Microsoft Defender EDR for old Windows Server 2008/2012/2016

%3CLINGO-SUB%20id%3D%22lingo-sub-2267070%22%20slang%3D%22en-US%22%3EMicrosoft%20Defender%20EDR%20for%20old%20Windows%20Server%202008%2F2012%2F2016%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2267070%22%20slang%3D%22en-US%22%3E%3CP%3EMicrosoft%20documentation%20states%20EDR%20feature%20is%20supported%20on%20older%20windows%20server%20versions%20like%20Server%202012%2F2016.%20Then%20it%20goes%20on%20to%20say%20to%20deploy%20the%20MMA%20agent.%20But%2C%20isn't%20MMA%20agent%20just%20a%20read-only%20log%20analytics%20agent%20that%20can%20only%20report%20the%20status%20of%20the%20server%20but%20can%20take%20no%20action.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHence%2C%20EDR%20means%20only%20detection%20but%20no%20response.%20Am%20I%20correct%20in%20understanding%20that%3F%20We%20are%20evaluating%20Defender%20for%20Servers%20and%20have%20gone%20through%20quite%20a%20lot%20of%20documentation%20but%20still%20no%20definitive%20answer.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2267070%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EDefender%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Ewindows%20server%202012%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Frequent Contributor

Microsoft documentation states EDR feature is supported on older windows server versions like Server 2012/2016. Then it goes on to say to deploy the MMA agent. But, isn't MMA agent just a read-only log analytics agent that can only report the status of the server but can take no action. 

 

Hence, EDR means only detection but no response. Am I correct in understanding that? We are evaluating Defender for Servers and have gone through quite a lot of documentation but still no definitive answer. 

0 Replies