When troubleshooting Microsoft Defender for Endpoint (MDE) issues, Microsoft Support or internal IT teams often request Defender Client Analyzer logs. Traditionally, collecting these logs requires local access to the endpoint. Using Live Response, you can remotely execute the Microsoft Defender Client Analyzer (MDE Client Analyzer), collect the diagnostic package, and download the results without requiring user interaction. This article explains how to configure, run, and retrieve Client Analyzer logs through Live Response.
Prerequisites
Before you begin, ensure the following requirements are met:
- Microsoft Defender for Endpoint is deployed.
- Live Response is enabled in your Microsoft Defender portal.
- You have the appropriate permissions to use Live Response.
- Download the latest Microsoft Defender Client Analyzer package from Microsoft.
- Devices must support Live Response and be online
Why use Live Response?
- No remote desktop or local login required
- No end-user interaction
- Collect diagnostics directly from the Defender portal
- Consistent log collection across all managed devices
- Ideal for Microsoft Support cases
What is the Client Analyzer tool?
The Microsoft Defender Client Analyzer (MDE Client Analyzer) is a Microsoft diagnostic tool designed to collect configuration details, logs, and health information from devices running Microsoft Defender for Endpoint. It helps administrators and Microsoft Support identify configuration issues, connectivity problems, onboarding errors, sensor health issues, and other client-related problems.
In larger environments, gaining interactive access to an endpoint can require coordination across multiple IT teams or support processes. Running the Client Analyzer remotely through Live Response avoids this overhead and allows diagnostics to be collected immediately.
Some of the information collected includes:
- Microsoft Defender for Endpoint sensor health
- Device onboarding status
- Connectivity to Microsoft Defender for Endpoint service URLs
- Microsoft Defender Antivirus configuration and status
- Event logs related to Defender components
- Registry settings and client configuration
- Network and proxy configuration relevant to Defender
- Operating system and device information
The Client Analyzer is particularly useful when troubleshooting issues such as:
- Sensors that are unhealthy or not reporting
- Missing or delayed security data
- Connectivity issues with Microsoft Defender cloud services
- MDE-Management-related configuration issues
- Performance or configuration-related problems
Besides obvious sensor health issues, MDECA can collect other traces, logs, and diagnostic information for troubleshooting
More information related to the client analyzer (MDECA) Troubleshoot sensor health using Microsoft Defender for Endpoint Client Analyzer – Microsoft Defender for Endpoint | Microsoft Learn
In this blog, we’ll use Live Response to remotely execute the Microsoft Defender Client Analyzer and retrieve the generated diagnostic package directly from the endpoint, eliminating the need for local user interaction.
Live Response session
There are two supported ways to run the Microsoft Defender Client Analyzer on Windows. The first option is to run MDEClientAnalyzer.cmd locally on the endpoint.
Another option is to run the MDE Client Analyzer via Live Response.
Download the scripts
Download the latest version of the Microsoft Defender Client Analyzer from Microsoft’s official repository. Extract the downloaded archive. Inside the package, you’ll find the Client Analyzer PowerShell scripts and supporting files.
Latest version download: Microsoft Defender for Endpoint Client Analyzer.
| Script | Purpose |
|---|---|
MDELiveAnalyzer.ps1 | Collects basic sensor and device health logs; also stops an active trace and packages the results. (Microsoft Learn) |
MDELiveAnalyzerAV.ps1 | Collects Microsoft Defender Antivirus (AV) logs. (Microsoft Learn) |
MDELiveAnalyzerDLP.ps1 | Collects Microsoft Endpoint Data Loss Prevention (DLP) logs. (Microsoft Learn) |
MDELiveAnalyzerNet.ps1 | Collects network and Windows Filtering Platform (WFP) logs. (Microsoft Learn) |
MDELiveAnalyzerAppCompat.ps1 | Collects Process Monitor (AppCompat) logs. (Microsoft Learn) |
MDELiveAnalyzerPerf.ps1 | Starts extended performance/WPR tracing in the background for performance investigations. Run this first, reproduce the issue, then run MDELiveAnalyzer.ps1 to stop tracing and package the results. (Microsoft Learn) |
MDELiveAnalyzerVerbose.ps1 | Collects a more verbose set of diagnostics than the standard analyzer. This script is included in the package but isn’t currently documented in the public Microsoft Learn articles. (Microsoft Learn) |
The MDELive*.ps1 wrapper scripts are designed specifically for Live Response. They extract the Client Analyzer package, execute the appropriate diagnostics, and automatically package the results for retrieval.
