OnBoarding Yes or No but even not expected

Question

Hello,

CC @CherryZhang-MSFT

I just find out I have some machines which are showing as on-boarded!!!

2023-03-29_7-55-06 OnBoarding.png

Most of them are in Azure, is it automatically on?

We are using System Center Endpoint Protection on all Operating System Servers (with Windows defender feature as needed - Windows Server 2016 & 2019) but we do not use the onboarding... why is it on? It is Yes or No most of them are No but why does it exist?

I am also concerned by the last 3 VMs which are not in Azure and still showing onboarding, why?

Any settings to change? I see two Distribution Points from Configuration Manager from the 12 DPs we are using, why these two get onboarding?

Thanks,

Dom

Answer 1

Hello,

I checked the machine VRPSCCMDP02 listed as having MDE:

It is a Windows Server 2016 with System Center Endpoint protection and Windows Defender Feature.

2023-03-29_12-20-21 VRPSCCMDP02 - Uninstall MDE.png

How to uninstall MDE?

Thanks,

Dom

Answer 2

Hi @Duchemin, Dominique, 

1, Please help check if there are any Client Settings or ATP Policies have been deployed to these clients. The link for your reference:

Microsoft Defender for Endpoint - Configuration Manager | Microsoft Learn

2, We can also create an offboarding configuration file for them. The link for your reference:

Microsoft Defender for Endpoint - Configuration Manager | Microsoft Learn

I will be sharing for you if I have any update!

Thanks for your time!

Best regards,
Cherry

---

 

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Hello @CherryZhang-MSFT

No Client Settings:

2023-04-03_7-58-31 MDE Client Settings 01.png

I even do not have access to the settings for this..

2023-04-03_8-02-40 MDE Client settings 02.png

Any comments?

Thanks,

Dom

Answer 4

2023-04-03_20-20-07 Windows Defender.png Hello, in the troubleshooting there is a step "go to "Control Panel > Administrative Tools > Services", find the service "Windows Defender Advanced Threat Protection Service", right-click on the service and click "Stop". This will stop the service and prevent it from running on the host.: ... but this service does not exist on the client... Which service should be stopped?

The Windows Defender Service has an access denied on any action to stop it, pass it on manual, etc... Any idea? Thanks, Dom

Answer 5

Hi @Duchemin, Dominique, 

What is the SCCM version you are using? If you are using SCCM 2207 onboarding may be configured automatically.  

The link for your reference: What's new in version 2207 - Configuration Manager | Microsoft Learn

I will be sharing for you if I have any update.

Looking forward to your feedback.

Best regards

Cherry

---

  If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.