How to Clear the Windows Defender Advanced Threat Protection (ATP) Cache via PowerShell

The EDR Telemetry Engine

Microsoft Defender Advanced Threat Protection (ATP)—now officially part of Microsoft Defender for Endpoint—is an enterprise-grade Endpoint Detection and Response (EDR) platform. Unlike traditional antivirus that relies on simple file signatures, Defender ATP continuously records the behavioral telemetry of the Windows operating system. It tracks every process creation, every registry modification, and every outbound network connection, caching this massive volume of data locally before transmitting it to the Microsoft cloud for AI analysis.

Because Defender ATP is constantly writing high-frequency telemetry to the local SSD, its internal state caches and diagnostic logs can occasionally become corrupted. When this occurs, the Sense service (the primary Defender ATP daemon) might spike to 100% CPU usage, the server might suddenly stop reporting its health status to the Intune/Security Center console (appearing “Inactive”), or the sensor might refuse to accept updated security policies.

To resolve a stuck or corrupted sensor without completely offboarding the machine, you must forcefully purge the Defender ATP diagnostic caches and restart the Sense service using PowerShell.

Locating the ATP Caches

Defender ATP is an incredibly privileged component of the Windows kernel. It operates primarily out of the highly restricted C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\ directory.

Inside this directory are the DataCollection and Support folders, which hold the queued telemetry and the localized diagnostic caches.

Purging the Cache via PowerShell

You cannot interact with these folders using standard Administrator privileges. The Defender ATP service is protected by Tamper Protection, meaning even a Domain Admin cannot easily stop the service or delete its files.

To perform this reset, you must execute a highly specific PowerShell script that utilizes the native Defender diagnostic commands to trigger a self-purge.

Open an elevated PowerShell session as an Administrator.

Step 1: Force a Diagnostic Flush

The safest way to clear the telemetry cache is to instruct the sensor to immediately dump its current state and re-initialize.

# Trigger the native Defender ATP diagnostic tool to flush the buffers
& "C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe" -f

Step 2: Restart the Sense Service

If Tamper Protection allows it (or if you have temporarily disabled Tamper Protection in the cloud console for troubleshooting), you should restart the primary telemetry daemon.

Restart-Service -Name sense -Force

The Nuclear Option (Offboarding and Re-onboarding)

If the SenseSampleUploader fails to resolve the 100% CPU spike, the internal SQLite database tracking the telemetry is fundamentally broken. You cannot delete this database; you must completely offboard the machine to destroy the cryptographic linkage, and then re-onboard it.

1. Download the Local Offboarding Script from the Microsoft 365 Defender portal (Settings > Endpoints > Offboarding).
2. Run the script on the corrupted server:

.\WindowsDefenderATPLocalOffboardingScript.cmd

3. Wait 5 minutes. The Sense service will completely shut down and obliterate its local caches.
4. Run the corresponding Local Onboarding Script to reconnect the server to the cloud.

.\WindowsDefenderATPLocalOnboardingScript.cmd

The moment the onboarding script finishes, the Defender ATP engine will initialize a completely fresh, 0-byte cache directory and instantly resume streaming healthy behavioral telemetry to the Microsoft cloud.