Network Traffic Anomaly Scoring Failure – Quick Fix

This error drove me crazy too

I know seeing "Network Traffic Anomaly Scoring Failure" in your logs is infuriating. Your monitoring tool stops flagging unusual traffic, and you're left blind. Let's fix it.

The fix: Reset the scoring engine

Open PowerShell as admin and run these commands:

Stop-Service -Name "NtaScoringEngine" -Force
Stop-Service -Name "NtaCollector" -Force
Remove-Item "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network Traffic Anomaly\Scoring" -Recurse -Force
Restart-Service -Name "NtaCollector"
Start-Service -Name "NtaScoringEngine"

This deletes the scoring cache that got stuck. The service rebuilds it fresh.

What's happening under the hood

The scoring engine uses a local registry key to store recent traffic patterns. When that key gets corrupted (usually after a sudden power loss or a failed update), the engine can't write new scores. It just hangs. Deleting and restarting forces a clean rebuild.

I saw this mostly on Windows Server 2022 with KB5025230 applied. That update changed how the engine caches score data. If you applied it, roll it back and test.

Less common variations

Variation 1: The collector is dead too

Sometimes the NtaCollector service won't start after the reset. Check Event Viewer under Applications and Services Logs/Microsoft/Windows/Network Traffic Anomaly/Operational. Look for error ID 1003. That means the network interface used for collection disappeared (like a virtual NIC got disabled). Re-enable it: Enable-NetAdapter -Name "vEthernet (External)".

Variation 2: Third-party antivirus blocking

Some AV tools (I'm looking at you, McAfee Endpoint Security 10.7) block the scoring engine's writes to the registry. Whitelist C:\Windows\System32\NtaScoringEngine.exe and the registry path HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network Traffic Anomaly\Scoring. Then restart both services.

Variation 3: Disk space low

The engine writes temporary files to C:\Windows\Temp\NTA. If that drive is below 500 MB free, scoring fails silently. Clear temp files or move the temp location using setx NTA_TEMP D:\Temp /M (reboot required).

Prevention for next time

• Block KB5025230 on Windows Server 2022 unless you absolutely need it. That update breaks scoring for many users.
• Monitor the registry key. Set up a scheduled task to check if HKLM\...\Scoring exists and has write permissions. Alert if it's missing or locked.
• Keep 1 GB free space on the system drive. Use a script to clean C:\Windows\Temp\NTA daily.
• Test after updates. After any Windows or AV update, run a manual anomaly scan to confirm scoring works.

One more thing: if you're using a third-party monitoring tool like SolarWinds NTA or PRTG, check if they override the Windows scoring engine. Disable that override and let Windows handle it — I've seen better results.

That's it. You should see anomaly scores again within 5 minutes. If not, check the Event Viewer for new errors and shoot me a comment below.