Microsoft Defender for Endpoint topics

EnableConvertWarnToBlock will not enable - stays False

Warren212 — Tue, 04 Aug 2026 16:27:15 GMT

We have a GPO applied to Windows 11 Pro machine - fully patched and onboarded to MDE. The GPO enables "EnableConvertWarnToBlock" as follows:

The GPO is applied to the machine and the following registry key is populated:

But when I check the status on the client - it will not enable:

I have enabled troubleshooting mode and disabled tamper protection in case this is blocking but nothing seems to work. Its as if MDAV/MDE is not even looking/reading that registry key.

Anyone else have the same issue or ideas on resolution?

Location of Defender for Identity Entry in Defender Tables

MichaelMichalko — Mon, 03 Aug 2026 18:39:16 GMT

Our GRC group wants an automated report on windows servers and workstations over 7 days old not onboarded for Defender for Endpoint. A change in our environment (not sure if it was MS or us) has caused an additional entry in a column named "DiscoverySources" for Defender for Identity. It's my understanding that D4I is only used on domain controllers, but we get entries on non-DCs as well. This identifier does not appear on the device dashboard, nor can I add it in with the custom column tab. Furthermore, if a machine requires onboarding for D4E, it will show them both in the same column, it separates them with a comma in the same field.

Right now, I have to do this process manually and with the overhead involved, it takes me about 30 minutes to run the reports, filter out the false positives and forward them to the appropriate staff. They want this every day, and I can't do this operationally. I'd welcome the opportunity to create a Logic App based on a query to perform this function and route it.

Can someone point me in the direction of the table which contains the DiscoverSources column? I haven't been able to find it. That would help me to perform the necessary KQL and Logic App to automate this process.

Long time listener. First time publisher. Thanks

Defender Device Groups

alexcolombari — Thu, 30 Jul 2026 20:59:40 GMT

Hello everyone,

I need some help creating a device group in Defender. I can't find anything related to Groups inside Microsoft Security. I'd read that it's possible to create one inside the Permissions tab, but I can't figure out how.

Someone can explain what's the process?

Inconsistent Microsoft Defender Behaviour

OllieHay1 — Mon, 20 Jul 2026 07:54:38 GMT

Hi everyone,

We have an issue whereby across several intune managed devices with identical defender AV policy, signature version, and platform version, we've found inconsistent detection/remediation behaviour.

Some devices block malicious files instantly on download (expected and correct). Others only detect on open rather than on write, or log a successful detection/remediation action without the file actually being removed from disk, it remains fully accessible indefinitely.

Since this occurs despite identical config, we're concerned this is a genuine gap in automatic remediation reliability that could affect real threats, not just our test files.

Troubleshooting completed, issue persists:

- Ruled out exclusions (path/extension/process)

- Confirmed PUA protection, real-time protection, tamper protection, and all granular protection flags enabled/healthy

- Removed orphaned third-party AV registrations from WSC (previously caused Defender to show as "snoozed")

- Confirmed filter driver (WdFilter) loaded correctly, no conflicts

- Cleared stuck "detected but not remediated" threat entries

- Ruled out file locks preventing remediation

- Cleared cached signature state, forced fresh signature pull

- Attempted full platform reset

- Confirmed cloud protection/MAPS enabled and reachable

- Increased CloudBlockLevel to test enforcement aggressiveness

Does anyone have any idea what could be happening here?

Thanks

MDVM - Patch Publication Date

cipherdell — Thu, 16 Jul 2026 14:54:25 GMT

Dear Microsoft MDVM Development Team,

Please could you as quickly as possible implement the "Patch Publication Date" for the vulnerabilities you report on. Any major Vulnerability management platform has this simple field/record please advise you are implementing this and the timeframe for it?

Kind Regards,

Graeme

DVM Certificate Inventory Shows No Data Despite Healthy Endpoints in Defender for Endpoint

vijaysethiya — Tue, 07 Jul 2026 12:54:31 GMT

Hi Team,

I'm testing Microsoft Defender Vulnerability Management.

Current status:

- Defender Vulnerability Management Add-on enabled

- Certificates inventory tab is visible

- Software Inventory populated

- Security Recommendations populated

- Windows and Linux devices onboarded

- Linux mdatp health = healthy:true, licensed:true, cloud_enabled:true

- Devices have local certificates installed

- Certificate Inventory page shows "No data"

The DVM Add-on was enabled more than 36 hours ago.

Has anyone experienced a delay in Certificate Inventory population or are there additional prerequisites beyond DVM licensing and device onboarding?

Thanks.

Microsoft Defender false positive and WDSI submission details page bug

MykolaHaponiuk — Thu, 25 Jun 2026 02:56:05 GMT

Hello,

I am the developer and publisher of Pulse Launcher, a legitimate signed Windows application / Minecraft mod launcher.

I already submitted this through Microsoft Security Intelligence and also opened a Microsoft Q&A thread, but I am posting here because the WDSI submission portal itself appears to be broken for these submissions.

