Description

Service is starting (Version parameter).

Message #

Service is starting (Version %1).

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:26.283851+00:00",
    "event_record_id": 3366,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 5016
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "parameter": "10.8210.22621.457"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Occurs when the device is shut down or offboarded. Normal operating notification; no action required.

Message #

Service is shutting down.

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Windows Defender Advanced Threat Protection service failed to start. Failure code: HRESULT.

Message #

Windows Defender Advanced Threat Protection service failed to start. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Contacted server UInt1 times, all succeeded, URI: Message1.

Message #

Contacted server %1 times, all succeeded, URI: %2.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T10:27:45.275327+00:00",
    "event_record_id": 3527,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 3804
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "UInt1": 1,
    "Message1": "https://edr-cus3.us.endpoint.security.microsoft.com/edr/"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Contacted server UInt1 times, all failed, URI: Message1. Last HTTP error code: Int1.

Message #

Contacted server %1 times, all failed, URI: %2. Last HTTP error code: %3

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 5,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-17T21:56:13.502771+00:00",
    "event_record_id": 1840,
    "correlation": {},
    "execution": {
      "process_id": 4668,
      "thread_id": 9400
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "UInt1": 2,
    "Message1": "https://edr-cus3.us.endpoint.security.microsoft.com/edr/",
    "Int1": 0
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

The device didn't onboard correctly and isn't reporting to the portal. Onboarding must be run before starting the service. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See Onboard client devices.

Message #

Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found.

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure: parameter.

Message #

Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

During onboarding: The service failed to clean its configuration during the onboarding. The onboarding process continues. During offboarding: The service failed to clean its configuration during the offboarding. The offboarding process finished but the service keeps running. Onboarding: No action required. Offboarding: Reboot the system. See Onboard client devices.

Message #

Service failed to clean configuration settings.

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: HRESULT.

Message #

Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: HRESULT.

Message #

Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

The device onboarded correctly. Normal operating notification; no action required. It might take several hours for the device to appear in the portal.

Message #

Onboarding or re-onboarding of Windows Defender Advanced Threat Protection service completed.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-10T04:30:03.610987+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 4668,
      "thread_id": 10328
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

New cloud configuration failed to apply, version: parameter1. Also failed to apply last known good configuration, version parameter2. Also failed to apply the default configuration.

Message #

New cloud configuration failed to apply, version: %1. Also failed to apply last known good configuration, version %2. Also failed to apply the default configuration.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Windows Defender Advanced Threat Protection machine ID calculated: parameter.

Message #

Windows Defender Advanced Threat Protection machine ID calculated: %1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 13,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:32.581645+00:00",
    "event_record_id": 3370,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 5040
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "parameter": "56fa48c49fc36bc258ea812952082082ea2d7bf8"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Windows Defender Advanced Threat Protection cannot calculate machine ID. Failure code: HRESULT.

Message #

Windows Defender Advanced Threat Protection cannot calculate machine ID. Failure code: %1

Fields #

Description

Windows Defender Advanced Threat Protection cannot start command channel with URL: parameter.

Message #

Windows Defender Advanced Threat Protection cannot start command channel with URL: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: HRESULT.

Message #

Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Service will only start after any Windows updates have finished installing. Normal operating notification; no action required.

Message #

OOBE (Windows Welcome) is completed.

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Service will only start after any Windows updates finish installing. Normal operating notification; no action required. If this error persists after a system restart, ensure all Windows updates have full installed.

Message #

OOBE (Windows Welcome) has not yet completed.

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Cannot wait for OOBE (Windows Welcome) to complete. Failure code: HRESULT.

Message #

Cannot wait for OOBE (Windows Welcome) to complete. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Service failed to reset health status in the registry. Failure code: HRESULT.

Message #

Service failed to reset health status in the registry. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Windows Defender Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: HRESULT.

Message #

Windows Defender Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Failed to enable Windows Defender Advanced Threat Protection mode in Windows Defender. Onboarding process failed. Failure code: HRESULT.

Message #

Failed to enable Windows Defender Advanced Threat Protection mode in Windows Defender. Onboarding process failed. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Connected User Experiences and Telemetry service registration failed with failure code: HRESULT. Requested disk quota in MB: diskSizeQuotaValue, Requested daily upload quota in MB: dailyUploadQuotaValue.

