Microsoft Defender for Endpoint not Onboarding

Question

Hello,

My team is having trouble onboarding Microsoft Defender for Endpoint because the Advanced Threat Protection Service won't start. It looks like the SENSE service is also not starting and is stuck in START_PENDING. I tried rebooting the device and updating the machine, but it did not work. Do you have any other suggestions? The SENSE service is also not showing up in the Services inventory.

Answer 1

Hello @Trent Nolin ,
Thank you for your question.
I can see that you have already tried the steps provided on this troubleshooting guide doc and the error is persistent. https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-onboarding.

You can attempt these steps below to Help resolve the issue:

1. Get values of these registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus

1. Change the values of these registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus  "GeneralizationState" DWORD value to 7"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State  ImageState to “IMAGE_STATE_COMPLETE”

Also, the State information is saved in %WINDIR%\Setup\State\State.ini

If the registry change (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State) is not persistent, then try changing the machine state in State.ini file and test.

With the above changes, reboot the machine and ensure test.

I hope this helps to resolve your issue.
If you find the answer above helpful, please Accept the answer to help anyone in the community who might have a similar question to quickly find the solution.