Update event-error-codes.md

denisebmsft · denisebmsft · commit 7d57ea845d86 · 2025-04-16T09:44:13.000-07:00
diff --git a/defender-endpoint/event-error-codes.md b/defender-endpoint/event-error-codes.md
@@ -56,29 +56,29 @@ See the following table for a list of events recorded by the service.
    |3|Microsoft Defender for Endpoint service failed to start. Failure code: `variable`.|Service didn't start.|Review other messages to determine possible cause and troubleshooting steps.|
    |4|Microsoft Defender for Endpoint service contacted the server at `variable`.|Variable = URL of the Defender for Endpoint processing servers. <br/><br/> This URL matches that seen in the Firewall or network activity.|Normal operating notification; no action required.|
    |5|Microsoft Defender for Endpoint service failed to connect to the server at `variable`.|Variable = URL of the Defender for Endpoint processing servers. <br/><br/> The service couldn't contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](configure-proxy-internet.md).|
-   |6|Microsoft Defender for Endpoint service isn't onboarded and no onboarding parameters were found.|The device didn't onboard correctly and isn't reporting to the portal.|Onboarding must be run before starting the service. <br/><br/> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md).|
-   |7|Microsoft Defender for Endpoint service failed to read the onboarding parameters. Failure: `variable`.|Variable = detailed error description. The device didn't onboard correctly and isn't reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md).|
-   |8|Microsoft Defender for Endpoint service failed to clean its configuration. Failure code: `variable`.|**During onboarding:** The service failed to clean its configuration during the onboarding. The onboarding process continues. <br/><br/> **During offboarding:** The service failed to clean its configuration during the offboarding. The offboarding process finished but the service keeps running.|**Onboarding:** No action required. <br/><br/> **Offboarding:** Reboot the system. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md).|
-   |9|Microsoft Defender for Endpoint service failed to change its start type. Failure code: `variable`.|**During onboarding:** The device didn't onboard correctly and isn't reporting to the portal. <br/><br/>**During offboarding:** Failed to change the service start type. The offboarding process continues. |Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md).|
-   |10|Microsoft Defender for Endpoint service failed to persist the onboarding information. Failure code: `variable`.|The device didn't onboard correctly and isn't reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md).|
+   |6|Microsoft Defender for Endpoint service isn't onboarded and no onboarding parameters were found.|The device didn't onboard correctly and isn't reporting to the portal.|Onboarding must be run before starting the service. <br/><br/> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard client devices](onboard-client.md).|
+   |7|Microsoft Defender for Endpoint service failed to read the onboarding parameters. Failure: `variable`.|Variable = detailed error description. The device didn't onboard correctly and isn't reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard client devices](onboard-client.md).|
+   |8|Microsoft Defender for Endpoint service failed to clean its configuration. Failure code: `variable`.|**During onboarding:** The service failed to clean its configuration during the onboarding. The onboarding process continues. <br/><br/> **During offboarding:** The service failed to clean its configuration during the offboarding. The offboarding process finished but the service keeps running.|**Onboarding:** No action required. <br/><br/> **Offboarding:** Reboot the system. <br/><br/> See [Onboard client devices](onboard-client.md).|
+   |9|Microsoft Defender for Endpoint service failed to change its start type. Failure code: `variable`.|**During onboarding:** The device didn't onboard correctly and isn't reporting to the portal. <br/><br/>**During offboarding:** Failed to change the service start type. The offboarding process continues. |Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard client devices](onboard-client.md).|
+   |10|Microsoft Defender for Endpoint service failed to persist the onboarding information. Failure code: `variable`.|The device didn't onboard correctly and isn't reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard client devices running Windows or macOS](onboard-client.md).|
    |11|Onboarding or reonboarding of Defender for Endpoint service completed.|The device onboarded correctly.|Normal operating notification; no action required. <br/><br/> It might take several hours for the device to appear in the portal.|
    |12|Microsoft Defender for Endpoint failed to apply the default configuration.|Service was unable to apply the default configuration.|This error should resolve after a short period of time.|
    |13|Microsoft Defender for Endpoint device ID calculated: `variable`.|Normal operating process.|Normal operating notification; no action required.|
    |15|Microsoft Defender for Endpoint can't start command channel with URL: `variable`.|Variable = URL of the Defender for Endpoint processing servers. <br/><br/> The service couldn't contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](configure-proxy-internet.md).|
-   |17|Microsoft Defender for Endpoint service failed to change the Connected User Experiences and Telemetry service location. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy)">Ensure the diagnostic data service is enabled. <br/><br/> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md).|
+   |17|Microsoft Defender for Endpoint service failed to change the Connected User Experiences and Telemetry service location. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy)">Ensure the diagnostic data service is enabled. <br/><br/> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard client devices running Windows or macOS](onboard-client.md).|
    |18|OOBE (Windows Welcome) is completed.|Service will only start after any Windows updates have finished installing.|Normal operating notification; no action required.|
    |19|OOBE (Windows Welcome) hasn't yet completed.|Service will only start after any Windows updates finish installing.|Normal operating notification; no action required. <br/><br/> If this error persists after a system restart, ensure all Windows updates have full installed.|
    |20|Can't wait for OOBE (Windows Welcome) to complete. Failure code: `variable`.|Internal error.|If this error persists after a system restart, ensure all Windows updates are installed.|
