Windows Server 2016 x64 - unable to enable Defender Missing KB's

Thanks, Yes it's on the working server. It seems the whole Folder Windows Defender Advanced Threat Protection is missing. For now I've just copied the platform folder to the problem server. I can copy the whole folder if required as there are multiple folders within Windows Defender Advanced Threat Protection folder (see below)

on a side note I would need to change the perms on the other folders as I don't have access


Working Server
1718011695462.png

Problem server with platform folder copied across

1718011835282.png

Problem server after trying to start sense service

1718011916138.png

Thanks
 
Please post the result of the following commands.
Code: 
sc query sense
sc qc sense
 
ERROR_PROCESS_ABORTED 1067 (0x42B) The process terminated unexpectedly.

Please try to start the Sense service again with Process Monitor running.
 
Please copy all the other folders from the working server too, then run SFC /Scannow.
 
Folders have been copied and SFC /Scannow run with no errors

I also tried to start sense service again which failed

1718017330471.png

Services view when trying to start the service

1718017406658.png
 
Hmm, please run the following command and post the result:
Code: 
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /s

Please check also the following folder if it exist or not? C:\Program Files\Windows Defender Advanced Threat Protection
 
Folder was not present in C:\Program Files\Windows Defender Advanced Threat Protection This has now been copied over

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /s - output below


1718019335309.png
 
Please do the following to export this key as *.hiv file.
Code: 
reg save "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" "%userprofile%\Desktop\ATP.hiv"
 
The only thing I can see is there's still a configuration pending.

Pleasy try to start the Sense service again after copying the ATP in the Program Files directory.
 
Unfortunately same error. I rebooted the server in the hope that would help. It's not looking to good is it.
1718021028174.png
 
Let's see if the result of the following commands is still the same with exit_code (0x42B).
Code: 
sc query sense
sc qc sense

Check also the Defender service.
Code: 
sc start WinDefend
sc query WinDefend
sc qc WinDefend
 
stinger007 said:
(...) They use trend as the main AV. Defender is used in passive mode in order to report to MDE.
Click to expand...

How is the Defender for Endpoint agent installed? With this command or in another way?
Code: 
Msiexec /i md4ws.msi /quiet FORCEPASSIVEMODE=1

This because the REG_DWORD value "ForceDefenderPassiveMode" is not present in the ATP.hiv. Since Trend Micro is the Primary AV-solution it is recommended to use the above command! What you can try is to add this value manually to see if it makes any difference in adding this server to the MDE config manager.

Code: 
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v ForceDefenderPassiveMode /t REG_DWORD /d 0x1 /f

Have you run the WindowsDefenderATPOnboardingScript.cmd script as well which is provided by Microsoft in combination with the *.MSI-file (md4ws.msi)....?
 
Ok so there are two parts to the onboarding process.

1) - Run Install.ps1 - This will install the Unified Agent, this is used to report back to MDE. This is where the install is failing as one of the prerequisites is that defender is installed and running. In this environment it will run in passive mode along with Trend. The issue I'm having is whoever built these servers completely removed defender from them and installed trend which was the wrong way to set things up

Before UA Microsoft was something called MMA for the agent, but this is now being retired and UA is being used in it's place

2) One UA is installed I then run WindowsDefenderATPOnboardingScript.cmd This will then onboard to MDE, but only if the UA agent has been installed

I've attached both files for your viewing

Maxstar said:
How is the Defender for Endpoint agent installed? With this command or in another way?
Code: 
Msiexec /i md4ws.msi /quiet FORCEPASSIVEMODE=1
Click to expand...
The above command is for the install of the UA agent not defender, however as explained above I use a PS Script provided by MS to install UA as the command above never works. This is the error that comes up on the problem server when I use the command above

1718030938534.png
Maxstar said:
This because the REG_DWORD value "ForceDefenderPassiveMode" is not present in the ATP.hiv. Since Trend Micro is the Primary AV-solution it is recommended to use the above command! What you can try is to add this value manually to see if it makes any difference in adding this server to the MDE config manager.
Click to expand...
I will add the below to the reg and let you know
Maxstar said:
Code: 
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v ForceDefenderPassiveMode /t REG_DWORD /d 0x1 /f
Click to expand...

This is what my onboarding folder looks like, Install.ps1 will call md4ws.msi and install it

1718030888740.png

Update - Attachments to large will upload via We transfer and post link in next post
 
stinger007 said:
The above command is for the install of the UA agent not defender, however as explained above I use a PS Script provided by MS to install UA as the command above never works. This is the error thatcomes up on the problem server when I use the command above
Click to expand...

Searching this KB number (KB4052623) I've found this blog-post of an Microsoft MVP which may help us to resolve this issue.
 
You must log in or register to reply here.
Back
Top