Microsoft Defender for Endpoint
Endpoint protectionUnderstand the Client Analyzer HTML Report - Microsoft Defender for Endpoint | Microsoft Learn
In brief
The page title and description were refined, screenshot captions now describe each image, and wording and punctuation were clarified throughout the report guidance.
What Defender admins need to know
Administrators get clearer context when interpreting Client Analyzer HTML reports; no action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Understand the client analyzerClient Analyzer HTML reportReport - Microsoft Defender for Endpoint | Microsoft Learn
The client analyzer produces a report in HTML format. Learn how to review the report to identify potential sensor issues so that you can troubleshoot them.
Use the following example to understand the report.
Example output
In this example, the Defender for Endpoint Client Analyzer produced information about a device that was onboarded to an expired Org ID and failed to reach a required Defender for Endpoint URL:
OnAt the top, the script version and script runtime are listed forreferencereference.The Device Information section provides basic
OSoperating system and device identifiers to uniquely identify the device on which the analyzer has run.The Endpoint Security Details provides general information about Microsoft Defender for Endpoint-related processes including Microsoft Defender Antivirus and the sensor process. If important processes aren't online as expected, the color changes to red.
On Check Results Summary,
youthere'll haves an aggregated count for error, warning, or informational events detected by the analyzer.On Detailed Results,
youthere'll sees alist (sortedlist, sorted byseverity)severity, with the results and the guidance based on the observations made by the analyzer.
Open a support ticket to Microsoft and include the Analyzer results
To include analyzer result files when opening a support ticket, make sure you use the Attachments section and include the MDEClientAnalyzerResult.zip file:
Note
@@ -1,6 +1,6 @@ --- layout: Conceptual-title: Understand the client analyzer HTML report - Microsoft Defender for Endpoint | Microsoft Learn+title: Understand the Client Analyzer HTML Report - Microsoft Defender for Endpoint | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/defender-endpoint/analyzer-report breadcrumb_path: /defender-endpoint/breadcrumb/toc.json feedback_system: Standard@@ -8,7 +8,7 @@ permissioned-type: public feedback_product_url: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/ct-p/MicrosoftSecurityandCompliance uhfHeaderId: MSDocsHeader-MicrosoftDefender manager: bagol-description: Learn how to analyze the Microsoft Defender for Endpoint Client Analyzer HTML report+description: Defender for Endpoint Client Analyzer results can pinpoint connectivity and onboarding issues. Learn how to read the HTML report and resolve problems. ms.service: defender-endpoint ms.author: chrisda author: chrisda@@ -42,31 +42,29 @@ spProducts: platformId: 23625b40-ef1d-a769-7b5a-965148f7c3ff --- -# Understand the client analyzer HTML report - Microsoft Defender for Endpoint | Microsoft Learn+# Understand the Client Analyzer HTML Report - Microsoft Defender for Endpoint | Microsoft Learn The client analyzer produces a report in HTML format. Learn how to review the report to identify potential sensor issues so that you can troubleshoot them.
-Use the following example to understand the report.
-
## Example output
In this example, the [Defender for Endpoint Client Analyzer](overview-client-analyzer) produced information about a device that was onboarded to an expired Org ID and failed to reach a required Defender for Endpoint URL:
-[](media/147cbcf0f7b6f0ff65d200bf3e4674cb.png#lightbox)
+[](media/147cbcf0f7b6f0ff65d200bf3e4674cb.png#lightbox)
-- On top, the script version and script runtime are listed for reference
-- The **Device Information** section provides basic OS and device identifiers to uniquely identify the device on which the analyzer has run.
+- At the top, the script version and script runtime are listed for reference.
+- The **Device Information** section provides basic operating system and device identifiers to uniquely identify the device on which the analyzer has run.
- The **Endpoint Security Details** provides general information about Microsoft Defender for Endpoint-related processes including Microsoft Defender Antivirus and the sensor process. If important processes aren't online as expected, the color changes to red.
- [](media/85f56004dc6bd1679c3d2c063e36cb80.png#lightbox)
-- On **Check Results Summary**, you'll have an aggregated count for error, warning, or informational events detected by the analyzer.
-- On **Detailed Results**, you'll see a list (sorted by severity) with the results and the guidance based on the observations made by the analyzer.
+ [](media/85f56004dc6bd1679c3d2c063e36cb80.png#lightbox)
+- On **Check Results Summary**, there's an aggregated count for error, warning, or informational events detected by the analyzer.
+- On **Detailed Results**, there's a list, sorted by severity, with the results and the guidance based on the observations made by the analyzer.
## Open a support ticket to Microsoft and include the Analyzer results
To include analyzer result files [when opening a support ticket](contact-support#open-a-service-request), make sure you use the **Attachments** section and include the `MDEClientAnalyzerResult.zip` file:
-[](media/508c189656c3deb3b239daf811e33741.png#lightbox)
+[](media/508c189656c3deb3b239daf811e33741.png#lightbox)
Note