Forum Discussion

unslog's avatar
unslog
Brass Contributor
Dec 28, 2024

Get-MpComputerStatus output is blank

 

Hello,

 

We recently transitioned from ESET AV to a solution that uses the Microsoft Defender engine. However, we're encountering an issue where domain-joined VMs running Windows Server 2022 return no output when executing the following command:

 

Get-MpComputerStatus | Select AntivirusEnabled

 

The antivirus application (Heimdal Next-Gen Antivirus) relies on this output to verify that real-time scanning is enabled.

 

We have tried several troubleshooting steps, including rebooting the machines, running the command D i s m /Online /Enable-Feature /FeatureName:Windows-Defender, and checking the registry to ensure that Defender is not in passive mode. However, the issue persists.

Has anyone encountered a similar issue, or can anyone suggest additional steps to resolve this?

Any help would be greatly appreciated!

 

 

 

 

 

  • mew-tuesday's avatar
    mew-tuesday
    Copper Contributor

    Also experiencing this exact issue, somehow randomly out of nowhere three devices have started not responding to this command.

     

    Anyone know a fix?

  • mp_marius's avatar
    mp_marius
    Copper Contributor

    Hi unslog ,

    I'm not sure if this applies to the issue you're facing, but we also observed in some cases that the Get-MpComputerStatus did not return any information. Defender Antivirus was running properly as we confirmed by using Defender operational logs from Event Viewer and run Eicar tests.

    In some cases we fixed the issue by reinstalling the antivirus platform or by reverting to a previous platform.

    Download platform from Microsoft update catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623

    Platform revert: https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-updates#how-to-roll-back-an-update

     

     

     

  • TSaL's avatar
    TSaL
    Copper Contributor

    Does the command Get-MpComputerStatus work?

    • unslog's avatar
      unslog
      Brass Contributor

      Hi,

      No, Get-MpComputerStatus doesn't work

  • Tim Beer's avatar
    Tim Beer
    Copper Contributor

    Most common thing I have seen while migrating from another AV is the key here 

     

    HKLM:\Software\Microsoft\Windows Defender     

    and the Disable Antivirus being set to 1 by the 3rd party Product

     

     

    Also it's worth checking in  Local Group Policy  I've seen this a lot of times too

     

    gpedit.msc

    Computer Configuration > Windows Components> Microsoft Defender Antivirus >  

    Ensure Turn Off Defender is not Enabled

    Finally also check Domain Group policy is not turning it off

    • unslog's avatar
      unslog
      Brass Contributor

      Hi Tim Beer 

      Thanks for your message.

       

      I have checked the suggested registry settings and GPO , both seem to be fine.

       

      Any other suggestions?

       

       

       

       

Resources