Message #

Connected User Experiences and Telemetry service registration failed with failure code: %1. Requested disk quota in MB: %2, Requested daily upload quota in MB: %3

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Failed to read the offboarding parameters. Error type: errorType, Error code: HRESULT, Description: description.

Message #

Failed to read the offboarding parameters. Error type: %1, Error code: %2, Description: %3

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Failed to disable Windows Defender Advanced Threat Protection mode in Windows Defender. Failure code: HRESULT.

Message #

Failed to disable Windows Defender Advanced Threat Protection mode in Windows Defender. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: HRESULT.

Message #

Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Windows Defender Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: HRESULT.

Message #

Windows Defender Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Windows Defender Advanced Threat Protection service failed to persist SENSE GUID. Failure code: HRESULT.

Message #

Windows Defender Advanced Threat Protection service failed to persist SENSE GUID. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

An error occurred with the Windows telemetry service. Ensure the diagnostic data service is enabled. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See Onboard client devices running Windows or macOS.

Message #

An error occurred with the Windows telemetry service. Ensure the diagnostic data service is enabled. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See Onboard client devices running Windows or macOS.

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Communication quotas are updated. Disk quota in MB: diskSizeQuotaValue, daily upload quota in MB: dailyUploadQuotaValue.

Message #

Communication quotas are updated. Disk quota in MB: %1, daily upload quota in MB: %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 35,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:32.579826+00:00",
    "event_record_id": 3369,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 5040
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "diskSizeQuotaValue": 99,
    "dailyUploadQuotaValue": 99
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Connected User Experiences and Telemetry service registration succeeded with completion code: HRESULT. Requested disk quota in MB: diskSizeQuotaValue, requested daily upload quota in MB: dailyUploadQuotaValue.

Message #

Connected User Experiences and Telemetry service registration succeeded with completion code: %1. Requested disk quota in MB: %2, requested daily upload quota in MB: %3

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 36,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:46.945960+00:00",
    "event_record_id": 3381,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 4212
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0",
    "diskSizeQuotaValue": 99,
    "dailyUploadQuotaValue": 99
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Module: Module, Quota: {module} {quotaValue}, Percentage of quota utilization: quotaValueUnit.

Message #

Module: %1, Quota: {%2} {%3}, Percentage of quota utilization: %4.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

The device is using a metered/paid network and contacts the server less frequently. Normal operating notification; no action required.

Message #

Network connection is identified as low. Windows Defender Advanced Threat Protection will contact the server every %1 seconds. Metered connection: %2, internet available: %3, free network available: %4, proxy is defined by GP: %5.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 38,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T05:29:07.821216+00:00",
    "event_record_id": 3460,
    "correlation": {},
    "execution": {
      "process_id": 3688,
      "thread_id": 12520
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "pollingInterval": 120,
    "meteredConnectionState": false,
    "internetAvailabilityState": false,
    "freeNetworkAvailabilityState": false,
    "proxyDefined": false
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

The device isn't using a metered/paid connection and contacts the server as usual. Normal operating notification; no action required.

Message #

Network connection is identified as normal. Windows Defender Advanced Threat Protection will contact the server every %1 seconds. Metered connection: %2, internet available: %3, free network available: %4, proxy is defined by GP: %5.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 39,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:46.117651+00:00",
    "event_record_id": 3378,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 5040
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "pollingInterval": 120,
    "meteredConnectionState": false,
    "internetAvailabilityState": true,
    "freeNetworkAvailabilityState": true,
    "proxyDefined": false
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

The device has low battery level and contacts the server less frequently. Normal operating notification; no action required.

Message #

Battery state is identified as low. Windows Defender Advanced Threat Protection will contact the server every %1 seconds. AC state: %2, battery saver mode : %3, battery low state: %4, battery critical state: %5

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

The device doesn't have low battery level and contacts the server as usual. Normal operating notification; no action required.

