Microsoft Defender for Endpoint didn't on-boarded

Question

Dear Team,

We have faced a problem while onboarding Microsoft defender for Endpoint.

We have run onboarding script through SCCM. From SCCM showing that the computers are compliant.

Then we have checked client machine registry value. Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status” found that OnboardingState is 1 which means agent was installed.

Then we run MDE client analyzer tools found that URL connectivity issue.

These urls also enabled from the network firewall. We have detect that through portqryUI tools. Found that urls are listening.

But showing the connectivity issue while execute MDE client analyzer tools.

Please help me to resolve this isue.

Thanks

Noyon

Answer 1

Hi, @Noyon Chandra Das

Thank you for posting in Microsoft Q&A forum.

We may check the result of the script on the device by going to Windows Logs > Application and looking for an event from WDATPOnboarding event source. If the script fails and the event is an error, we can check the event ID in the following table to help you troubleshoot the issue.

https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-onboarding#troubleshoot-onboarding-when-deploying-with-a-script

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Add comment".