Forum Discussion

Copper Contributor

May 30, 2020

Endpoint Protection not installed on non-Azure servers

Hi all, I've used the "Onboard servers to Security Center" with a workspace for our non Azure servers. The agent got installed successfully and could see the server on Microsoft Defender ATP as...

threat protection

Eli

Microsoft

Jun 14, 2020

Ambarish Haridathan ,

Please search the Log Analytics workspace in which the machine is connected to for the ProtectionStatus logs.

Query to target your computer looks like:

ProtectionStatus 
| where Computer has "<your computer name>"

check the ProtectionStatusRank. Anything other than 150 indicate unhealthy state.

If no logs return then it might be computer connection to workspace issue, check the 'Heartbeat' on the same query window

Ambarish Haridathan

Copper Contributor

Jun 14, 2020

Eli The query that shows that the end point not installed is as below:

*removed data that are our environment specific.

ProtectionStatus

| where (ComputerEnvironment != "Azure" or isempty(ResourceId)) and (TypeofProtection == "Malicious Software Removal Tool" or TypeofProtection == "No Anti-Malware Tool was detected")

| where tolower(SubscriptionId) in ("SUBSCRIPTION_ID") or isempty(SubscriptionId)

| summarize AggregatedValue = count() by Computer

| limit 1000000000

With the query you gave:

ProtectionStatusRank	450
ProtectionStatus	Not Reporting
ProtectionStatusDetails	Not reporting - Unable to collect data
SignatureVersion	Unknown
TypeofProtection	Malicious Software Removal Tool
ComputerEnvironment	Non-Azure
Type	ProtectionStatus

Eli
Microsoft
Jun 14, 2020
Not Reporting means just that. How is the Heartbeat?
- Ambarish Haridathan
  Copper Contributor
  Jun 14, 2020
  Eli I don't have much expertise on the query part, but found the query
  
  Heartbeat
  | where TimeGenerated > ago(1h)
  
  I could see that the server in question is showing up on this list from the query
  Is there anything in specific I should be looking at?
  - Eli
    Microsoft
    Jun 15, 2020
    Ambarish Haridathan log existence by itself is not enough, you need to see that it is current (at least once a day).
    
    Please check this out for better troubleshooting:
    
    https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows-troubleshoot
    
    If further help still required and if you have Microsoft Support SR# please send it over so I can internally investigate further, else please create one and refer my name (Eli Sagie) as reference.