May 29 2020 10:59 PM
May 29 2020 10:59 PM
I've used the "Onboard servers to Security Center" with a workspace for our non Azure servers. The agent got installed successfully and could see the server on Microsoft Defender ATP as well as active. However, on the Azure Security Center dashboard, under recommendations, I see those servers as "Endpoint Protection not installed on non-Azure servers". Have an open ticket with Microsoft for almost a month without any resolution. Anyone faced this issue before and found a possible solution?
Jun 14 2020 07:45 AM
Please search the Log Analytics workspace in which the machine is connected to for the ProtectionStatus logs.
Query to target your computer looks like:
ProtectionStatus | where Computer has "<your computer name>"
check the ProtectionStatusRank. Anything other than 150 indicate unhealthy state.
If no logs return then it might be computer connection to workspace issue, check the 'Heartbeat' on the same query window
Jun 14 2020 08:27 AM
@Eli Sagie The query that shows that the end point not installed is as below:
*removed data that are our environment specific.
Not reporting - Unable to collect data
Malicious Software Removal Tool
Jun 14 2020 12:10 PM
@Eli Sagie I don't have much expertise on the query part, but found the query
Jun 15 2020 02:37 AM
@Ambarish Haridathan log existence by itself is not enough, you need to see that it is current (at least once a day).
Please check this out for better troubleshooting:
If further help still required and if you have Microsoft Support SR# please send it over so I can internally investigate further, else please create one and refer my name (Eli Sagie) as reference.
Jun 21 2020 08:55 AM
@Eli Sagie I checked the troubleshooting steps from the link you shared and everything seems to be ok in terms of connectivity. I've messaged you the existing ticket I have with MS as well. Thank you
Jul 04 2020 10:19 AM
I got somebody from Azure Security Center (ASC) working with MDATP team via the ticket and guided me to install System Center Endpoint Protection (SCEP) client. Over the call he mentioned that the MDATP engineer said that SCEP is more compatible with 2012 R2 server and had see performance issues with MDATP agent. I asked for an official document regarding this and then they sent me the link https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/mic... that MDATP is not compatible with 2012 R2.
However, I found another article which shows the support for 2012 R2 https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure...
Not sure if this is a platform support issue and some confusions within the support team
Jul 12 2020 09:36 AM
@Eli Sagie got some updates from the Microsoft support
From MS Team:
As per our investigation and discussion with MDATP engineers. Windows Defender is compatible with Windows 10, Server 2016 and 2019 only. For Windows 2012 server. System Center Endpoint Protection(SCEP) is one of the compatible AV for Server 2012.
Microsoft Defender Antivirus compatibility:
However, I found in the link from MS that 2012 is supported
Another engineer from Microsoft Security team confirmed the following:
SCEP will provide all the features of MDATP. And also 2012 R2 has SCEP as its Anti Virus, Defender is just an Anti Malware Service
Does it mean that I can I safely assume that I manually install the SCEP client on all Windows 2012 servers along with MMA agent and consider that it gives the same protection as Defender ATP?
Also, I can assign the same hardening policies which I will be applying on other server versions for Defender ATP and will get in effect?