AV Status shows disabled on end point

%3CLINGO-SUB%20id%3D%22lingo-sub-2615854%22%20slang%3D%22en-US%22%3EAV%20Status%20shows%20disabled%20on%20end%20point%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2615854%22%20slang%3D%22en-US%22%3E%3CP%3EMorning%2C%26nbsp%3B%20When%20I%20run%20a%20filtered%20report%20on%20machines%20via%20the%20security%20center%20I%20see%20around%2023%20(out%20of%20800%2B)%20machines%20that%20are%20active%20but%20show%20as%20AV%20Disabled.%26nbsp%3B%20Remoting%20to%20a%20few%20of%20these%20machines%2C%20I%20see%20that%20Defender%20is%20indeed%20running%20and%20doing%20its%20thing.%20Normally%20I%20get%20a%20warning%20that%20an%20endpoint%20is%20disabled%20but%20none%20on%20these%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20idea%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Morning,  When I run a filtered report on machines via the security center I see around 23 (out of 800+) machines that are active but show as AV Disabled.  Remoting to a few of these machines, I see that Defender is indeed running and doing its thing. Normally I get a warning that an endpoint is disabled but none on these

 

Any idea?

0 Replies