diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
index 22b162a252..c287bb94bc 100644
--- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
+++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
@@ -194,8 +194,8 @@ Event ID|Message|Description|Action
2|Windows Advanced Threat Protection service shutdown.|Occurs when the endpoint is shut down or offboarded.|Normal operating notification; no action required.
3|Windows Advanced Threat Protection service failed to start. Failure code: ```variable```|Service did not start.|Review other messages to determine possible cause and troubleshooting steps.
4|Windows Advanced Threat Protection service contacted the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers.
This URL will match that seen in the Firewall or network activity.|Normal operating notification; no action required.
-5|Windows Advanced Threat Protection service failed to connect to the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
-6|Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.|The endpoint did not onboard correctly and will not be reporting to the portal.|Onboarding must be run before starting the service.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
+5|Windows Advanced Threat Protection service failed to connect to the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
+6|Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.|The endpoint did not onboard correctly and will not be reporting to the portal.|Onboarding must be run before starting the service.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
7|Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
8|Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
9|Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)