-   |25|Microsoft Defender for Endpoint service failed to reset health status in the registry. Failure code: `variable`.|The device didn't onboard correctly. It reports to the portal; however, the service might not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md).|
-   |26|Microsoft Defender for Endpoint service failed to set the onboarding status in the registry. Failure code: `variable`.|The device didn't onboard correctly. <br/><br/> It reports to the portal; however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md).|
-   |27|Microsoft Defender for Endpoint service failed to enable SENSE aware mode in Microsoft Defender Antivirus. Onboarding process failed. Failure code: `variable`.|Normally, Microsoft Defender Antivirus enters a special passive state if another real-time antimalware product is running properly on the device, and the device is reporting to Defender for Endpoint.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md). <br/><br/> Ensure real-time antimalware protection is running properly.|
-   |28|Microsoft Defender for Endpoint Connected User Experiences and Telemetry service registration failed. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy). <br/><br/> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md).|
+   |25|Microsoft Defender for Endpoint service failed to reset health status in the registry. Failure code: `variable`.|The device didn't onboard correctly. It reports to the portal; however, the service might not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard client devices running Windows or macOS](onboard-client.md).|
+   |26|Microsoft Defender for Endpoint service failed to set the onboarding status in the registry. Failure code: `variable`.|The device didn't onboard correctly. <br/><br/> It reports to the portal; however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard client devices running Windows or macOS](onboard-client.md).|
+   |27|Microsoft Defender for Endpoint service failed to enable SENSE aware mode in Microsoft Defender Antivirus. Onboarding process failed. Failure code: `variable`.|Normally, Microsoft Defender Antivirus enters a special passive state if another real-time antimalware product is running properly on the device, and the device is reporting to Defender for Endpoint.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard client devices running Windows or macOS](onboard-client.md). <br/><br/> Ensure real-time antimalware protection is running properly.|
+   |28|Microsoft Defender for Endpoint Connected User Experiences and Telemetry service registration failed. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy). <br/><br/> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard client devices running Windows or macOS](onboard-client.md).|
    |29|Failed to read the offboarding parameters. Error type: %1, Error code: %2, Description: %3|This event occurs when the system can't read the offboarding parameters.|Ensure the device has Internet access, then run the entire offboarding process again. Ensure the offboarding package isn't expired.|
-   |30|Microsoft Defender for Endpoint service failed to disable SENSE aware mode in Microsoft Defender Antivirus. Failure code: `variable`.|Normally, Microsoft Defender Antivirus enters a special passive state if another real-time antimalware product is running properly on the device, and the device is reporting to Defender for Endpoint.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md). <br/><br/> Ensure real-time antimalware protection is running properly.|
+   |30|Microsoft Defender for Endpoint service failed to disable SENSE aware mode in Microsoft Defender Antivirus. Failure code: `variable`.|Normally, Microsoft Defender Antivirus enters a special passive state if another real-time antimalware product is running properly on the device, and the device is reporting to Defender for Endpoint.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard client devices running Windows or macOS](onboard-client.md). <br/><br/> Ensure real-time antimalware protection is running properly.|
    |31|Microsoft Defender for Endpoint Connected User Experiences and Telemetry service unregistration failed. Failure code: `variable`.|An error occurred with the Windows telemetry service during onboarding. The offboarding process continues.|[Check for errors with the Windows telemetry service](troubleshoot-onboarding.md#ensure-the-diagnostic-data-service-is-enabled).|
    |32|Microsoft Defender for Endpoint service failed to request to stop itself after offboarding process. Failure code: %1|An error occurred during offboarding.|Reboot the device.|
    |33|Microsoft Defender for Endpoint service failed to persist SENSE GUID. Failure code: `variable`.|A unique identifier is used to represent each device that is reporting to the portal. <br/><br/> If the identifier doesn't persist, the same device might appear twice in the portal.|Check registry permissions on the device to ensure the service can update the registry.|
-   |34|Microsoft Defender for Endpoint service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy). <br/><br/> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard Windows client devices](onboard-windows-client.md).|
+   |34|Microsoft Defender for Endpoint service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy). <br/><br/> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <br/><br/> See [Onboard client devices running Windows or macOS](onboard-client.md).|
    |35| Communication quotas are updated. Disk quota in MB: `variable`, daily upload quota in MB: `variable`| Variable = disk quota in MB. |Normal operating notification; no action required.|
    |36|Microsoft Defender for Endpoint Connected User Experiences and Telemetry service registration succeeded. Completion code: `variable`.|Registering Defender for Endpoint with the Connected User Experiences and Telemetry service completed successfully.|Normal operating notification; no action required.|
    |37|Microsoft Defender for Endpoint A module is about to exceed its quota. Module: %1, Quota: {%2} {%3}, Percentage of quota utilization: %4.|The device is near its allocated quota of the current 24-hour window. It's about to be throttled.|Normal operating notification; no action required.|
@@ -218,7 +218,7 @@ You can use this table for more information on the Defender for Endpoint events
 
 ## See also
 
-- [Onboard Windows client devices](onboard-windows-client.md)
+- [Onboard client devices running Windows or macOS](onboard-client.md)
 - [Configure device proxy and Internet connectivity settings](configure-proxy-internet.md)
 - [Troubleshoot Microsoft Defender for Endpoint](troubleshoot-onboarding.md)
 - [Client analyzer overview](overview-client-analyzer.md)
