This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
A couple days ago, something tried to start the "Sense" service, display name "Windows Defender Advanced Threat Protection Service", (start on demand). It apparently crashed and the service manager tried every 5 minutes to restart it (in accordance with its recovery options). I wound up with quite a few dump files with names like "MsSense.exe.7736.protected.dmp". A reboot stopped it. The system event log (starting in July 2021) says this hadn't happened before. If I manually try to start it (with services.msc) I get a message box saying it unexpectedly stopped and the whole thing starts again (retry every 5 minutes and crash dumps). Otherwise, there are no complaints from Windows. These are running and the security tray icon has the OK checkmark.
mpssvc Windows Defender Firewall
WinDefend Microsoft Defender Antivirus Service
WdNisSvc Microsoft Defender Antivirus Network Inspection Service
I'd like to figure out what's going on and fix it. My first attempts at capitalizing on the dump files failed because (1) WinDBG could not open the DMP file and (2) KernelDumpDecrypt.exe could not decrypt it.
Are there any suggestions on fixing the problem itself or on unlocking the dump files? Thanks!
Here is more info that I just found in Sense's own event log folder. Apparently it had never run before this incident. The strings in its earliest entries, prefaced with the event level, are these (which repeat).
Info - Service is starting (Version 10.8210.19041.2006).
Info - Sense starting for platform: 0x1001
Info - Cloud configuration loaded from persistent storage, version: 0.0.0.0.
Error - Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found.
Info - Service is shutting down.
Info - Windows Defender Advanced Threat Protection machine ID calculated: e5efce7d6395e9fa764f2d0acd566279c44c6070
Info - Windows Defender Advanced Threat Protection service successfully generated a key.
"Windows Defender Advanced Threat Protection" is the enterprise product.
you could try Troubleshoot Microsoft Defender for Endpoint onboarding issues
I've seen that one before. I have no idea what onboarding is, or why it would become a problem after more than a year of the Sense service never trying start (EventLog\Apps&services\MS\Windows\Sense).
That article mentions that DiagTrack is needed. I reconfigured DiagTrack (disabled -> automatic) and rebooted. The problem remains.
Hi,
Thank you for your question and reaching out.
I understand that you're getting the "Windows Defender Advanced Threat Protection Service". We often encounter this kind of scenario if there are compatibility issues with the apps and drivers on the PC that prevent it from running other processes. We can first try to perform a clean boot process which disables some of the third-party services that might be conflicting with the Microsoft services which causes the message to appear every time.
You may refer to this link for the steps on how to perform clean boot: https://support.microsoft.com/en-us/topic/how-to-perform-a-clean-boot-in-windows-da2f9573-6eec-00ad-2f8a-a97a1807f3dd
-------------------------------------------------------------------------------------------------------------------------------------------
--If the reply is helpful, please Upvote and Accept as answer--
It's been a few weeks and no other info has been posted. I've been working on same problem for a couple months. Have seen this and MANY other people with this same problem and I have not seen ONE solution that works. What is up with this MSsense.exe crashing and starting and stopping all the time? Has "anyone" ever found an answer? I have gone to the point of doing an "in place" rebuild and repair and the problem continues. Even disabled Windows defender after installing and trying several 3rd party anti-viruses and my system had NO Defender (was automatically turned off when the 3rd party AV was installed). And STILL the MsSense service is running and crashing. I've tried to stop the service and windows won't stop it. Can not stop, uninstall or remove the Mssense.exe from crashing every five minutes as long as the PC is turned on.
Anyone else had this problem and actually solved it?
I am receiving Error 15: Failed to start SENSE service. While Onboarding the Defender Service was not able to start. and if I try to run manually it says the service is not responding to the control function. It was observed on Server 2019 Core Edition. The Defender Advanced Threat Protection Service not able to run. If anyone has some updates Please post. I am also working with MS support, but unfortunately no resolution yet