Forum Discussion
Endpoint Protection not installed on non-Azure servers
Eli I don't have much expertise on the query part, but found the query
MicrosoftAmbarish Haridathan log existence by itself is not enough, you need to see that it is current (at least once a day).
Please check this out for better troubleshooting:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows-troubleshoot
If further help still required and if you have Microsoft Support SR# please send it over so I can internally investigate further, else please create one and refer my name (Eli Sagie) as reference.
Eli I checked the troubleshooting steps from the link you shared and everything seems to be ok in terms of connectivity. I've messaged you the existing ticket I have with MS as well. Thank you
Eli got some updates from the Microsoft support
From MS Team:
As per our investigation and discussion with MDATP engineers. Windows Defender is compatible with Windows 10, Server 2016 and 2019 only. For Windows 2012 server. System Center Endpoint Protection(SCEP) is one of the compatible AV for Server 2012.
Referred Document:
Microsoft Defender Antivirus compatibility:
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect-eu.mimecast.com%2Fs%2F0Hw9CBPKLU0EDxiv81n7%3Fdomain%3Dnam06.safelinks.protection.outlook.com&data=02%7C01%7C%7Ce73e394576224ff2c1b008d822072116%7C77062e0dc7da46b08b044c018aa88a0d%7C0%7C0%7C637296761320595657&sdata=MeARV2GngpJMZ%2BPgkGRC8D3zIIM9n40QUon5uRObLYM%3D&reserved=0
However, I found in the link from MS that 2012 is supported
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect-eu.mimecast.com%2Fs%2FgmCGCwKYmckYv5tqB6Kj%3Fdomain%3Dnam06.safelinks.protection.outlook.com&data=02%7C01%7C%7Ce73e394576224ff2c1b008d822072116%7C77062e0dc7da46b08b044c018aa88a0d%7C0%7C0%7C637296761320585658&sdata=64U6BXAR9N5ahO1qRv61d4RPsWa4gSv0Rwdyxo2burY%3D&reserved=0
Another engineer from Microsoft Security team confirmed the following:
SCEP will provide all the features of MDATP. And also 2012 R2 has SCEP as its Anti Virus, Defender is just an Anti Malware Service
Does it mean that I can I safely assume that I manually install the SCEP client on all Windows 2012 servers along with MMA agent and consider that it gives the same protection as Defender ATP?
Also, I can assign the same hardening policies which I will be applying on other server versions for Defender ATP and will get in effect?
Please advise.
I got somebody from Azure Security Center (ASC) working with MDATP team via the ticket and guided me to install System Center Endpoint Protection (SCEP) client. Over the call he mentioned that the MDATP engineer said that SCEP is more compatible with 2012 R2 server and had see performance issues with MDATP agent. I asked for an official document regarding this and then they sent me the link https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect-eu.mimecast.com%2Fs%2FomRQCgnBLtK8prsxSF7J%3Fdomain%3Ddocs.microsoft.com&data=02%7C01%7C%7C944e9a49d2d24492c0a208d81f8ddb71%7C77062e0dc7da46b08b044c018aa88a0d%7C0%7C0%7C637294041440982295&sdata=9TBIiDyJGwMtLYvW8K0gcofwcGk7wh8ZnQ0KjqnD00g%3D&reserved=0 that MDATP is not compatible with 2012 R2.
However, I found another article which shows the support for 2012 R2 https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints
Not sure if this is a platform support issue and some confusions within the support team