Type in a device name. Get a straight answer about whether that machine is in trouble — and what to do about it.
Preview feature · Requires Microsoft Defender for Endpoint with Advanced Hunting
Someone asks you “is there something wrong with Sarah’s laptop?” Answering that properly today means writing half a dozen Advanced Hunting queries, reading them in separate tabs, and holding the whole picture in your head.
Machine Investigator does that in one pass. You enter one device — or up to twenty-five — and each one comes back with a colour-coded verdict, the facts behind that verdict, and concrete remediation steps you can copy and paste.
Every device gets one of three answers, with a single sentence explaining why. This is the part you read first, and often the only part you need.
Nothing significant found in the period you looked at. Defender is doing its job and there is nothing outstanding.
Real findings, but nothing on fire — unpatched high-severity CVEs, a handful of configuration gaps, or unusual activity worth a look.
Something serious: a critical vulnerability with a known exploit, a malware detection, or a high-severity Defender alert.
The rules behind the colours are fixed and published, not a black box. A vulnerability with a CVSS score of 9 or above, a high-severity Defender alert, or an antivirus detection pushes a device to red. Three or more configuration gaps, or a mid-severity finding, makes it amber.
One run asks sixteen questions about each device. You don’t write any of them.
Operating system and build, sensor health, onboarding status, join type, exposure level, whether it is internet-facing, and who is signed in.
The most severe CVEs affecting it, ranked by score, with the ones that have a known exploit in the wild pushed to the top.
Open alerts by severity and category, plus antivirus and SmartScreen detections.
ASR rule blocks and warnings, App Control (WDAC) events, Device Control blocks, and Network Protection blocks — the protections that are actively earning their keep.
Living-off-the-land binaries such as certutil and rundll32, outbound traffic on unusual ports, failed logon storms, and executables written into Temp or Downloads.
Registry Run keys, new services, scheduled tasks, WMI event subscriptions, driver loads and RDP sessions — the classic persistence footholds.
Non-compliant secure-configuration items from Defender Vulnerability Management, grouped by category, each with a fix.
Any section that failed or returned nothing is listed explicitly, so a silent gap never gets mistaken for a clean result.
You choose the lookback window, from one to thirty days. Seven is the default and is usually the right call.
.txt or .csv file. Duplicates are skipped and the list caps at twenty-five.The report is the summary. The Details tab is where you work. It holds four sortable tables:
| Table | What it shows |
|---|---|
| Vulnerabilities | CVE, score, severity, the affected software and version, and whether an exploit exists. Sorted so anything exploitable is at the top. |
| Enforcement | Which Defender component acted — ASR, antivirus, App Control, Device Control, Network Protection — what it did, how many times, and the first thing it saw. |
| Configuration Gaps | The secure-configuration item, its category, and when it was last evaluated. |
| Activity | Processes, network connections, logons, file writes and persistence attempts, with counts. |
Click any row and a panel opens on the right with a priority badge, a plain description of why it matters, and remediation in three forms — a PowerShell command you can run now, the Intune path to click through, and the Group Policy setting. Vulnerability rows link to the CVE record; enforcement and configuration rows link to the relevant Microsoft documentation.
MachineInvestigator-<Device>-<Timestamp>.csv.If your organisation has set DisableExportButtons, these are blocked and the app says so rather than failing quietly.
| Topic | Detail |
|---|---|
| Availability | Preview feature. Set ShowPreviewFeatures to 1 under HKLM\SOFTWARE\Policies\MDE-Toolkit to reveal it. |
| Page visibility | VisibilityMachineInvestigatorPage — 0 hidden, 1 admin only (default), 2 standard users, 3 both. |
| Licensing / access | A Defender for Endpoint tenant with Advanced Hunting. Results are scoped to the signed-in user’s permissions and device groups. |
| Data handling | With the local engine, the snapshot stays in memory on the investigator’s workstation and is written out only if they export it. |
| Custom guidance | Remediation content lives in JSON catalogs. Point AnalyzerCatalogPath at your own copies, or drop files into %ProgramData%\MDE Toolkit\AnalyzerCatalogs\, to replace the shipped advice with your organisation’s runbooks. |
| Batch limits | 25 devices per run; roughly a dozen Advanced Hunting calls total. |
ShowPreviewFeatures and every page-visibility value are covered by the downloadable ADMX templates, so you can control who sees Machine Investigator without touching the registry by hand.
Machine Investigator ships in the current build. Enable preview features and it appears under Tools.