Defender for Endpoint and policy changes

Wilson29184 11

Hello,

I'm currently testing Defender as our AV solution to replace a 3rd party one. I have the connection to Intune setup and I've onboarded my test devices.

I've also created an AV policy including a daily full scan at 10am.

It's now almost 5pm, in the Defender portal my device doesn't show that it's run a full scan today (force by the policy). If I look in my local security center, I can see the scan did run.

Is there a delay in the communications between the client and the portal? Other settings (like adding our support team's details to the local security center) synced quickly.

I'm just concerned that this will be an unreliable solution if scan data isn't reflected in the portal promptly.

update I'm actually posting this a day later (13th) and my machine hasnt ran a full scan at 10 like it should.

thank you

Wilson29184 11 Reputation points

2022-09-13T12:33:19.127+00:00

I will add that the policy is targeting a Group that the devices are a member of.
JamesTran-MSFT 36,596 Reputation points Microsoft Employee

2022-09-19T17:48:14.34+00:00

@Wilson29184
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

1 answer

Andrew Blumhardt 9,856 Reputation points Microsoft Employee

2022-09-13T12:26:52.53+00:00

Where are you looking in the MDE portal? I recommend filtering the device timeline for Antivirus events.

MDAV runs real-time scans. Scheduled scans are less important. The general recommendation is to run quick scans weekly.
Please sign in to rate this answer.

1 person found this answer helpful.
Wilson29184 11 Reputation points

2022-09-13T12:42:46.143+00:00

Hi Andrew,
Im looking on the overview page for the device.

Andrew Blumhardt 9,856 Reputation points Microsoft Employee

2022-09-13T12:59:21.387+00:00

That looks good to me. What am I missing?

Wilson29184 11 Reputation points

2022-09-13T13:29:44.83+00:00

the scheduled full daily scan hasnt been recorded today.
so im concerned policy changes are getting through (if this isnt)

Andrew Blumhardt 9,856 Reputation points Microsoft Employee

2022-09-13T20:50:11.74+00:00

You might double check the AV policy config in MEM to verify the schedule setup. Hard to say more with limited info. You might try the following steps, Check the sense event logs.

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus-when-migrating

JamesTran-MSFT 36,596 Reputation points Microsoft Employee

2022-09-15T20:51:45.567+00:00

@Wilson29184
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Defender for Endpoint and policy changes

1 answer

Your answer