|
| 1 | +--- |
| 2 | +title: Diagnose Defender for Endpoint issues with Client Analyzer |
| 3 | +ms.topic: conceptual |
| 4 | +description: Understand how to Diagnose Defender for Endpoint issues with Client Analyzer so that you can send the right data to Microsoft support for troubleshooting. |
| 5 | +ms.service: defender-endpoint |
| 6 | +author: KesemSharabi |
| 7 | +ms.author: kesharab |
| 8 | +audience: ITPro |
| 9 | +ms.collection: |
| 10 | +- m365-security |
| 11 | +- tier1 |
| 12 | +- mde-ngp |
| 13 | +ms.subservice: ngp |
| 14 | +search.appverid: met150 |
| 15 | +ms.date: 10/28/2025 |
| 16 | +--- |
| 17 | + |
| 18 | +# Diagnose issues with Client Analyzer |
| 19 | + |
| 20 | +When you troubleshoot Microsoft Defender for Endpoint, collecting diagnostic data is crucial for problem resolution. Different issues such as performance, connectivity and detection-related concerns, require different telemetry. As a security expert investigating these issues, you can use the [Client Analyzer](overview-client-analyzer.md) tool to gather data about your organization's Defender for Endpoint issues. With this data, you can troubleshoot your organization's Defender for Endpoint issues, and if needed [work with Microsoft support](contact-support.md) to resolve them |
| 21 | + |
| 22 | +This article lists different types of issues and how to collect data for them using the Client Analyzer tool. The tool's flags are listed in [Data collection for advanced troubleshooting on Windows](data-collection-analyzer.md). |
| 23 | + |
| 24 | +## Categorize your issue |
| 25 | + |
| 26 | +Use the categories listed in the table to identify the type of issue you're experiencing. [Run the Client Analyzer tool](#run-the-client-analyzer-tool) with the appropriate flags when collecting data. |
| 27 | + |
| 28 | +|Issue |Description and examples |Flags | |
| 29 | +|---------|---------|---------| |
| 30 | +|Issues that can't be reproduced |Issues that occur sporadically or are triggered by automated processes and can't be reproduced. This includes problems related to scheduled tasks such as automatic updates and scans, and Attack Surface Reduction (ASR) rules triggered unpredictably. | Run without flags | |
| 31 | +|Performance issues that can be reproduced |Includes high CPU usage, memory consumption problems, and slow response times. |`-a` and `-v` | |
| 32 | +|General |On-demand scans, manual updates, sense portal and alert issues, Attack Surface Reduction (ASR) issues that can be triggered on command, and app compatibility problems. |`-e` and `-v` | |
| 33 | +|Hanging systems |Unresponsive systems and freezes. Require advanced debugging techniques including memory dumps and crash analysis. |`-z` | |
| 34 | +|Compatibility |Issues with third-party applications, other security solutions, system software, performance problems, and functional issues. |`-c`, `-e` and `-v` | |
| 35 | +|Controlled Folder Access (CFA) |Include blocked applications, unexpected access permissions, and issues related to protected folders configuration. |Reproducible: `-cfa`, `-e` and `-v`</br>Nonreproducible: `-cfa` | |
| 36 | +|Data Loss Prevention (DLP) |Include policy enforcement problems, content detection false positives and negatives, and DLP client health and connectivity issues. |Reproducible: `-e`, `-t` and `-v`</br>Nonreproducible: `-t` | |
| 37 | +|Indicator |Include problems with URLs, domains, IP addresses, files, and certificates that aren't enforced as expected. |URL, IP, domain in first-party browser: `-a`, `-i` and `-v`</br>File indicator: `-v` | |
| 38 | +|Web Content Filtering (WCF) |Unenforced WCF policy when accessing web content using first and third party browsers. |`-a`, `-i` and `-v` | |
| 39 | +|Network protection |Network protection doesn't trigger configured policies when URLs, domains, and IPs are accessed through third-party browsers. |`-i` and `-v` | |
| 40 | + |
| 41 | +## Run the Client Analyzer tool |
| 42 | + |
| 43 | +Follow the steps in this section to collect data for the issues you've identified. Use the appropriate flags when needed. If you have scenarios that involve both working and nonworking conditions, collect separate log packages for each scenario and clearly label each collection. The comparison helps identify the differences that cause the performance issue. |
| 44 | + |
| 45 | +1. Start log collection running: |
| 46 | + |
| 47 | + ```powershell |
| 48 | + |
| 49 | + MDEClientAnalyzer.cmd |
| 50 | + |
| 51 | + ``` |
| 52 | +
|
| 53 | + If you used a flag that includes a timespan, such as `-a`, `-e`, or `-v`, you're asked to specify the duration of the log collection. |
| 54 | +
|
| 55 | +2. Once the log collection starts, reproduce the issue so that the issue's data is captured while the logs are being collected. |
| 56 | +
|
| 57 | +3. To stop the log collection press Press `q`. |
0 commit comments