ATP onboarding problem

Question

We have onboarding policy on MECM.
Today i see some problem in ATPHandler.log.
On all servers we have this :
ATPHandler: Handling policy originating from AdminConsole: AdvancedThreatProtectionSettings_WorkspaceKey
ATPHandlerUtils: Native Support.
ATPHandler: MDE agent supports natively.
ATPHandler: HandleOnboardingRule for WinServer1803 or above or Win10 or if MDE is supported ATPHandler: AllowSampleCollection is already at the expected value: '1'
ATPHandler: TelemetryReportingFrequency is already at the expected value: 'normal'
ATPHandler: OnboardingState: 1
ATPHandler: Service is onboarded to a different account. The device needs to be offboarded before onboarding to a different account.
ATPHandler: Offboard from current workspace before onboarding to a new one.
ATPHandler: ATP Service was not onboarded to the intended account, setting non-compliance.

I try offboard one server, then onboard it , this was ok but after some time problem is in log again.
In Microsoft 365 defender is all Ok , machines are reporting, they are green , in eventlog is all OK.

Whats the problem ?

Answer 1

Hello BelanMarek

From the error: "Service is onboarded to a different account. The device needs to be offboarded before onboarding to a different account." it seems that the device was already onboarded using a different account and the only solution would be to Offboard first the device and onboard again with the current account.

For the offboarding you can use the scripts provided by Microsoft here: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/offboard-machines?view=o365-worldwide

-------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--