Windows defender for Endpoint on VDI SENSE service breaking VDI's from displaying engine status

Dave Baker 1 Reputation point
2021-04-26T15:09:13.153+00:00

We're running a non-persistent VDI pool with FileShares as the definition update source. This has been working fine until we began onboarding/offboarding VM's into security centre.

Initially, I configured the image to run the onboarding script for 'multiple entries' in VDI to check it works - it did, with plenty of duplicate machine names. I then adjusted the master image to use the 'single entry' method described here

This also appears to work, we don't see anymore duplicates in the Security Centre console, but the local VM's do not display their Defender engine status.
91297-defenderimage.jpg

Reading around KB's for defender and 'troubleshoot onboarding ' docs - there's some core services that must be running on the VMs - diagtrack, windefend, rpcSs AND Sense service. Checking I could see all of these services were running (presumably a good thing...). At this point I had not ran an offboarding script on the master image (which is recommended). I ran the offboarding script, created a new snapshot, published, and then could see the VM's DID display their engine status correctly, and appeared to perform their startup task to fetch definitiosn from our UNC share.

We're on E3 licensing, my question is this - the Defender SENSE service appears to be causing the defender engine to 'break' on the child VM's , with the service running, VM's do not display their last update status, should the SENSE service be running if we're onboarding VM's to security centre? Why does the SENSE service cause the defender engine to egg-timer/not display it's status - is this a licensing limitation or incompatibility the 'FileShares' updating for definitions w/ onboarding to security centre?

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,924 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Leila Kong 3,701 Reputation points
    2021-04-27T08:50:03.947+00:00

    Hello @Dave Baker ,

    Is there any error message showing the Defender SENSE service cause the defender engine not display its' status?
    Did you Manage Microsoft Defender Antivirus updates?
    Did you meet the requirements for Microsoft Defender for Endpoint?

    For your reference:
    https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-onboarding?view=o365-worldwide
    https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/event-error-codes?view=o365-worldwide
    https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility?view=o365-worldwide
    https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide
    https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/minimum-requirements?view=o365-worldwide

    Best regards,
    Leila

    ----------

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

  2. Leila Kong 3,701 Reputation points
    2021-05-11T03:22:54.03+00:00

    Hello @Dave Baker ,

    How are things going there on this issue?
    Please let me know if you would like further assistance.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.