Related Microsoft Q&A thread:

https://learn.microsoft.com/en-us/answers/questions/5929545/microsoft-defender-false-positive-and-wdsi-submiss

There are two related issues:

1. Microsoft Defender cloud ML false positives keep appearing on public multi-engine scan results for the same signed application/product family. The Microsoft detection name changes across rescans and equivalent builds, including:

- PUA:Win32/Puwaders.C!ml

- Program:Win32/Wacapew.C!ml

- Trojan:Win32/Wacatac.B!ml

- Trojan:Win32/Wacatac.C!ml

- Trojan:Win32/Sabsik.EN.A!ml

2. Microsoft Security Intelligence submissions are visible in Submission history and show status "In progress", but opening the submission details page returns:

"The details for the submission were not found or the submission has expired."

Affected submission IDs:

- dd476efa-fc04-4f13-82cf-631bbfd145a6

- efc6514c-d700-4d6a-a7e2-67a9a83334a2

- ff8d04b7-c5fc-4a05-bd53-ee7ac5981284

File details:

- File name: pulse_launcher.exe

- SHA-256: def6059c07c3e1f4a8c5649a1bbf190d4f355ee8e8b88c55c5b404edee99ecc8

- Signer: FOP Haponiuk Mykola Viktorovych

- Certificate: GlobalSign EV Code Signing certificate

The executable is not VMProtect-packed or obfuscated. It is EV-signed. A previous Microsoft analyst response stated that the file did not meet Microsoft criteria for malware or PUA, but Microsoft cloud detections continue to appear.

Could someone route this to Microsoft Defender Security Intelligence / malware analysis, or advise how to escalate WDSI submissions that exist in history but whose details endpoint returns "not found or expired"?

Thank you.

Microsoft Defender for Endpoint and WDAC audit logs not include kernel audit/blocks

Warren212 — Fri, 12 Jun 2026 13:35:02 GMT

While testing WDAC on a fully patched Win11 pro machine - I noticed that kernel audit/block events do not get collected by MDE in the advanced hunting portal, only user mode audit/blocks are collected. Can anyone confirm they see this too and is this by design?

My test case is to use a Strict Kernel Mode WDAC policy (as per:

https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-policy-for-BYOVD-Kernel-mode-only-protection) which is active, using the global secure access client as my test, when the machine boots, the below event is generated locally on the machine:

This event is never shown on the MDE advanced hunting portal, though user events do show. Examples of events that are coming through:

Not receiving these events centrally for auditing would make deploying a kernel mode wdac control impossible. Would be amazing if Microsoft product team could look into this and resolve as these alerts should be captured as well please to facilitate deployment of more secure controls.

Ways to fetch quarantine files

Dhwani_Shah — Tue, 09 Jun 2026 05:36:57 GMT

We are working with quarantine files and have a few questions:

1. Is there a public API available to retrieve quarantined files from Microsoft Defender for Endpoint?

2. Is there a documented method to map an alert or a file SHA-1/SHA-256 hash to the corresponding object in the Defender quarantine store?

3. Is there a way to retrieve quarantined files other than using a PowerShell script through the Live Response API?

Understanding AI workloads on Linux

tejaskashyap — Tue, 02 Jun 2026 15:01:12 GMT

Hi everyone,

I’m a PM working on security for Linux environments and trying to better understand how AI workloads are actually showing up in production today.

Would appreciate hearing from folks here:

Are you running any AI workloads on Linux today? Or actively exploring?
What does your deployment/setup look like — e.g., model training/inference, agents, MCP servers, data pipelines, etc.?
How are you thinking about securing this stack, if at all?

If you’re open to a quick 30-min chat, I’d love to learn more from your experience as well.

Thanks in advance — this will directly help shape where we invest next.

Larac2shell: Turning MDE Live Response into a near real-time shell We are the EDR!

alkefallonitis — Fri, 08 May 2026 08:25:12 GMT

https://github.com/akefallonitis/larac2shell

Turning MDE live response into a near real time interactive shell beta version out

Features:

- Internal (Thanks to Fabian Bader - Nathan McNulty and xdrinternals research ) vs External api authentication
- Arbitrary command execution via pre-uploaded base64 wrapper script
- Cross-OS support

PS Two MSRC bugs reported for direct command execution bypass waiting for Microsoft Response in order to publish them

Coming SOON TM

Full LaraC2 Post Exploitation OST framework over MDE as C2/C3 Channel - We are the EDR / No external Infra / Onboarding to your controlled tenant silencing MDE

Happy testing 🥳 🎉

runHuntingQuery API and 'evaluate pivot'

Tim4 — Fri, 01 May 2026 09:26:00 GMT

Seem to have a problem where any request to the runHuntingQuery API with 'evaluate pivot' fails with

error": {

"code": "UnknownError",

"message": "",

Is this just a 'feature' ? The query happily runs trough the website/XDR portal. :-(

Is there a way to simulate a pivot (easily) in powerapps ?

