Azure Defender Removal from VDI and Server VM

Question

Azure Defender Removal from VDI and Server VM

Ladi 0

Hello,

Unable to remove Defender and stop the service. Please help.

Removed Integration from Subscription for Defender
Removed MDE exstension from VMs
Policy is removed. GPO is set to "Turn off Windows Defender", "Turn off Real-time-protection" "MAPS-->Do not join Cloud" and many other Setting to turn off scanning, Registry hack also creating "DisableAntiSpyware" (Is being removed after automatically) etc. None of this are working to turn off the service or Defender.
When we install CrowdStrike AV is being removed after couple minutes. In event viewer 1034 is showing "Windows installer removed the product name CrowdStrike device control....
This is azure so something is that is preventing to remove the Defender and install our Custom AV. Is Temper Protection?

Marilee Turscak-MSFT 37,411 Reputation points Microsoft Employee Moderator

2023-02-27T21:52:47.3033333+00:00

If you need to remove Defender from your environment, you can follow the steps detailed in Protect your endpoints with Defender for Cloud's integrated EDR solution: Microsoft Defender for Endpoint. If you still face issues, you can use Azure Resource Manager to remove the Defender profile from AKS. The relevant template and parameters to remove the Defender profile are mentioned in the document, Remove the Defender Profile

As for the issue with CrowdStrike AV, it would help to check the event viewer for more information and errors. You might need to reach out to Windows support for that one.
Catherine Kyalo 3,100 Reputation points Microsoft Employee

2024-01-31T06:51:50.78+00:00
It seems like you are facing an issue in removing Microsoft Defender from your VMs and VDIs. There could be several reasons why you are unable to remove Defender. Here are a few things you can try:

Check if there are any policies set at the subscription or resource group level that could be enforcing Microsoft Defender. You can check this by going to the Azure portal and navigating to the subscription or resource group where your VMs and VDIs are located.

Ensure that you have administrative rights on the VMs and VDIs to uninstall Microsoft Defender.

Try uninstalling Microsoft Defender using PowerShell. You can use the following PowerShell command to uninstall Microsoft Defender: Uninstall-WindowsFeature -Name Windows-Defender

Your answer

Marilee Turscak-MSFT 37,411 Reputation points Microsoft Employee Moderator

2023-02-27T21:52:47.3033333+00:00

If you need to remove Defender from your environment, you can follow the steps detailed in Protect your endpoints with Defender for Cloud's integrated EDR solution: Microsoft Defender for Endpoint. If you still face issues, you can use Azure Resource Manager to remove the Defender profile from AKS. The relevant template and parameters to remove the Defender profile are mentioned in the document, Remove the Defender Profile

As for the issue with CrowdStrike AV, it would help to check the event viewer for more information and errors. You might need to reach out to Windows support for that one.
Catherine Kyalo 3,100 Reputation points Microsoft Employee

2024-01-31T06:51:50.78+00:00

It seems like you are facing an issue in removing Microsoft Defender from your VMs and VDIs. There could be several reasons why you are unable to remove Defender. Here are a few things you can try:

Check if there are any policies set at the subscription or resource group level that could be enforcing Microsoft Defender. You can check this by going to the Azure portal and navigating to the subscription or resource group where your VMs and VDIs are located.

Ensure that you have administrative rights on the VMs and VDIs to uninstall Microsoft Defender.

Try uninstalling Microsoft Defender using PowerShell. You can use the following PowerShell command to uninstall Microsoft Defender: Uninstall-WindowsFeature -Name Windows-Defender