Edit

Bagikan melalui

Run the client analyzer on Windows

  • Artikel

Applies to:

You have two options for running the Defender for Endpoint client analyzer on Windows:

  • Use live response
  • Run the client analyzer locally on the device

Option 1: Live response

You can collect the Defender for Endpoint analyzer support logs remotely using Live Response.

Option 2: Run MDE Client Analyzer locally

  1. Download the MDE Client Analyzer tool or MDE Client Analyzer tool (preview) to the Windows device you want to investigate. The file is saved to your Downloads folder by default.

  2. Extract the contents of MDEClientAnalyzer.zip to an available folder.

  3. Open a command line with administrator permissions:

    1. Go to Start and type cmd.

    2. Right-click Command prompt and select Run as administrator.

  4. Type the following command and then press Enter:

    *DrivePath*\MDEClientAnalyzer.cmd

    Replace DrivePath with the path where you extracted MDEClientAnalyzer, for example:

    C:\Work\tools\MDEClientAnalyzer\MDEClientAnalyzer.cmd

In addition to the previous procedure, you can also collect the analyzer support logs using live response..

Note

On Windows 10 and 11, Windows Server 2019 and 2022, or Windows Server 2012R2 and 2016 with the modern unified solution installed, the client analyzer script calls into an executable file called MDEClientAnalyzer.exe to run the connectivity tests to cloud service URLs.

On Windows 8.1, Windows Server 2016 or any previous OS edition where Microsoft Monitoring Agent (MMA) is used for onboarding, the client analyzer script calls into an executable file called MDEClientAnalyzerPreviousVersion.exe to run connectivity tests for Command and Control (CnC) URLs while also calling into Microsoft Monitoring Agent connectivity tool TestCloudConnection.exe for Cyber Data channel URLs.

Important points to keep in mind

All the PowerShell scripts and modules included with the analyzer are Microsoft-signed. If files were modified in any way, then the analyzer is expected to exit with the following error:

The client analyzer error

If you see this error, the issuerInfo.txt output contains detailed information about why this happened and the affected file:

The issuer info

Example contents after MDEClientAnalyzer.ps1 is modified:

The modified ps1 file

Result package contents on Windows

Note

The exact files captured may change depending on factors such as:

  • The version of windows on which the analyzer is run.
  • Event log channel availability on the machine.
  • The start state of the EDR sensor (Sense is stopped if machine is not yet onboarded).
  • If an advanced troubleshooting parameter was used with the analyzer command.

By default, the unpacked MDEClientAnalyzerResult.zip file contains the items listed in the following table:

Folder Item Description
MDEClientAnalyzer.htm This is the main HTML output file, which will contain the findings and guidance that the analyzer script run on the machine can produce.
SystemInfoLogs AddRemovePrograms.csv List of x64 installed software on x64 OS collected from registry
SystemInfoLogs AddRemoveProgramsWOW64.csv List of x86 installed software on x64 OS collected from registry
SystemInfoLogs CertValidate.log Detailed result from certificate revocation executed by calling into CertUtil
SystemInfoLogs dsregcmd.txt Output from running dsregcmd. This provides details about the Microsoft Entra status of the machine.
SystemInfoLogs IFEO.txt Output of Image File Execution Options configured on the machine
SystemInfoLogs MDEClientAnalyzer.txt This is verbose text file showing with details of the analyzer script execution.
SystemInfoLogs MDEClientAnalyzer.xml XML format containing the analyzer script findings
SystemInfoLogs RegOnboardedInfoCurrent.Json The onboarded machine information gathered in JSON format from the registry
SystemInfoLogs RegOnboardingInfoPolicy.Json The onboarding policy configuration gathered in JSON format from the registry
SystemInfoLogs SCHANNEL.txt Details about SCHANNEL configuration applied to the machine such gathered from registry
SystemInfoLogs SessionManager.txt Session Manager specific settings gather from registry
SystemInfoLogs SSL_00010002.txt Details about SSL configuration applied to the machine gathered from registry
EventLogs utc.evtx Export of DiagTrack event log
EventLogs senseIR.evtx Export of the Automated Investigation event log
EventLogs sense.evtx Export of the Sensor main event log
EventLogs OperationsManager.evtx Export of the Microsoft Monitoring Agent event log
MdeConfigMgrLogs SecurityManagementConfiguration.json Configurations sent from MEM (Microsoft Endpoint Manager) for enforcement
MdeConfigMgrLogs policies.json Policies settings to be enforced on the device
MdeConfigMgrLogs report_xxx.json Corresponding enforcement results

See also

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.