Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity

When a device is missing from the Defender portal, reports only now and then, or won't offboard cleanly, the sensor's own event log usually names the problem. This quick reference groups the SENSE event IDs you're most likely to meet, with the usual cause and the first check. The meanings follow Microsoft's event table; the checks are practical next steps.

How to read these codes#

SENSE is Microsoft's internal name for the behavioral sensor behind Defender for Endpoint. It logs to Applications and Services Logs › Microsoft › Windows › SENSE › Operational (Microsoft-Windows-SENSE/Operational). Most messages include a value filled in at runtime, such as a failure code, URL, service name or limit, and that value often tells you more than the ID. Filter on Critical, Error and Warning to find problems, but keep the informational events in view: they show what "good" looks like.

# Errors and warnings from the sensor log in the last 24 hours
Get-WinEvent -FilterHashtable @{
    LogName   = 'Microsoft-Windows-SENSE/Operational'
    Level     = 1, 2, 3
    StartTime = (Get-Date).AddHours(-24)
} | Select-Object TimeCreated, Id, LevelDisplayName, Message |
    Format-Table -AutoSize -Wrap

• The onboarding script has its own numbers. Onboarding scripts log to Windows Logs › Application under the source WDATPOnboarding, and the IDs overlap: script event 40 means the onboarding status isn't 1, while SENSE event 40 means the battery is low.
• MDM events can sit in a second log. The event table includes CSP events (1800 to 1840), recorded when an MDM service such as Intune reads or writes Defender for Endpoint values, and Microsoft's onboarding guide shows event 1819 in DeviceManagement-Enterprise-Diagnostics-Provider › Admin. Check both logs.
• Many IDs are routine. Treat an event as a problem when it's an error that repeats, or when it matches your symptom.

Start-up and onboarding events#

Service start-up and Windows setup#

Onboarding#

Offboarding#

Telemetry and dependent service events#

The sensor works with other Windows services, notably Connected User Experiences and Telemetry (DiagTrack). Since Windows 10 version 1809 the EDR service doesn't depend directly on DiagTrack, but Microsoft still advises checking it when devices aren't reporting correctly: sc qc diagtrack should show AUTO_START.

Events 63, 64, 86 and 88 record the sensor fixing a start type or restarting a service by itself. They're informational, but find out what keeps changing the start type, and contact support if event 64 keeps reappearing.

Connectivity, authentication and upload events#

The sensor connects over WinHTTP in the system context, so the proxy that matters is what netsh winhttp show proxy reports (or a static proxy set for the sensor), not the browser's.

Sensor components, configuration and MDM events#

Event tracing and drivers#

Cloud configuration, tags and running mode#

Intune and other MDM (CSP) events#

In the System log#

For installer errors on Windows Server 2012 R2 and 2016, see the unified solution guide.

How to verify a fix#

1. Restart the device and confirm sc.exe query sense reports RUNNING and OnboardingState is 1.
2. Read the log since the restart: a healthy start shows event 1 (service started) and event 4 (contacted the server), usually with 50 or 53 for the cloud configuration, and no new errors from the tables above.
3. In the Microsoft Defender portal, open Assets › Devices and check the device's sensor health state is Active with a current last-seen time. For Intune-managed devices, Endpoint security › Endpoint detection and response › EDR Onboarding Status should show it as onboarded.
4. If connectivity was the problem, rerun the Client Analyzer and confirm the service URLs pass.

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' |
    Select-Object OnboardingState, OrgId
$boot = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-SENSE/Operational'; StartTime = $boot } |
    Where-Object Id -in 1, 4, 50, 53 | Select-Object TimeCreated, Id, Message

References#

• Review events and errors using Event Viewer (source of the event table)
• Troubleshoot Microsoft Defender for Endpoint onboarding issues