Microsoft Defender for Endpoint - Network Issues

[SteveTheITDude]

Hello,

We recently started onboarding our machines into the Microsoft Security Center and using Defender for Endpoint. 

After doing so, we've noticed what seems to be related to how defender is handing network traffic.

Issue 1 - We have an on-premise file share. When accessing network shares we're unable to open files randomly. We'll get generic errors like "Sorry we couldn't find [File Name]. Is it possible it was moved, renamed or deleted? and "Microsoft Excel cannot access the file [File Name]. There are several possible reasons".

However, if we access the same files from a machine that has not been onboard yet there are no issues whatever so. 

Issue 2 - When accessing flow.microsoft.com from a machine with defender for endpoint enabled, I can not edit any flows or do any work. The flow constantly comes back as "invalid connection". I've deleted and re-added the connection multiple times, re-authenticated etc and nothing seems to work.

However, same situation as above. When I access flow.microsoft.com from a machine that has not been onboarded yet there are no issues editing or working with the flows. 

I've disabled EDR in Block Mode and also the Customer network indicators just to see if it would help but no luck. So far the only thing that works is offboard the device. 

Thanks.

[#2]

@SteveTheITDudeDid you configure firewall rules either on MEM portal or via Group Policy?

[#3]

Im also experiencing the same issue. We have Server 2019 and we configure windows firewall via GPO and have it disabled.
I have a case open right now but I also see some old article that dates back to 2018 about this and supposedly was going to get fixed?

[#4 · Accepted solution]

Here's what ended up resolving my issues (although it sounds like it wont apply to your situation)

Issue 1 - File Shares - We discovered this was only happening on a file server that had Server 2012 R2. We ended up upgrading the server to 2019 and the issue disappeared.

Issue 2 - Access to Flow - Our DNS was also being filtered by a third party provider (DNSFilter). Once we disabled DNSFilter and just let Defender for Endpoint do the filtering, the access issues resolved.