Forum Discussion

Ambarish Haridathan's avatar
Ambarish Haridathan
Copper Contributor
May 30, 2020

Endpoint Protection not installed on non-Azure servers

Hi all,   I've used the "Onboard servers to Security Center" with a workspace for our non Azure servers. The agent got installed successfully and could see the server on Microsoft Defender ATP as...
threat protection
Ambarish Haridathan's avatar
Ambarish Haridathan
Copper Contributor
Jun 14, 2020

Eli The query that shows that the end point not installed is as below:

 

*removed data that are our environment specific.

 

ProtectionStatus
| where (ComputerEnvironment != "Azure" or isempty(ResourceId)) and (TypeofProtection == "Malicious Software Removal Tool" or TypeofProtection == "No Anti-Malware Tool was detected")
| where tolower(SubscriptionId) in ("SUBSCRIPTION_ID") or isempty(SubscriptionId)
| summarize AggregatedValue = count() by Computer
| limit 1000000000
 
With the query you gave:
ProtectionStatusRank450
ProtectionStatus
Not Reporting
ProtectionStatusDetails
Not reporting - Unable to collect data
SignatureVersion
Unknown
TypeofProtection
Malicious Software Removal Tool
ComputerEnvironment
Non-Azure
Type
ProtectionStatus
Eli's avatar
Eli
Icon for Microsoft rankMicrosoft
Jun 14, 2020
Not Reporting means just that. How is the Heartbeat?
  • Ambarish Haridathan's avatar
    Ambarish Haridathan
    Copper Contributor
    Jun 14, 2020

    Eli I don't have much expertise on the query part, but found the query

     

    Heartbeat
    | where TimeGenerated > ago(1h)
     
    I could see that the server in question is showing up on this list from the query
    Is there anything in specific I should be looking at?
    • Eli's avatar
      Eli
      Icon for Microsoft rankMicrosoft
      Jun 15, 2020

      Ambarish Haridathan log existence by itself is not enough, you need to see that it is current (at least once a day).

      Please check this out for better troubleshooting:

      https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows-troubleshoot

       

      If further help still required and if you have Microsoft Support SR# please send it over so I can internally investigate further, else please create one and refer my name (Eli Sagie) as reference.

      • Ambarish Haridathan's avatar
        Ambarish Haridathan
        Copper Contributor
        Jun 21, 2020

        Eli I checked the troubleshooting steps from the link you shared and everything seems to be ok in terms of connectivity. I've messaged you the existing ticket I have with MS as well. Thank you

Resources