Defender for Business - No alert after process lock out ?

karnalta — Tue, 27 Jan 2026 11:43:15 GMT

Hello all,

A few days ago, I have setup Defender for business server on a Windows Server 2019.

I can see that server in the Microsoft security portail devices list.

I have also tested the "suspicious" powershell command provided by Microsoft and it went all good. Powershell blocked, alert escaladed as incident in the security portal, email received, ...

But the next day, I tried to install a service on that server that got blocked by Virus & Thread Protection because it was attempting to modify a lot of files. That was a good point for Defender (it was not a real thread and was later added as exception).

My worry is that it was never escaladed to the security portal, I didn't received a alert email, .. The system blocked that "thread" multiple times during my attempt to deploy it and no incident were throw.

What could be wrong ?

Thank you.

Save the date - January 26, 2026 - AMA: Secure your endpoints with policy and Microsoft Defender

Pearl-Angeles — Tue, 20 Jan 2026 22:13:25 GMT

Save the date for January 26 at 8:00 AM PT! Have questions about using Microsoft Intune to enforce device compliance? Curious how to configure devices to help prevent security breaches and limit the impact of threats? Ask Microsoft Anything (AMA) about integrating Microsoft Defender for Endpoint with Microsoft Intune at Tech Community Live!

Product teams will be answering your questions live and in chat. Get tips using policy to onboard devices, define risk level, block non-compliant devices from accessing corporate resources, and more.

Go to aka.ms/AMA/SecureEndpoints to save the date and add this event to your calendar!

Defender for Identity health issues

zlate81 — Mon, 19 Jan 2026 11:31:19 GMT

When will the issues/alerts from defender for identity sensors be available to view via advanced hunting instead of the Graph API and "/security/identities/healthIssues"

Using MDE (Passive Mode) with Palo Alto Cortex XDR to enable Defender for IoT (Enterprise IoT)

gabpereira — Wed, 14 Jan 2026 13:56:04 GMT

Hi everyone!
I’m working with a customer that uses Palo Alto Cortex XDR as their primary EDR. We want to leverage Microsoft Defender for IoT specifically for Enterprise IoT (not OT/ICS). I have a few questions:

MDE in Passive Mode as a sensor:
Can Microsoft Defender for Endpoint (MDE) running in Passive mode act as a sensor to enable Enterprise IoT discovery/monitoring for Defender for IoT? Are there any feature limitations when MDE is not the primary EDR?
Appliance sensor in Enterprise IT:
If we cannot use the MDE agent, is it supported to deploy the Defender for IoT appliance sensor in an enterprise IT network (e.g., offices/campuses) to cover Enterprise IoT use cases?
Coexistence / Complementary sensors:
Is it possible (and recommended) to run the appliance sensor alongside MDE (sensor) to complement coverage/features? Any guidance on architecture, data overlap/deduplication, or licensing implications?

Alert tuning for Custom detection rules

mikhailf — Tue, 13 Jan 2026 18:40:36 GMT

undefined

MS Defender setting

sangbin — Mon, 12 Jan 2026 01:19:46 GMT

Hello, I have a question.

I'm not an English-speaking country, so please understand any shortcomings.

I'm trying to block or alert on specific URLs in Microsoft Defender > Settings > Endpoint > Rules > Indicators. I've completed the setup, but I'd like to customize the screen that appears on the webpage when an alert is triggered.

Is there a way to do this?

Thank you in advance for your help.

Grounds up

ozanwilliams — Wed, 07 Jan 2026 10:30:30 GMT

A business that respects others to help kis be business owners

Latest Threat Intelligence (December 2025)

Theo_Cohen — Mon, 29 Dec 2025 07:00:11 GMT

Microsoft Defender for IoT has released the December 2025 Threat Intelligence package. The package is available for download from the Microsoft Defender for IoT portal (click Updates, then Download file).

Threat Intelligence updates reflect the combined impact of proprietary research and threat intelligence carried out by Microsoft security teams. Each package contains the latest CVEs (Common Vulnerabilities and Exposures), IOCs (Indicators of Compromise), and other indicators applicable to IoT/ICS/OT networks (published during the past month) researched and implemented by Microsoft Threat Intelligence Research - CPS.

The CVE scores are aligned with the National Vulnerability Database (NVD). Starting with the August 2023 threat intelligence updates, CVSSv3 scores are shown if they are relevant; otherwise the CVSSv2 scores are shown.

Guidance

Customers are recommended to update their systems with the latest TI package in order to detect potential exposure risks and vulnerabilities in their networks and on their devices. Threat Intelligence packages are updated every month with the most up-to-date security information available, ensuring that Microsoft Defender for IoT can identify malicious actors and behaviors on devices.

Update your system with the latest TI package

The package is available for download from the Microsoft Defender for IoT portal (click Updates, then Download file), for more information, please review Update threat intelligence data | Microsoft Docs.

MD5 Hash: 5c642a16bf56cb6d98ef8b12fdc89939

For cloud connected sensors, Microsoft Defender for IoT can automatically update new threat intelligence packages following their release, click here for more information.