To run the Client Analyzer via Live Response, the wrapper scripts in the downloaded packages are needed. All wrapper files supported for Live Response start with MDELive*.ps1 and are located in the Tools folder.
Upload the Client Analyzer to the Live Response Library
The Client Analyzer needs to be uploaded once to the Live Response library before it can be executed remotely.
- Open the Microsoft Defender portal.
- Navigate to Settings.
- Select Endpoints.
- Open Optional features and verify that Live Response is enabled.
- Navigate to Endpoints > Live response library.
- Select Add file.
- Upload the Client Analyzer ZIP file or the required PowerShell scripts.
- MDEClientAnalyzerPreview.zip
- MDELiveAnalyzer.ps1
- Wait until the upload status changes to Available.
Once uploaded, the file can be executed on any supported managed endpoint.
Uploading MDEClientAnalyzerPreview.zip ensures that Live Response uses the bundled Client Analyzer binaries instead of relying on a locally installed version, which may be outdated or unavailable.
Upload additional MDELive*.ps1 scripts only if you need their specific diagnostic capabilities or specific use-cases. MDELiveAnalyzerAV.ps1 is recommended for the log collection of Defender AV.
Processes and how to confirm it is running (for test)
To better understand Live Response. First, let’s explain some of the key services as part of the Defender for Endpoint component:
- MsSense.exe: This process is the main service executable for Defender for Endpoint. The service is running as a service with the name SENSE.
- SenseIR.exe: This executable spawns as a child process of MsSense.exe when initiating a Live Response Session via the Microsoft Defender portal.
Live Response uses the Windows Push Notification Service (WNS) to establish the remote session between the Defender portal and the endpoint.
During a Live Response session, two key processes are involved:
- MsSense.exe
- SenseIR.exe
MsSense.exe is always active when the machine is correctly onboarded to Defender for Endpoint and will start the SenseIR.exe process as a child process when the live response connection is initiated
Live Response can execute PowerShell scripts that have been uploaded to the Live Response library. These scripts run in a non-interactive PowerShell session initiated by SenseIR.exe. As a result, you’ll typically see PowerShell.exe as a child process of SenseIR.exe during execution.
Each file needs to be uploaded to the centralized library. This is not an interactive PowerShell session; in general, there is another child process of SenseIR.exe for PowerShell.exe and, when needed, additional services.
When running the PowerShell script directly, it creates a new PowerShell child process for SenseIR.exe.
When we check the process details, more information is visible. The command line is:
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass "& 'C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDECA\MDEClientAnalyzer.ps1' -outputDir 'C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDECA'"As seen in the command, the MDEClientAnalyzer.ps1 is started, and the output directory is C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDECA
More information related to troubleshooting live response: How to troubleshoot Live Response in Defender for Endpoint
How to run Client Analyzer via Live Response
Check available files
Optional: To check if the file is available in the library. Run the command LIBRARY. This will show the existing list of files available from the library source.
Run the analyzer
When the file is available, run the analyzer with the following command. The following example runs MDELiveAnalyzer.ps1. A similar command can be executed with MDELiveAnalyzerAV.PS1, MELiveAnalyzerDLP.PS1 and other PowerShell scripts.
Run MDELiveAnalyzer.ps1
The script starts the Client Analyzer and collects the diagnostic package:
After the script completes, the following message is displayed in the command console of Live Response:
Result is available at: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDECA\MDEClientAnalyzerResult.zipThe generated ZIP file contains the collected diagnostic logs and can be downloaded directly from the Live Response session for further analysis or to share with Microsoft Support.
Download the files
Download the generated archive using the following command:
GetFile "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\MDECA\MDEClientAnalyzerResult.zip"
Results in the zip file. MDEClientAnalyzer.htm is the overview page of the results; additional logs are provided in the log folders.
Result:
Conclusion
Live Response provides a fast and efficient way to execute the Microsoft Defender Client Analyzer without requiring local or remote interactive access to the endpoint. Administrators can remotely generate and retrieve diagnostic packages directly from the Microsoft Defender portal, making troubleshooting faster while minimizing disruption for end users. This approach is particularly valuable in large enterprise environments where endpoint access is often restricted or requires coordination across multiple support teams.
