Windows Defender Advanced Threat Protection Service failed to start

[Fhaddad81]

Good Day,

I have one PC Microsoft Windows 11 Enterprise couldn’t be onboarded because Windows Defender Advanced Threat Protection Network Detection and Response could not be started. Event ID 101 is being logged under Microsoft-Windows-SENSE/Operational with below error "Windows Defender Advanced Threat Protection Network Detection and Response executable failed to start. Failure code: 0x8007051A"

Thanks

[#2 · Accepted solution]

looking up the error with errorlookup in cmtrace:
"Indicates two revision levels are incompatible.
Source: Windows"

did you offboard, reboot, onboard?

[#3]

do yo fix this issue?

[#4]

Not Yet. I will keep you posted.

[#5]

The device was not onboarded before , but i will offboard it then onboard . I will keep you posted.

[#6]

I try this not help.

[#7]

After trying to offboard then restart it , I onboarded it successfully . most probably the error appeared because this pc was renamed

[#8]

@Fhaddad81 

i try this on same machine and this not help. We have this on all W2022 servers.

[#9]

@Marek_Belan Do you receive the same error on event viewer under sense folder? What other errors do you receive? May be you need to change device ID and create a new certificate. 

[#10]

Yes the same error. new ID need reinstall machine i think so this is not the way for xxx servers.

[#11]

So if you have many devices with the same error and we're not onboarded , I recommend to open a support case with Microsoft

[#12]

The error code 0x8007051a indicates that the process cannot access the file because it is being used by another process. This issue typically arises when there are conflicts or access issues within the system or with other applications. Here are some steps to troubleshoot and resolve this issue:

Check for Conflicting Applications:

Ensure no other security software or network-related tools are running that might conflict with Windows Defender Advanced Threat Protection (ATP).
Update Windows Defender ATP:

Make sure Windows Defender ATP and all its components are up to date. Check for any updates or patches from Microsoft.
Restart the Service:

Restart the Windows Defender ATP service. Open a Command Prompt with administrative privileges and run the following commands:
sh

net stop Sense
net start Sense
Check System Logs:

Open the Event Viewer and check the system and application logs for more detailed error messages that could give more context about the issue.
Permissions Check:

Ensure that the Windows Defender ATP service has the necessary permissions to access the required files and directories. You can do this by checking the service account and its permissions in the Services console.
Repair or Reinstall Windows Defender ATP:

If the issue persists, consider repairing or reinstalling Windows Defender ATP. This can be done via the Settings app under Apps & Features.
Check Disk Health:

Sometimes file access issues can be due to disk errors. Run a disk check to ensure there are no underlying issues with the disk:
sh

chkdsk /f
SFC and DISM Commands:

Run the System File Checker (SFC) and Deployment Imaging Service and Management Tool (DISM) to repair any corrupted system files:
sh

sfc /scannow
dism /online /cleanup-image /restorehealth

[#13]

OMG in which universe this work?
net stop Sense
net start Sense

this is from chatGPT or what?????????

[#14]

I have noticed the same error on all our Windows Server 2022 onboarded machines. Not seeing it on any other machines with different OS versions.

Has anyone opened a support request with Microsoft about it?

[#15]

@cjg000 I did not open a ticket with microsoft.  Make sure that your servers are up to date and defender components as well (Engine and paltform).

 If possible run mdeanalyzer and posted here to check.

[#16]

https://learn.microsoft.com/en-us/windows/release-health/status-windows-server-2022#326msgdesc

[#17]

Thank you for the link. Good to know they have confirmed it as a known issue.