Forum Discussion

Riley Hale's avatar
Riley Hale
Brass Contributor
Feb 20, 2018

Exploit Guard - Network Protection

We've begun pushing the Windows 10 Fall Creator's Update in our business environment.  We have configured many of the new security features through GPO including Exploit Guard - Attack Surface Reduct...
Dylan Haines's avatar
Dylan Haines
Copper Contributor
May 10, 2018

We have a few PCs, pre and post 1709, that Defender is completely cutting off the network. In one case deleting wdnsfltr.exe and .sys solved it. Nothing in the Defender Event logs about blocking access to the network or a bad site. We are deploying via Group Policy from Server 2016. Win10 Pro clients.

 

DH

Steve Norton's avatar
Steve Norton
Brass Contributor
May 10, 2018

What platform versions are the affected clients running?

  • Dylan Haines's avatar
    Dylan Haines
    Copper Contributor
    May 10, 2018

    Win 10 Pro.

     

    One was 1709 and the other was 1603.

     

    In the case of 1709, we had to delete wdnsfltr while unjoined.

     

    In the case of 1603, we took it off the domain, applied 1709, rejoined and network came back. wdnsfltr never started up in this case.

     

    DH

    • Steve Norton's avatar
      Steve Norton
      Brass Contributor
      May 10, 2018

      What Windows Defender platform version was running at the time of the issues, look at C:\ProgramData\Microsoft\Windows Defender\Platform\x.xx.x.xxx for example. The issues we've seen have been a combination of Defender platform and OS version.

      Do you still have issues now with platform 4.14.17639.18041-0?

      • Dylan Haines's avatar
        Dylan Haines
        Copper Contributor
        May 10, 2018

        Both clients are at that version now, but part of the troubleshooting for both was to update them to 1709 so not sure what was there before.

         

        On checking now on other PCs, some platform folders are empty, some are at 4.12.17007.18022-0, etc etc

         

        How do we ensure everyone has current Defender regardless of OS patch level - is there a KB we can quickly push on everyone?

         

        Thanks

         

        DH

Resources