Forum Discussion

Iron Contributor

Apr 22, 2024

MDE onboarding issues with proxy configuration

Hello Everyone, We're currently in the process of onboarding MDE via scripts on several Windows 10 and 11 PCs. These PCs have proxies configured in Settings > Network & internet > Proxy > Manual pro...

drivesafely

Iron Contributor

Apr 24, 2024

jbmartin6

rahuljindal

Thanks for your responses.

We have onboarded devices in workgroup through script. The device status displays the info like versions as 0.0.0.0 and status is unknown. I have a doubt on applying security policy to the added device. Like i have created ASR, AV and Device policies. At the option to assign the policy, there is option to assign it to group only. I created a group through Intune, then added one of the device to it, then applied this group to the ASR and Device policy. The issue is that when i click on the Applied devices tab, i do see any devices applied although assigning the policy to the group to which the device is added.

How to we assign policies to such devices that are in workgroup ?

Please guide. Thanks,

rahuljindal

Bronze Contributor

Apr 24, 2024

Are you using security settings management to onboard the devices to MDE and manage the devices using Intune? If yes, then have the devices created a synthetic object in Entra ID? As for the unknown status, can you check if Defender antimalware service is enabled and running or not?

drivesafely
Iron Contributor
Apr 24, 2024
I have onboarded the device using a local script. I am trying to manage the devices through the portal "security.microsoft.com" and not through intune.
Due to other EDR running, i cannot run powershell or psexec tools. Can you guide other way to check whether the antimalware service is enable and running?
Thanks for your support,
- rahuljindal
  Bronze Contributor
  Apr 24, 2024
  You mentioned Intune here - “ I created a group through Intune, then added one of the device to it, ”, which is why I asked. Why and how is Intune being used here? Since you have another EDR solution running, which is the primary AV solution running on the devices? Can you check the manage security providers in Windows security and confirm?
  - drivesafely
    Iron Contributor
    Apr 25, 2024
    rahuljindal
    Since there is no option to create group and add devices to it through "security.microsoft.com" portal page, i created the group through intune.
    Further i followed the below guide and after many hours, i can see devices under the Applied devices tab in the policy.
    https://blog.mindcore.dk/2022/06/how-to-target-security-policies-to-devices-not-enrolled-into-intune/
    The primary AV is not the Defender. The other EDR is the primary AV solution.
    Since Defender is in passive mode, does any of the policies will take effect on devices?
    Thanks for your time and guidance,