Report: Microsoft Defender (local) vs. Microsoft Defender for Endpoint

[dugi]

Hi Lansweepers!

We started rolling out Microsoft Defender for Endpoint, but Lansweeper didn't make any change on the clients, which are now using Microsoft Defender for Endpoint instead of Microsoft Defender.

Do you know, if there is any change to create a report, where I can see, if the client is using Microsoft Defender or Microsoft Defender for Endpoint?

Best,

Patrick

[DavidPK]

Hi Dugi,

We wanted to provide you with a more thorough explanation on a possibility on how to report on this. 

Make sure that to enable "services" in scan item intervals if not already enabled. You can find more information about scanned item intervals in the following KB article: https://community.lansweeper.com/t5/scanning-your-network/manage-scanned-item-intervals/ta-p/64335

Look to see if the "sense" service is running. This service is often associated with MDE.

You can then use Custom Registry Scanning and check for the presence of the key HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status. If this key exists, it's a strong indication of MDE being present.

More information on custom registry scanning can be found here: https://community.lansweeper.com/t5/scanning-your-network/scan-registry-values-with-custom-registry-...

[DavidPK]

Defender for Endpoint includes Microsoft Defender Antivirus so this remain local to the asset and can be scanned. 

To clarify more:

In general, when Lansweeper scans your assets, the antivirus information is being retrieved in two ways:

• By scanning the WMI class AntiVirusProduct.
• By comparing the installed software with the list of known antivirus software found in the web console under Software\Anti-Virus Settings

For Windows Server operating systems specifically, the AntiVirusProduct WMI class does not exist, and the antivirus information can only be retrieved from the second option listed above. More information on how Lansweeper scans antivirus information can be found in the following article: https://www.lansweeper.com/knowledgebase/managing-anti-virus-software-reports/