Issues installing MDE on Win2K12 R2

[misrich]

Hello, I've been able to install MDE on Win2K16 & Win2K19 however, Win2K12 R2 is proving to be abit more complicated. When I execute the onboarding package I get the following error

[Error Id: 15, Error Level: 1] Unable to start Microsoft Defender for Endpoint Service. Error message: The service name is invalid.
For more information, visit: https://go.microsoft.com/fwlink/p/?linkid=822807

Went to the link and couldn't resolve the issue. I also noticed that Powershell is missing the Defender Module. Are there pre-requisites that are required before I can install MDE?

[#2]

did you install using the install.ps1 helper script or just manually installed the package? the install.ps1 helper script will check for any missing pre-reqs (https://github.com/microsoft/mdefordownlevelserver) . I have also found that occasionally even when the install reported successfully that either the PowerShell module was missing or the MDE engine version was blank. Running UpdatePlatform.exe (https://go.microsoft.com/fwlink/?linkid=870379&arch=x64) to update the defender engine and mpan-fe.exe (https://www.microsoft.com/security/encyclopedia/adlpackages.aspx?arch=x64)) resolved these issues on server 2012 R2 running the Unified MDE client.

If this doesn't work I would raise a support case with Microsoft for the issue.

hope that helps

Steve:)

[#3]

Secondly, I run the MDE Client Analyzer. Test: OMSListener; Resulta: SenseOms listener missing;
Guidance: This device is unable to upload cyber data. Contact Microsoft support if issue persists and you require assistance with onboarding.

I performed a telenet on the server to see if I can get out and it responds

[#4]

If the Defender PowerShell module is missing (e.g. Get-MPComputerStatus etc) does not return data or errors this needs to be resolved first as a lot of the other tools you run to collect MDE data rely on the PS cmdlets.

Also since there is no GUI on Server 2012 R2 you also need to use the PS cmdlets for running AV scans [Start-MpScan -ScanType QuickScan]

[#5]

The thread originated with a question about the installation of Microsoft Defender for Endpoint. IT Admins with access to the Microsoft 365 Admin Center have step-by-step guidance to set up and deploy Microsoft Defender for Endpoint using the deployment guide.

The guide detects settings in your tenant to provide you with tailored guidance.

Additionally, the Microsoft Defender for Endpoint deployment guide is used to view and configure features as well as save time with automated investigation and response. 

Note: If you don't have Microsoft 365 admin permissions, open the guide in a test or POC tenant to get instructions.