Issue with Windows Server 2022 Defender Onboarding

Since offboarding and re-onboarding were already tried multiple times, focus on device-side verification to find why the server remains Can be onboarded.

1. Verify the Defender for Endpoint sensor service is running. Run these commands in an elevated Command Prompt:

      sc.exe query sense
      sc.exe query Windefend
   

   • sense should show as running.
   • If Windefend returns The specified service doesn't exist as an installed service, Microsoft Defender Antivirus must be installed.
2. Check the local onboarding error log. Open Event Viewer and go to: Applications and Services Logs > Microsoft > Windows > SENSE > Operational Filter for Critical, Warning, and Error. Pay attention to these documented cases:
   • Event ID 5: service failed to connect to the server → verify Internet access.
   • Event ID 6: no onboarding parameters were found → run the onboarding script again.
   • Event ID 7: failed to read onboarding parameters → verify Internet access, then run the full onboarding process again.
   • Event ID 9 during onboarding: reboot, then re-run onboarding.
3. Verify the diagnostic data service. In an elevated Command Prompt, run:

      sc qc diagtrack
   

   START_TYPE should be AUTO_START. If it is not, set it and start the service:

      sc config diagtrack start=auto
      sc qc diagtrack
      sc start diagtrack
   

4. Confirm connectivity requirements from the server. Defender for Endpoint uses WinHTTP for sensor communication. Even if general outbound access is open, the sensor still must be able to reach the Defender for Endpoint service endpoints correctly. If connectivity verification fails in the documented checks, review proxy and Internet connectivity settings.
5. Check whether the device appears in the Defender portal device inventory. In the Defender portal, go to Assets > Devices and confirm whether the server is present there at all. If deployment tools show success but the device still does not appear correctly after about an hour, continue with the local event log and service checks above.
6. If onboarding tooling is not reporting a clear error, use the local onboarding script again from the portal and run it in an elevated Command Prompt.
7. If this server is being treated like an older server onboarding path, verify the older prerequisites only if applicable:
   • Microsoft Monitoring Agent (MMA) installed and configured
   • Microsoft Monitoring Agent service running
   • Operation Manager log in Event Viewer for errors
   • Azure Log Analytics (OMS) workspace status running

A practical sequence for this server is:

1. sc.exe query sense
2. sc qc diagtrack
3. Check SENSE\Operational events
4. Reboot if Event ID 9 is present
5. Re-run onboarding script elevated
6. Recheck Assets > Devices after waiting

If the server still stays at Can be onboarded after those checks, the strongest documented indicators to collect are the SENSE Operational event IDs and the service states for sense, Windefend, and diagtrack.

• Onboard servers through Microsoft Defender for Endpoint's onboarding experience
• Troubleshoot Microsoft Defender for Endpoint onboarding issues
• Troubleshoot Microsoft Defender for Endpoint onboarding issues
• Onboard Windows devices using a local script