Defending Windows Server 2012 R2 and 2016

Paul Bendall this indeed means the unified install package delivers Defender Antivirus on Windows Server 2012R2 to Microsoft Defender for Endpoint customers.

The recommendation on server OS is to remove Defender if you are using a third party AV solution - unless you are using passive mode which is only available when running Microsoft Defender for Endpoint. This mode is now also available with the new solution. Please read more about this here. (Note Defender does not automatically go into passive mode on servers, please follow the instructions on the linked page). For 2016 servers where you are already in a disabled state and you are switching from 3rd party read up here.

Once you have followed the instructions at the link above (remove disablement and/or install the feature) and you notice Defender is still not running ”c:\Program Files\Windows Defender\mpcmdrun.exe” -wdenable usually does the trick. Don’t forget to update the OS, including Defender Antivirus platform updates, all the way to the latest (at time of writing 4.18.2109.6) product version before installing the package.