add sensor topics

windows/keep-secure/TOC.md

@@ -742,6 +742,8 @@
 ##### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md)
 ##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md)
 ##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md)
+##### [Check sensor status](check-sensor-status-windows-defender-advanced-threat-protection.md)
+###### [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
 ##### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
 #### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md)
 #### [Windows Defender ATP service status](service-status-windows-defender-advanced-threat-protection.md)

windows/keep-secure/check-sensor-status-windows-defender-advanced-threat-protection.md

@@ -0,0 +1,56 @@
+---
+title: Check sensor health status in Windows Defender ATP
+description: Check sensor health on machines to see if they are misconfigured or inactive.
+keywords: sensor, sensor health, misconfigured, inactive, no sensor data, sensor data, impaired communication, communication
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+author: mjcaparas
+localizationpriority: high
+---
+
+# Check sensor health status
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
+
+The sensor health tile provides information on the individual endpoint’s ability to provide sensor data and communicate with the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take actions to correct known issues.
+
+![Windows Defender ATP sensor health tile](images/atp-sensor-health-filter.png)
+
+There are two status indicators on the tile that provide information on the number of machines that are not reporting properly to the service:
+-	**Inactive** - Machines that have stopped reporting to the Windows Defender ATP service for more than seven days in the past month.
+- **Misconfigured** - These machines might partially be reporting sensor data to the Windows Defender ATP service and might have configuration errors that need to be corrected.
+
+Clicking any of the groups directs you to Machines view, filtered according to your choice.
+
+You can filter the health state list by the following status:
+
+![Windows Defender ATP sensor filter](images/atp-sensor-filter.png)
+
+- **Active** - Machines that are actively reporting to the Windows Defender ATP service.
+- **Inactive** - Machines that have stopped reporting to the Windows Defender ATP service.
+- **Misconfigured** - These machines might partially be reporting sensor data to the Windows Defender ATP service but have configuration errors that need to be corrected. Misconfigured machines can have either one or a combination of the following issues:
+- **No sensor data** - Machines has stopped sending sensor data. Limited alerts can be triggered from the machine.
+- **Impaired communication** - Ability to communicate with machine is impaired. Sending files for deep analysis, blocking files, isolating machine from network and other actions that require communication with the machine may not work.
+
+Clicking on a misconfigured or inactive machine brings you the machine details view. There you’ll see more information about the specific issue of the machine by clicking the information icon.
+
+![Windows Defender ATP sensor filter](images/atp-machine-health-details.png)
+
+In the **Machines view**, you can download a full list of all the machines in your organization in a CSV format. To download, click the **Manage Alert** menu icon on the top corner of the page.
+
+>[!NOTE]
+>Exporting the list in CSV format displays the data in an unfiltered manner. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself and can take a significant amount of time to download, depending on how large your organization is.
+
+## Related topics
+- [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)

windows/keep-secure/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md

@@ -0,0 +1,76 @@
+---
+title: Fix unhealthy sensors in Windows Defender ATP
+description: Fix machine sensors that are reporting as misconfigured or inactive.
+keywords: misconfigured, inactive, fix sensor, sensor health,  no sensor data, sensor data, impaired communication, communication
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+author: mjcaparas
+localizationpriority: high
+---
+
+# Fix unhealthy sensors
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+Machines that are categorized as misconfigured or inactive can have varying causes of being flagged. This section provides some explanations as to what might have caused a machine to be categorized as inactive or misconfigured.
+
+## Inactive machines
+
+An inactive machine is not necessarily due to an issue. The following actions taken on a machine can cause a machine to be categorized as inactive:
+
+**Machine was reinstalled or renamed**</br>
+A reinstalled or renamed machine will generate a new machine entity in Windows Defender ATP portal. The previous machine entity will remain in the portal with a status ‘Inactive’. If you reinstalled a machine and deployed the Windows Defender ATP package, search for the new machine name to verify that the machine is reporting normally.
+
+
+**Machine is not in use**</br>
+If the machine has not been in use for more than 7 days for any reason, it will remain in the portal in status ‘Inactive’
+
+**Machine was offboarded**</br>
+If the machine was offboarded it will still appear in machines view. After 7 days, the machine health status should change to inactive.
+
+Do you expect a machine to be in ‘Active’ status? [Open a CSS ticket](https://support.microsoft.com/en-us/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636206786382823561).
+
+## Misconfigured machines
+Misconfigured machines can further be classified to:
+  - Impaired communication
+  - No sensor data
+
+### Impaired communication
+This status indicates that there's limited communication between the machine and the service.
+
+The following suggested actions can help fix issues related to a misconfigured machine with impaired communication:
+
+- [Ensure the endpoint has Internet connection](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-endpoint-has-an-internet-connection)
+  The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
+
+- Verify client connectivity to Windows Defender ATP service URLs</br>
+  Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs.
+
+If you took corrective actions and the machine status is still misconfigured, [open a CSS ticket](https://support.microsoft.com/en-us/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636206786382823561).
+
+### No sensor data
+A misconfigured machine with status ‘No sensor data’ has communication with the service but can only report partial sensor data.
+Follow theses actions to correct known issues related to a misconfigured machine with status ‘Impaired communication’:
+
+- [Ensure the endpoint has Internet connection](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-endpoint-has-an-internet-connection)
+  The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
+
+- Verify client connectivity to Windows Defender ATP service URLs</br>
+  Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs.
+
+- [Ensure the telemetry and diagnostics service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-telemetry-and-diagnostics-service-is-enabled)
+If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is set to automatically start and is running on the endpoint.
+
+- [Ensure that Windows Defender is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-is-not-disabled-by-a-policy)
+If your endpoints are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled.
+
+If you took corrective actions and the machine status is still misconfigured, [open a CSS ticket](https://support.microsoft.com/en-us/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636206786382823561).