Blog Post

Microsoft Defender for Endpoint Blog
9 MIN READ

Onboarding and servicing non-persistent VDI machines with Microsoft Defender ATP

JesseEsquivel's avatar
JesseEsquivel
Icon for Microsoft rankMicrosoft
May 05, 2020
Virtual Desktop Infrastructure (VDI) is fairly common in customer environments, especially in today’s world where many are working from home as a result of COVID-19. As such, we want to ensure that M...
Updated Sep 13, 2022
Version 9.0
remote work
VDI
virtual desktop
virtual machines
JonathanPitre's avatar
JonathanPitre
Brass Contributor
Jan 19, 2023

Couples questions and comments regarding this process.

  1. The offboarding script no longer works as Defender itself detects the psexec command as a virus threat when trying to stop the sense service. If the service cannot be stopped, the reg value senseGuid and the files from "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber" can't be deleted either.

  2. Please provide an improved PowerShell script to do the offboarding that actually works and has been tested. Doing QA on a recommended script to guarantee that the actual Antivirus is working is kind of important. This needs to work 100%.

  3. If indeed we need to download a fresh copy of the WindowsDefenderATPOnboardingScript.zip file every month, please provide a static URL to download it so we can automate the task with our master image update. Something like http://aka.ms/WindowsDefenderATPOnboardingScript. At this moment, this is a complete nightmare to maintain.

Also posted here
https://github.com/MicrosoftDocs/microsoft-365-docs/issues/10740