Forum Discussion
Spurious health alerts with sensor 2.241.18721.18894
MicrosoftThis is indeed a new health alert added in the last version.
If you feel that it is false, meaning you don't have LSO enabled for sure,
Open a support case.
I advise to attach the output of this powershell command to the case notes:
(Get-CimInstance -Namespace root\standardcimv2 -Query "SELECT * FROM MSFT_NetAdapterAdvancedPropertySettingData WHERE InstanceID LIKE '%YOUR_ADAPTER_ID%' AND DisplayName LIKE 'Large Send Offload%'") | Where-Object { $_.DisplayValue -eq 'Enabled' } | ForEach-Object { $true } | Select-Object -First 1
or run this WMI query any other way like wmic:
wmic /namespace:\\root\standardcimv2 path MSFT_NetAdapterAdvancedPropertySettingData where "InstanceID like '%YOUR_ADAPTER_ID%' and DisplayName like 'Large Send Offload%'" get DisplayValue
Make sure to replace your adapter id, you can get it with something like this:
Get-CimInstance -Namespace root\standardcimv2 -ClassName MSFT_NetAdapter | Select-Object Name, InstanceID
The sensor logic that reports the health alert uses something very close to that to decide if there is an issue.
One more note when checking for LSO, keep in mind to check both ipv4 and ipv6.
Thanks for the reply. I did indeed open a support case, and the support engineer quickly pointed me in the right direction. My confusion arose from looking at the NIC driver GUI option "IPv4 TSO Offload" as shown on the https://learn.microsoft.com/en-us/defender-for-identity/troubleshooting-known-issues#vmware-virtual-machine-sensor-issue. I had assumed that setting this option to Disabled was sufficient. This option in the GUI does not correspond to "Large Send Offload v2" as detected by the new sensor and set by the Powershell commands provided on the same doc page. In the NIC driver GUI, these appear as "Large Send Offload V2 (IPv4)" and "Large Send Offload V2 (IPv6)"