Windows Server 2022 – Defender for Endpoint sensor unhealthy after proxy change – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Endpoint telemetry drops and server appears inactive in security portal, reducing detection coverage.

Environment & Reproduction

Appears after outbound proxy or SSL inspection changes.

Get-MpComputerStatus
Test-NetConnection  -Port 443

Root Cause Analysis

Sensor cannot reach required cloud endpoints due to proxy auth/certificate interception mismatch.

Quick Triage

Validate service status and proxy configuration applied to LocalSystem context.

Step-by-Step Diagnosis

Collect Defender connectivity analyzer output and review onboarding logs.

Get-Service Sense
Get-WinEvent -LogName Microsoft-Windows-SENSE/Operational -MaxEvents 200

Solution – Primary Fix

Correct proxy allowlist/bypass for Defender endpoints and restart sensor service.

netsh winhttp show proxy
Restart-Service Sense

Solution – Alternative Approaches

Redeploy onboarding package after connectivity restoration if sensor registration remains stale.

Verification & Acceptance Criteria

Device reports healthy in portal and telemetry timestamp updates within expected SLA.

Rollback Plan

Reapply prior proxy baseline and disable recent SSL inspection policy for server segment.

Prevention & Hardening

Test security tooling endpoints in change windows before proxy policy promotion.

Related Errors & Cross-Refs

Related to TLS interception trust failures and outdated onboarding packages.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn: Defender for Endpoint server onboarding and network endpoint requirements.