Security recommendation "Turn on antivirus"

[kenlee2370]

Hi, I have 50 2012R2 servers onboarded to Defender for endpoint. 

In security recommendations 21 of the 50 servers gets a recommendation to "Turn on antivirus" and "Turn on real-time protection. 

From what I see on the servers windefend service is running and looking good.

Why does it recommend these actions?

[#2]

Make sure those servers are update.
Sometimes, there might be delay and you could wait to receive the report.
Try restart affected devices and see if the problem persist?

[#3]

@Reza_Ameri  Thanks for answering. 

The devices are updated and rebooted but I still get the recommendation to turn on defender antivirus and real time protection.

Yes I see its quite a delay on the reporting, especially "software inventory" in the defender portal. 

[#4]

Just for test disjoint one or some of clients and join them and see if the problem persist?
You may file a support ticket with Microsoft too.

[#5]

Having the exact same issues here, server 2012R2, just onboarded one server and showing to turn on AV and real time scan etc even thought powershell command shows its active and running, any one has any answer to this..

[#6]

Do you have more than one servers onboarded?
And do any of the others report the same?

[#7]

"Solved" it. After the servers got new updates the message disappeared. No idea what caused this, might have been a bug. As I cross checked the configuration several times and they seemed identical.
The servers were rebooted before the patch as well, so it's not the reboot that solved it.

[#8]

Thank you for the update, from what you explained it might have been a bug which has been resolved when you update your device.