Forum Discussion

MarcVDH's avatar
MarcVDH
Iron Contributor
Oct 14, 2024

SenseNdr.exe is slowly eating the memory

Hello, For a few days now, we have some Windows Server 2019 physical machines where almot all the memory is commited to sensendr.exe. If you terminate sensendr.exe, the process comes back after...
mjhelmb's avatar
mjhelmb
Copper Contributor
Oct 17, 2024

We started seeing this on 12 machines beginning 10/8. They will last a few days before running out of memory. Adding more memory only delayed the issue. 

 

Server 2022 with both the September 2024 and October 2024 patches. 

 

The only thing special about these machines is that they are on an isolated network using a proxy for Defender only. Anyone else in that scenario?

 

  • Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus

    • Define proxy server for connecting to the network: enabled

  • Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds

    • Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service: enabled

    • Configure Connected User Experiences and Telemetry: enabled

  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
    • PreferStaticProxyForHttpRequest set to REG_DWORD 0x1

 

Resources