Forum Discussion
unslog
Dec 28, 2024Brass Contributor
Get-MpComputerStatus output is blank
Hello,
We recently transitioned from ESET AV to a solution that uses the Microsoft Defender engine. However, we're encountering an issue where domain-joined VMs running Windows Server 2022 return no output when executing the following command:
Get-MpComputerStatus | Select AntivirusEnabled
The antivirus application (Heimdal Next-Gen Antivirus) relies on this output to verify that real-time scanning is enabled.
We have tried several troubleshooting steps, including rebooting the machines, running the command D i s m /Online /Enable-Feature /FeatureName:Windows-Defender, and checking the registry to ensure that Defender is not in passive mode. However, the issue persists.
Has anyone encountered a similar issue, or can anyone suggest additional steps to resolve this?
Any help would be greatly appreciated!
- mew-tuesdayCopper Contributor
Also experiencing this exact issue, somehow randomly out of nowhere three devices have started not responding to this command.
Anyone know a fix?
- mp_mariusCopper Contributor
Hi unslog ,
I'm not sure if this applies to the issue you're facing, but we also observed in some cases that the Get-MpComputerStatus did not return any information. Defender Antivirus was running properly as we confirmed by using Defender operational logs from Event Viewer and run Eicar tests.
In some cases we fixed the issue by reinstalling the antivirus platform or by reverting to a previous platform.
Download platform from Microsoft update catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623
Platform revert: https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-updates#how-to-roll-back-an-update
- TSaLCopper Contributor
Does the command Get-MpComputerStatus work?
- unslogBrass Contributor
Hi,
No, Get-MpComputerStatus doesn't work
- Tim BeerCopper Contributor
Most common thing I have seen while migrating from another AV is the key here
HKLM:\Software\Microsoft\Windows Defender
and the Disable Antivirus being set to 1 by the 3rd party Product
Also it's worth checking in Local Group Policy I've seen this a lot of times too
gpedit.msc
Computer Configuration > Windows Components> Microsoft Defender Antivirus >
Ensure Turn Off Defender is not Enabled
Finally also check Domain Group policy is not turning it off