# Elastic Defend (windows) - Policy response failure

**URL:** <https://discuss.elastic.co/t/elastic-defend-windows-policy-response-failure/391192>\
**Category:** Endpoint Security\
**Created:** [October 26, 2026, 11:43am UTC](https://discuss.elastic.co/t/elastic-defend-windows-policy-response-failure/391192 "2026-10-26T11:43:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![J0hnK3y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/j0hnk3y/32/148453_2.png) [@J0hnK3y](https://discuss.elastic.co/u/J0hnK3y)\
**Post date:** [October 26, 2026, 11:43am UTC](https://discuss.elastic.co/t/elastic-defend-windows-policy-response-failure/391192/1 "2026-10-26T11:43:12Z")

</div>

The Elastic Agent reports an UNHEALTHY status while remaining CONNECTED to Fleet Server.

The endpoint is still communicating with Fleet, but its health status is unhealthy/degraded due to multiple Elastic Defend event activation failures.

The affected actions include configure\_dns\_events, configure\_security\_events, configure\_threat\_intelligence\_api\_events, configure\_kernel\_api\_events, configure\_keyboard\_api\_events, configure\_tcpip\_api\_events, configure\_winhttp\_api\_events, configure\_wininet\_api\_events, configure\_wmi\_api\_events, configure\_amsi\_api\_events, and configure\_ldap\_client\_api\_events.

How can I fix the Elastic Agent showing UNHEALTHY while still CONNECTED to Fleet, with multiple Elastic Defend event activation failures on Windows Server 2019?

 ![Policy Response](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e1952d513e39ef50f8173bc3df79f1a6a5ecd118.png)

 ![Events](https://us1.discourse-cdn.com/elastic/original/3X/0/8/081a27f360fb498b59ef0f1dad626977b53adfca.png)

---

<div class="post-metadata">

**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\
**Post date:** [October 26, 2026, 6:31pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-policy-response-failure/391192/2 "2026-10-26T18:31:05Z")

</div>

Hi @J0hnK3y

It is most likely that you're hitting a single issue affecting all those actions. When you expand the ones in red (e.g. `Configure Security Events`) is there a useful message displayed? If not I recommend looking at Endpoints logs. By default they're ingested into `logs-elastic_agent.endpoint_security-*` and on the host in `c:\Program Files\Elastic\Endpoint\state\log\` (use an Admin account to read them).

It's easiest to just look for the time range when policy was last changed to identify suspect logs. Otherwise look at logs starting when you see `Applying policy with name ...`. If you don't see anything consider turning on Debug (much noisier) logs (Fleet -\> Agents -\> [Agent Name] -\> Settings -\> [change the log level]).

---

<div class="post-metadata">

**Author:** ![J0hnK3y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/j0hnk3y/32/148453_2.png) [@J0hnK3y](https://discuss.elastic.co/u/J0hnK3y)\
**Post date:** [October 27, 2026, 9:45am UTC](https://discuss.elastic.co/t/elastic-defend-windows-policy-response-failure/391192/3 "2026-10-27T09:45:25Z")

</div>

i have look the log but there is no useful information, here is thre screenshot;  
every messages has the same error (Failure enabling \*\*\* api events; current state is disabled)

 ![inis](https://us1.discourse-cdn.com/elastic/original/3X/c/d/cdeb21ead37d7aaf2e67f0e35b2c89ae2ccb59ef.png)

![ini](https://us1.discourse-cdn.com/elastic/original/3X/2/1/2105d8dfe495a2613e6d9dc80e98d5b794ffd067.png)