Windows Server onboarding fails due to missing rights !

Hello,

The silent onboarding failure you are seeing is a classic Defender for Endpoint onboarding issue when deployed via GPO. The root cause is twofold: the onboarding binary SenseCM.exe is being blocked by delegation rules, and the service account context lacks the “Log on as a batch job” right, which is required for the scheduled task that executes the onboarding script. Without that right, the scheduled task is created but fails immediately, which explains why you see no visible error but onboarding never completes.

To correct this, you need to adjust the GPO that delivers the onboarding package. First, ensure that the delegation rules on the GPO allow the target computers to read and apply the policy. If the GPO is restricted to a narrow security filtering group, confirm that the computer accounts are included. Then, in the same GPO, configure the “Log on as a batch job” right under Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment. Add the local SYSTEM account and the computer accounts that will run the onboarding task. This ensures that the scheduled task created by the onboarding script can execute SenseCM.exe successfully.

After correcting delegation and rights, force a policy refresh with gpupdate /force and verify in Task Scheduler that the onboarding task runs under SYSTEM with batch job rights. You should then see the onboarding status update in the Defender Security Center portal. If onboarding still fails, check %ProgramData%\Microsoft\Windows Defender Advanced Threat Protection\Logs\SenseCM.log for detailed error codes.

In short, the fix is to adjust GPO delegation so the policy applies correctly, and explicitly grant “Log on as a batch job” rights to SYSTEM so the scheduled onboarding task can run. Once those two conditions are met, SenseCM.exe executes normally and onboarding completes.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.