Edit

Troubleshoot agent health issues

Defender for Endpoint health status

The following table provides information about the values that are returned when you run the mdatp health command and their corresponding descriptions.

Value Description
app_version Displays Microsoft Defender application version.
automatic_definition_update_enabled True if automatic antivirus definition updates are enabled; otherwise, false.
cloud_automatic_sample_submission_consent Current sample submission level.

Can have one of the following values:
- None: No suspicious samples are submitted to Microsoft.
- safe: Only suspicious samples that don't contain personal data are submitted automatically. This value is the default value for this setting.
- All: All suspicious samples are submitted to Microsoft.
cloud_diagnostic_enabled True if optional diagnostic data collection is enabled; otherwise, false.

For more information related to Defender for Endpoint and other products and services like Microsoft Defender Antivirus and Windows, see Microsoft Privacy Statement.
cloud_enabled True if cloud-delivered protection is enabled; otherwise, false.
cloud_pin_certificate_thumbs pinned cloud certificate's thumbprints.
conflicting_applications List of applications that are possibly conflicting with Microsoft Defender for Endpoint. This list includes, but isn't limited to, other security products and other applications known to cause compatibility issues.
data_loss_prevention_status Status of data loss prevention. Can have one of the following values:
- unknown
- unsupported_os
- unsupported_os_version
- disabled
- unhealthy
- dormant
- ready
- active
definitions_status Status of antivirus definitions. Can have one of the following values:
- up_to_date
- updating
- unavailable
definitions_updated Date and time of last antivirus definition update.
definitions_updated_minutes_ago Number of minutes since last antivirus definition update.
definitions_version Antivirus definition version.
edr_client_version Version of the EDR client running on the device.
device_control_enforcement_level Device control activation statue.
edr_configuration_version EDR configuration version.
edr_device_tags List of tags associated with the device.
edr_early_preview_enabled Setting of EDR early preview. Can have one of the following values:
- disabled
- enabled
edr_group_ids Group ID that the device is associated with.
edr_machine_id Device identifier used in the Microsoft Defender portal.
engine_load_status Status of antivirus engine to determine whether it's running.

Can have one of the following values:
- Engine not loaded - antivirus engine process is down
- Engine load succeeded - antivirus engine process is up and running
engine_version Version of the antivirus engine.
healthy True if the product is healthy; otherwise, false.
health_issues Lists health issues if any.
licensed True if the device is onboarded to a tenant; otherwise, false.
log_level Current log level for the product.

Can have one of the following values:
- info
- debug
machine_guid Unique machine identifier used by the antivirus component.
network_protection_enforcement_level Mode of network protection.

Can have one of the following values:
- disabled - all components associated with network protection are disabled
- block - network protection prevents connection to malicious websites
- audit - Check how blocks occur
network_protection_status Status of the network protection component (macOS only).

Can have one of the following values:
- starting - Network protection is starting
- failed_to_start - Network protection couldn't be started due to an error
- started - Network protection is running on the device
- restarting - Network protection is restarting
- stopping - Network protection is stopping
- stopped - Network protection isn't running
org_id Organization that the device is onboarded to. If the device isn't yet onboarded to any organization, it shows as unavailable. For more information on onboarding, see Onboard to Microsoft Defender for Endpoint.
passive_mode_enabled True if the antivirus component is set to run in passive mode; otherwise, false.
product_expiration Date and time when the current product version reaches end of support.
real_time_protection_available True if the real-time protection component is healthy; otherwise, false.
real_time_protection_enabled True if real-time antivirus protection is enabled; otherwise, false.
real_time_protection_subsystem Subsystem used to serve real-time protection. If real-time protection isn't operating as expected, it shows as unavailable.
release_ring Release ring. For more information, see Deployment rings.
tamper_protection Status of tamper protection feature.

Can have one of the following values:
- disabled - tamper protection is off.
- audit - tamper protection is on but doesn't block any event.
- block - tamper protection is monitoring events and block them as needed.
troubleshooting_mode True if Defender for Endpoint is in troubleshooting mode; otherwise, false. see Troubleshooting mode.

Component specific health

You can get more detailed health information for different features in Defender for Endpoint by using the command, mdatp health --details <feature>. Here are some examples:


mdatp health --details permissions

mdatp health --details system_extensions

mdatp health --details edr

mdatp health --details definitions

mdatp health --details features

mdatp health --details help

You can run mdatp health --help on recent versions to list all supported features.

See also

  • Last updated on