Message #

Battery state is identified as normal. Windows Defender Advanced Threat Protection will contact the server every %1 seconds. AC state: %2, battery saver mode : %3, battery low state: %4, battery critical state: %5

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 41,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:46.117743+00:00",
    "event_record_id": 3379,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 5040
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "pollingInterval": 120,
    "acPowerState": true,
    "batterySavingState": false,
    "batteryLowState": false,
    "batteryCriticalState": false
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Internal error. The service failed to start. If this error persists, contact Support.

Message #

Component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception message: %4

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Internal error. The service failed to start. If this error persists, contact Support.

Message #

Component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception Error: %4, Exception message: %5

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

The service was offboarded. Normal operating notification; no action required.

Message #

Offboarding of Windows Defender Advanced Threat Protection service completed.

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Failed to register and to start the event trace session [TraceSessionName]. Error code: HRESULT.

Message #

Failed to register and to start the event trace session [%1]. Error code: %2

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

An error occurred on service startup while creating ETW session due to lack of resources. The service is running, but doesn't report sensor events until the ETW session starts. Normal operating notification; no action required. The service tries to start the session every minute.

Message #

Failed to register and start the event trace session [%1] due to lack of resources. Error code: %2. This is most likely because there are too many active event trace sessions. The service will retry in 1 minute.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

This event follows the previous event after successfully starting of the ETW session. Normal operating notification; no action required.

Message #

Successfully registered and started the event trace session - recovered after previous failed attempts.

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Failed to add a provider [ProviderId] to event trace session [TraceSessionName]. Error code: ErrorCode. This means that events from this provider will not be reported.

Message #

Failed to add a provider [%1] to event trace session [%2]. Error code: %3. This means that events from this provider will not be reported.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Invalid cloud configuration command received and ignored. Version: Version, status: Status, error code: HRESULT, message: ErrorMessage.

Message #

Invalid cloud configuration command received and ignored. Version: %1, status: %2, error code: %3, message: %4

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

New cloud configuration applied successfully. Version: parameter.

Message #

New cloud configuration applied successfully. Version: %1.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 50,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-18T21:51:39.113607+00:00",
    "event_record_id": 2199,
    "correlation": {},
    "execution": {
      "process_id": 3388,
      "thread_id": 7692
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "parameter": "10.8824.icm.752524955.2026.02.25.02-b0f8150134e39fffb9644c0884629b7ceb6f95b6"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

New cloud configuration failed to apply, version: parameter1. Successfully applied the last known good configuration, version parameter2.

Message #

New cloud configuration failed to apply, version: %1. Successfully applied the last known good configuration, version %2.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

New cloud configuration failed to apply, version: parameter1. Also failed to apply last known good configuration, version parameter2. Successfully applied the default configuration.

Message #

New cloud configuration failed to apply, version: %1. Also failed to apply last known good configuration, version %2. Successfully applied the default configuration.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Cloud configuration loaded from persistent storage, version: parameter.

Message #

Cloud configuration loaded from persistent storage, version: %1.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 53,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:28.128009+00:00",
    "event_record_id": 3368,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 5040
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "parameter": "10.8824.icm.752524955.2026.02.25.02-b0f8150134e39fffb9644c0884629b7ceb6f95b6"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Global (per-pattern) state changed. State: Value1, pattern: Value2.

Message #

Global (per-pattern) state changed. State: %1, pattern: %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 54,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:32:01.371209+00:00",
    "event_record_id": 3399,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 7148
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Value1": "0x1",
    "Value2": "0x9",
    "Value3": "{962D215C-F6D0-494D-BEEC-C71E8A2AC50E}"
  },
  "message": ""
}

Description

Failed to create the Secure ETW autologger. Failure code: HRESULT.

Message #

Failed to create the Secure ETW autologger. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Failed to remove the Secure ETW autologger. Failure code: HRESULT.

Message #

Failed to remove the Secure ETW autologger. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

An investigation package, also known as forensics package, is being collected. Normal operating notification; no action required.

Message #

Capturing a snapshot of the machine for troubleshooting purposes.

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Starting command: parameter.

