Forum Discussion
Offboard multiple machines (unreachable)
So I can see how to POST one machine at a time in Defender ATP API Explorer to offboard one machine, but curious the best way to handle multiple machines.
Is there a way to post multiple machine IDs at one time to offboard all of them?
2 Replies
If you are familiar with PowerShell you could try out the PSMDATP module
https://github.com/alexverboon/PSMDATP
that has a Remove-MDATPDevice cmdlet to offboard devices.
https://github.com/alexverboon/PSMDATP/blob/master/docs/Remove-MDATPDevice.md
With that you could create a text file with all the devies you want to remove and then simply run a forEach loop calling the remove-MDATPDevice cmdlet.
- Alex Verboon
I was trying to use this module to offboard some devices, but it does not seem to succeed, although I do see the devices have the tag "Offboarded."
I am able to get a list of devices, so other portions of the module are working correctly.
Here's what I get:
remove-MDATPDevice -DeviceName computer.mydomain
VERBOSE: GET https://api.securitycenter.windows.com/api/machines with 0-byte payload
VERBOSE: received 30374-byte response of content type application/json; odata.metadata=minimal
StatusCode : 200
StatusDescription : OK
Content : {"@odata.context":"https://api.securitycenter.windows.com/api/$metadata#Machines/$entity","id":"computerdeviceID","computerDnsName":"computer.mydomain","firstSe
en...
RawContent : HTTP/1.1 200 OK
x-content-type-options: nosniff
x-request-id: {requestID}
OData-Version: 4.0
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Content-Lengt...
Forms : {}
Headers : {[x-content-type-options, nosniff], [x-request-id, {requestID}],
[OData-Version, 4.0], [Strict-Transport-Security, max-age=31536000 ; includeSubDomains]...}
Images : {}
InputFields : {}
Links : {}
ParsedHtml : mshtml.HTMLDocumentClass
RawContentLength : 903
True
