Defender for Endpoint - Unified onboarding failed on 2012 R2 - MpAsDesc.dll 310

[LoicM]

Hello,

We have some 2012 R2 servers which failed to install the new onboarding package.

Error code 1603.

Message is Verify that you have sufficient privileges to install system services.

Didn't found anything in the know issues related to that, any idea?

Thank you,

LoicM

[#2]

with another Admin account test it(Local / Domain/...).

[#3]

Same thing, tried with 2 account no success.

[#4]

Did you use the 2012R2 installer and right click run as administrator?
Disabled your old AV?

[#5]

Same issue here, it seems that the Security Essentials Tool Software doesnt allow to override the current settings.

[#6]

So far no luck on those machines for us too, we tried to disable 3rd party AV with no luck and support representative have not being really helpful to investigate the root cause.

[#7]

@LoicM did you disable or remove the av? Its recommended to remove it! What does the log say? 

[#8]

Hi @LoicM,

Step 1) Go to Add/Remove Programs (AppWiz.cpl) and make sure that there are no other Antimalware (e.g. SCEP) and/or EDR products installed.

Step 2) Have you tried installing using the "Installer script" documented here:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/server-migration?view=o365...

Step 3) Make sure that you have the latest* MDE installation package for Windows Server 2012 R2.
Note: * = (installs version 10.8048.22439.1065)

Which is documented here:
Microsoft Defender for Endpoint update for EDR Sensor
https://support.microsoft.com/en-us/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f6...

and which points to https://catalog.s.download.windowsupdate.com/d/msdownload/update/software/defu/2022/03/updatesensecl...

Step 4) If none of these help, please open a Microsoft support ticket (case).
Have the following handy:
aka.ms/MDEClientAnalyzer

A verbose MSI log
https://docs.microsoft.com/en-us/troubleshoot/windows-client/application-management/enable-windows-i...

A Process Monitor (ProcMon) while trying to install MDE
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-performance-i...

Thanks,
Yong Rhee - MSFT