This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(169.60000000000002, 0%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVE%3C/text%3E%3C/svg%3E)
A couple days ago, something tried to start the "Sense" service, display name "Windows Defender Advanced Threat Protection Service", (start on demand). It apparently crashed and the service manager tried every 5 minutes to restart it (in accordance with its recovery options). I wound up with quite a few dump files with names like "MsSense.exe.7736.protected.dmp". A reboot stopped it. The system event log (starting in July 2021) says this hadn't happened before. If I manually try to start it (with services.msc) I get a message box saying it unexpectedly stopped and the whole thing starts again (retry every 5 minutes and crash dumps). Otherwise, there are no complaints from Windows. These are running and the security tray icon has the OK checkmark.
mpssvc Windows Defender Firewall
WinDefend Microsoft Defender Antivirus Service
WdNisSvc Microsoft Defender Antivirus Network Inspection Service
I'd like to figure out what's going on and fix it. My first attempts at capitalizing on the dump files failed because (1) WinDBG could not open the DMP file and (2) KernelDumpDecrypt.exe could not decrypt it.
Are there any suggestions on fixing the problem itself or on unlocking the dump files? Thanks!
Here is more info that I just found in Sense's own event log folder. Apparently it had never run before this incident. The strings in its earliest entries, prefaced with the event level, are these (which repeat).
Info - Service is starting (Version 10.8210.19041.2006).
Info - Sense starting for platform: 0x1001
Info - Cloud configuration loaded from persistent storage, version: 0.0.0.0.
Error - Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found.
Info - Service is shutting down.
Info - Windows Defender Advanced Threat Protection machine ID calculated: e5efce7d6395e9fa764f2d0acd566279c44c6070
Info - Windows Defender Advanced Threat Protection service successfully generated a key.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 71%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Same problem on group of Windows 11 devices.
Error: "Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found."
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(230.39999999999998, 6%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMB%3C/text%3E%3C/svg%3E)
Did you install the sensor before running the onboarding script? If so, you can manually start the service you just have to take ownership of the Windows Defender ATP keys and then you can switch its start type to automatic. HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection