Troubleshoot onboarding issues related to Security Management for Microsoft Defender for Endpoint

Security Management for Microsoft Defender for Endpoint is a capability for devices that aren’t managed by a Microsoft Endpoint Manager, either Microsoft Intune or Microsoft Endpoint Configuration Manager, to receive security configurations for Microsoft Defender for Endpoint directly from Endpoint Manager. For more information on Security Management for Microsoft Defender for Endpoint, see Manage Microsoft Defender for Endpoint on devices with Microsoft Endpoint Manager.

For Security Management for Microsoft Defender for Endpoint onboarding instructions, see Microsoft Defender for Endpoint Security Configuration Management

This end-to-end onboarding is designed to be frictionless and doesn’t require user input. However, if you encounter issues during onboarding, you can view and troubleshoot errors within the Microsoft Defender for Endpoint platform.

For more information about the client analyzer, see Troubleshoot sensor health using Microsoft Defender for Endpoint Client Analyzer.

wp-signup.phping domain joined computers with Azure Active Directory

To successfully wp-signup.php devices to Azure Active Directory, you’ll need to ensure the following:

• Computers can authenticate with the domain controller
• Computers have access to the following Microsoft resources from inside your organization’s network:
  • https://enterpriseregistration.windows.net
  • https://login.microsoftonline.com
  • https://device.login.microsoftonline.com
• Azure AD connect is configured to sync the computer objects. By default, computer OUs are in Azure AD connect sync scope. If the computer objects belong to specific organizational units (OUs), configure the OUs to sync in Azure AD Connect. To learn more about how to sync computer objects by using Azure AD Connect, see Organizational unit–based filtering.

Troubleshoot errors from the Microsoft Defender for Endpoint portal

Through the Microsoft Defender for Endpoint portal, security administrators can now troubleshoot Security Management for Microsoft Defender for Endpoint onboarding.

In Endpoints > Device inventory, the Managed By column has been added to filter by management channel (for example, MEM).

To see a list of all devices that have failed the Security Management for Microsoft Defender for Endpoint onboarding process, filter the table by MDE-Error.

In the list, select a specific device to see troubleshooting details in the side panel, pointing to the root cause of the error, and corresponding documentation.

Run Microsoft Defender for Endpoint Client Analyzer on Windows

Consider running the Client Analyzer on endpoints that are failing to complete the Security Management for Microsoft Defender for Endpoint onboarding flow. For more information about the client analyzer, see Troubleshoot sensor health using Microsoft Defender for Endpoint Client Analyzer.

The Client Analyzer output file (MDE Client Analyzer Results.htm) can provide key troubleshooting information:

• Verify that the device OS is in scope for Security Management for Microsoft Defender for Endpoint onboarding flow in General Device Details section
• Verify that the device has successfully wp-signup.phped to Azure Active Directory in Device Configuration Management Details

  

In the Detailed Results section of the report, the Client Analyzer also provides actionable guidance.

For example, as part of the Security Management onboarding flow, it is required for the Azure Active Directory Tenant ID in your Microsoft Defender for Endpoint Tenant to match the SCP Tenant ID that appears in the reports’ Device Configuration Management Details section. If relevant, the report output will recommend to perform this verification.

General troubleshooting

If you weren’t able to identify the onboarded device in AAD or MEM, and did not receive an error during the enrollment, checking the registry key Computer\\HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SenseCM\\EnrollmentStatus can provide additional troubleshooting information.

The following table lists errors and directions on what to try/check in order to address the error. Note that the list of errors is not complete and is based on typical/common errors encountered by customers in the past:

Azure Active Directory Runtime troubleshooting

Azure Active Directory Runtime

The main mechanism to troubleshoot Azure Active Directory Runtime (AADRT) is to collect debug traces. Azure Active Directory Runtime on Windows uses ETW provider with ID bd67e65c-9cc2-51d8-7399-0bb9899e75c1. ETW traces need to be captured with the reproduction of the failure (for example if join failure occurs, the traces need to be enabled for the duration of time covering calls to AADRT APIs to perform join).

See below for a typical error in AADRT log and how to read it:

From the information in the message, it’s possible in most cases to understand what error was encountered, what Win32 API returned the error (if applicable), what URL (if applicable) was used and what AAD Runtime API error was encountered.

Instructions for applying Computer Join rule in AAD Connect

For Security Management for Microsoft Defender for Endpoint on Windows Server 2012 R2 domain joined computers, an update to Azure AD Connect sync rule “In from AD-Computer Join” is needed. This can be achieved by cloning and modifying the rule, which will disable the original “In from AD – Computer Join” rule. Azure AD Connect by default offers this experience for making changes to built-in rules.

1. Open the Synchronization Rules Editor application from the start menu. In the rule list, locate the rule named In from AD – Computer Join. Take note of the value in the ‘Precedence’ column for this rule.

   

2. With the In from AD – Computer Join rule highlighted, select Edit. In the Edit Reserved Rule Confirmation dialog box, select Yes.

   

3. The Edit inbound synchronization rule window will be shown. Update the rule description to note that Windows Server 2012R2 will be synchronized using this rule. Leave all other options unchanged except for the Precedence value. Enter a value for Precedence that is higher than the value from the original rule (as seen in the rule list).

   

4. Select Next three times. This will navigate to the ‘Transformations’ section of the rule. Do not make any changes to the ‘Scoping filter’ and ‘Join rules’ sections of the rule. The ‘Transformations’ section should now be shown.

   

5. Scroll to the bottom of the list of transformations. Find the transformation for the cloudFiltered attribute. In the textbox in the Source column, select all of the text (Control-A) and delete it. The textbox should now be empty.
6. Paste the content for the new rule into the textbox.
   commandCopy

   IIF(
     IsNullOrEmpty([userCertificate])
     || 
     (
       (InStr(UCase([operatingSystem]),"WINDOWS") > 0)
       && 
       (Left([operatingSystemVersion],2) = "6.")
       &&
       (Left([operatingSystemVersion],3) <> "6.3")
     )
     ||
     (
       (Left([operatingSystemVersion],3) = "6.3") 
       &&
       (InStr(UCase([operatingSystem]),"WINDOWS") > 0)
       &&
       With(
         $validCerts,
         Where(
           $c, 
           [userCertificate], 
           IsCert($c) && CertNotAfter($c) > Now() && RegexIsMatch(CertSubject($c), "CN=[{]*" & StringFromGuid([objectGUID]) & "[}]*", "IgnoreCase")),
         Count($validCerts) = 0)
     ),
     True,
     NULL
   )
   
   

7. Select Save to save the new rule.