Defender for Endpoint onboarding causes force reboot?

[tommihovi]

Is it known that in some cases onboarding to Defender for Endpoint can cause force reboot with 2 minute notice? Do we know when the reboot is forced and why for others this reboot does not happen? Is there some dependencies that need to be present (installed) if not exists?

[#2]

I haven't had this issue before. What OS do you have the issue with?
Are you removing other AV software at the same time?

[#3]

@Thijs Lecomte I cannot get my hands on a test device where I could do proper testing of onboarding due to covid-restrictions. I work for MSP so these devices are not from my own organization. This is also why I don't have full access to these devices (which are Windows 10 2004) and I cannot see event viewer which would tell me something of the reboot. So it's not 100% verified that the reboot is caused by the onboarding, but out of 4 devices that were onboarded 3 got forcefully rebooted within an hour of onboarding. No one else's device force rebooted during the day that day. So I'm suspecting it's the MD for Endpoint onboarding. They have Microsoft Defender Antivirus in use, no other AV solution installed.

You mentioned "issue". So you'd categorize force reboot during onboarding an "issue"? I have done just a few onboardings but mostly servers thus far. They did not reboot as far as I can remember.

[#4]

Yes, I haven't had it that computers rebooted after deployment.
I did an onboarding last week on Windows 10 1909 and didn't get any issue.
I think it might be another application forcing the reboot as I haven't heard any reports on this (maybe somebody from Microsoft can confirm)

[#5 · Accepted solution]

This most likely isn't Microsoft Defender for Endpoint causing the reboot -- but it's hard to tell with limited information. Can you open a support case or provide more details here?

[#6]

You are most likely right. I've come to believe that there is other configuration being pushed at the same time as the MDE onboarding happens and one of those changes causes force reboot. I just do not know which one. But all in all it is most definitely something else.

[#7]

Did you configure an Application Control Policy as a part of the onboarding? We've noticed this does trigger a reboot without notification or cancellation option. Even with the option not to reboot enforced, it still reboots ...

Maybe that's the same situation? More information can be found here:

https://www.reddit.com/r/Intune/comments/lwmx00/defender_application_control_forced_restarts/

[#8]

Oh Yes sir I did! Thanks for the link!

[#9]

You're welcome! 😉