SCCM Client Settings - Endpoint Protection

[DMobley_232]

Hello. Over 90% of our sccm clients are failing client check however, Client activity looks great.

I think the issue is we use Crowdstrike, but in our SCCM Client settings, we have a Endpoint Protection policy that is set to "Yes" for "Manage Endpoint Protection Client on Client computers".

From what I can tell, if using a 3rd party anti-virus, this setting should be set to No?

Is that correct?

[#2]

@DMobley_232 You don't mention what client checks are failing exactly, but setting the "Manage Endpoint Protection client on client computers" to "No" when using a third-party anti-malware solution would probably be a good idea.

[#3]

@Michiel Overweel I am referencing when you go to Monitoring> Client Status> Client Check

Unfortunately without a Microsoft document the admin will not set Microsoft endpoint Protection on client computers to no.

We us crowdstrike if that helps at all.

[#4]

@DMobley_232 What I meant was, you didn't mention which client checks fail. The Client Status dashboard (\Monitoring\Overview\Client Status) contains a Most Frequent Client Check Errors bar graph that should give you an idea which checks are failing most frequently.

As for the "Manage Endpoint Protection client on client computers" setting: this is set to "No" by default. Before you can even set this to "Yes", you need to install the Endpoint Protection point role in the site. None of this is required if you don't want to manage the Windows Defender using ConfigMgr, and both of these require a conscious decision by and effort from an administrator, so this is something that someone enabled in your site at some point in time.

More information:

• Planning for Endpoint Protection in Configuration Manager
• Endpoint Protection overview 
• How to configure Endpoint Protection 

[#5]

@Michiel Overweel 

Thank You. I see what you are saying now. It looks like it is failing the CcmEval task. 

We currently use Crowdstrike as our primary endpoint protection, however they still want Windows Defender in the event crowdstrike fails and defender would be the backup.

1. We do have "endpoint protection point" configured under Site system Roles.
2. There is a Desktop Policy under Assets and Compliance>Endpoint Protection>Antimalware policies
3. There is also a policy set for endpoint protection under Administration> Client Settings>

As a test. I created a new collection of 15 computers. They were all Client Check=Failed in Client status> Client check.

I created a new client setting policy under Administration> Client settings that was deployed to the 15 computers with "NO" to Manage Endpoint Protection Client on client Computers. Within 24 hours, 75% of the test computers successfully passed client check.

I then changed the setting to "Yes" and 24 hours later, all the computers but 1 are back to "Failed Client Check". In the computers that failed, I did find this in the ccmeval

Evaluating health check rule {B89B8B51-369F-42E6-80BC-FF46B8963B0F} : Verify/Remediate Antimalware service status for Windows 10 or up.      CcmEval               9/6/2020 10:56:03 AM  39032 (0x9878)

Attempting to change service status for service 'WinDefend' to 'Running'.              CcmEval               9/6/2020 10:56:03 AM         39032 (0x9878)

Failed to start the service 'WinDefend', hr=80004005        CcmEval               9/6/2020 10:56:03 AM  39032 (0x9878)

Any ideas?

[#6]

@DMobley232 This is exactly as expected. As documented in Microsoft Defender Antivirus compatibility , "If your organization's endpoints and devices are protected with a non-Microsoft antivirus/antimalware solution, and Microsoft Defender ATP is not used, then Microsoft Defender Antivirus automatically goes into disabled mode".

However, in your client settings you've configured Defender to be enabled. As a result, the Configuration Manager Health Evaluation task (CcmEval) will check the status of the Defender service and, if it isn't enabled and/or running, will try to enable and/or start it. Obviously this fails because a third-party antivirus solution is installed.

The aforementioned document also states that "When Microsoft Defender Antivirus is automatic disabled, it can automatically re-enable if the protection offered by a third-party antivirus product expires or otherwise stops providing real-time protection from viruses, malware or other threats. This is to ensure antivirus protection is maintained on the endpoint". So for that, you don't need to enable the Defender management client settings in ConfigMgr at all. My recommendation would be to disable these settings, and to uninstall the Endpoint Protection point if no longer needed.

[#7]

Ah, the quirks of SCCM and Endpoint Protection settings can make anyone do a double take, right?

[#8]

Your detective work seems spot on! When playing nice with a 3rd party like Crowdstrike, flipping the switch to "No" on "Manage Endpoint Protection Client on Client computers" often does the trick. It lets the external AV do its thing without unnecessary clashes.

For a deeper dive into this SCCM conundrum, you might want to explore the insights in the learn sccm community. They've got some real gems when it comes to navigating these tricky settings.