User impact: Admins may have noticed excessive memory usage on their Windows Server 2016 machines.

More info: Admins may have noticed delays or timeouts with third-party applications hosted on affected Windows Sever 2016 machines running Microsoft Defender for Endpoint’s Sense.

Final status: We’ve determined that a recent code change exposed an issue with how the Windows Server 2016 machine operating system handles Microsoft Defender for Endpoint service requests and was resulting in the observed impact. We’ve confirmed through an extended period of monitoring that our service optimizations have successfully reached all previously impacted devices, fully resolving the issue.

Scope of impact: Any Windows Server 2016 admin may have been impacted.

Start time: Monday, March 23, 2026, at 12:00 AM UTC

End time: Monday, April 13, 2026, at 12:00 AM UTC

Root cause:  A recent code change exposed an issue with how the Windows Server 2016 machine operating system handles Microsoft Defender for Endpoint service requests, which resulted in impact.

Next steps:
– We’re reviewing our code change check and implementation processes to improve how we detect potential operating system issues and prevent similar service incidents in the future.

This is the final update for the event.