Message #

Starting command: %1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 59,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-11T00:56:32.102827+00:00",
    "event_record_id": 381,
    "correlation": {},
    "execution": {
      "process_id": 4668,
      "thread_id": 680
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "parameter": "incidentresponsecommand"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Failed to run command CommandName, error: HRESULT.

Message #

Failed to run command %1, error: %2.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 60,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:40:08.797847+00:00",
    "event_record_id": 2808,
    "correlation": {},
    "execution": {
      "process_id": 3952,
      "thread_id": 5916
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "CommandName": "incidentresponsecommand",
    "HRESULT": "0xffffffff80192ee2"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Data collection command parameters are invalid: SasUri: SasUri, compressionLevel: CompressionLevel.

Message #

Data collection command parameters are invalid: SasUri: %1, compressionLevel: %2.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Failed to start Connected User Experiences and Telemetry service. Failure code: HRESULT.

Message #

Failed to start Connected User Experiences and Telemetry service. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Updating the start type of external service. Name: ServiceName, actual start type: ActualStartType, expected start type: ExpectedStartType, exit code: ErrorCode.

Message #

Updating the start type of external service. Name: %1, actual start type: %2, expected start type: %3, exit code: %4

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 63,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-10T04:35:06.343019+00:00",
    "event_record_id": 45,
    "correlation": {},
    "execution": {
      "process_id": 4668,
      "thread_id": 4292
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ServiceName": "wlidsvc",
    "ActualStartType": 4,
    "ExpectedStartType": 3,
    "ErrorCode": "0x0"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Starting stopped external service. Name: Starting_stopped_external_service_Name, exit code: exit_code.

Message #

Starting stopped external service. Name: %1, exit code: %2

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Failed to load Microsoft Security Events Component Minifilter driver. Failure code: HRESULT.

Message #

Failed to load Microsoft Security Events Component Minifilter driver. Failure code: %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Policy update: Latency mode - parameter.

Message #

Policy update: Latency mode - %1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 66,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:46.117193+00:00",
    "event_record_id": 3377,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 5040
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "parameter": "demo"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Contacted server Last_HTTP_error_code times, failed UInt1 times and succeeded UInt2 times. URI: UInt3. Last HTTP error code: Message1.

Message #

Contacted server %1 times, failed %2 times and succeeded %3 times. URI: %4. Last HTTP error code: %5

Fields #

Description

The start type of the service is unexpected. Service name: ServiceName, actual start type: ActualStartType, expected start type: ExpectedStartType.

Message #

The start type of the service is unexpected. Service name: %1, actual start type: %2, expected start type: %3

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 68,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:32:46.137351+00:00",
    "event_record_id": 3409,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 2544
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ServiceName": "WpnService",
    "ActualStartType": 4,
    "ExpectedStartType": 2
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

The service is stopped. Service name: parameter.

Message #

The service is stopped. Service name: %1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 69,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:32:46.137777+00:00",
    "event_record_id": 3410,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 2544
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "parameter": "WpnService"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Policy update: Allow sample collection - UInt1.

Message #

Policy update: Allow sample collection - %1

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Succeeded to run command: parameter.

Message #

Succeeded to run command: %1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 71,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-11T00:56:33.194261+00:00",
    "event_record_id": 383,
    "correlation": {},
    "execution": {
      "process_id": 4668,
      "thread_id": 680
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "parameter": "incidentresponsecommand"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Tried to send first full machine profile report. Result code: HRESULT.

Message #

Tried to send first full machine profile report. Result code: %1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 72,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:46.912867+00:00",
    "event_record_id": 3380,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 7104
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Sense starting for platform: platformBitMask.

Message #

Sense starting for platform: %1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SENSE",
    "guid": "FAE96D09-ADE1-5223-0098-AF7B67348531",
    "event_source_name": "",
    "event_id": 73,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:26.327796+00:00",
    "event_record_id": 3367,
    "correlation": {},
    "execution": {
      "process_id": 3632,
      "thread_id": 5040
    },
    "channel": "Microsoft-Windows-SENSE/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "platformBitMask": "0x1001"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Description

Device tag in registry exceeds length limit. Tag name: Message1. Length limit: UInt1.

Message #

Device tag in registry exceeds length limit. Tag name: %2. Length limit: %1.

Fields #