Microsoft Defender ATP via Intune for MacOS

Anonymous
2021-03-04T16:34:53.607+00:00

I am trying to deploy Microsoft Defender Endpoint for macOS via Intune , I added as available for a group of users and they can see the app available inside the company portal.

The problem is that when they click on install , the app change status to pending and a few minutes later as installed , with the option to re-install. But Microsoft Defender is not installed and can't find the app inside application and If I go to Endpoint Manager Admin Center the application in the computer is show as installed.

I'm not sure what is causing this and trying to troubleshooting without success , any idea where should I look ? Thanks

Microsoft Intune Application management
Microsoft Intune Application management
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Application management: The process of creating, configuring, managing, and monitoring applications.
912 questions
Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
4,693 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Anonymous
    2021-03-04T16:54:23.867+00:00

    I got this from the install.log in one macos computer :

    preinstall com.microsoft.wdav begin [2021-03-03 11:29:22 -0600] 738
    INSTALLER_SECURE_TEMP=/Library/InstallerSandboxes/.PKInstallSandboxManager/F6253205-F32C-4949-8D78-4C8E4EB3B104.activeSandbox/8E8DC93C-3719-4295-A4BD-95D11B04787B
    correlation id=F6253205-F32C-4949-8D78-4C8E4EB3B104
    Generation installation id
    Installation id: 6840F2BC-07AE-5148-8EA8-4541F016EE25
    Product version detected from build.plist
    is_new_install=1, bundle_version=101.10.72, branch=release/2009-2
    No proxy configured for telemetry URL
    [2021-03-03 11:29:28 -0600][LogTelemetry] submitting {"client":{"appVersion": "101.10.72", "hostname": "UserApplei.local", "machineGuid": "6840F2BC-07AE-5148-8EA8-4541F016EE25","productGuid":"c65eac3e-401e-4a0c-82e3-f106f693222f", "platform": "mac"},"reports":[{"$type":"installationReport", "correlation_id": "F6253205-F32C-4949-8D78-4C8E4EB3B104", "version": "101.10.72", "severity": "I", "code":"InstallStarted", "text":"is_new_install='1', bundle_version='101.10.72', branch='release/2009-2', package='/var/folders/zz/zyxvpxvq6csfxvn_n0000044000011/C/com.apple.appstore/4EA2FB0E-66C7-48E3-8AAD-D93B05BF4E53/wdav.pkg'"}]}
    % Total % Received % Xferd Average Speed Time Time Time Current
    Dload Upload Total Spent Left Speed

    0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
    0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
    100 699 100 126 100 573 117 534 0:00:01 0:00:01 --:--:-- 652
    {"actions":[{"$type":"SignatureUpdateAction","versionId":"83707","updateUri":"https://eu-cdn.x.cp.wd.microsoft.com/av64bit"}]}[LogTelemetry] result=0
    [2021-03-03 11:29:30 -0600][LogTelemetry] submitting {"client":{"appVersion": "101.10.72", "hostname": "UserApplei.local", "machineGuid": "6840F2BC-07AE-5148-8EA8-4541F016EE25","productGuid":"c65eac3e-401e-4a0c-82e3-f106f693222f", "platform": "mac"},"reports":[{"$type":"installationReport", "correlation_id": "F6253205-F32C-4949-8D78-4C8E4EB3B104", "version": "101.10.72", "severity": "I", "code":"InstallMDM", "text":"applemdmunknown"}]}
    % Total % Received % Xferd Average Speed Time Time Time Current
    Dload Upload Total Spent Left Speed

    0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
    0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
    100 514 100 126 100 388 144 446 --:--:-- --:--:-- --:--:-- 591
    {"actions":[{"$type":"SignatureUpdateAction","versionId":"83707","updateUri":"https://eu-cdn.x.cp.wd.microsoft.com/av64bit"}]}[LogTelemetry] result=0
    Clean installation
    Full package detected, proceed with installation
    Stopping main app
    No matching processes were found
    Stopping tray
    launchctl bootout gui/501 /Library/LaunchAgents//com.microsoft.wdav.tray.plist
    Could not find service "com.microsoft.wdav.tray" in domain for user gui: 501
    /Library/LaunchAgents//com.microsoft.wdav.tray.plist: No such file or directory
    Boot-out failed: 2: No such file or directory
    No matching processes were found
    Check if daemon is already installed
    Could not find service "com.microsoft.fresno" in domain for system
    Check that daemon is shut down...
    Running instances of wdavdaemon:
    All daemon processes stopped
    [2021-03-03 11:29:31 -0600][LogTelemetry] submitting {"client":{"appVersion": "101.10.72", "hostname": "UserApplei.local", "machineGuid": "6840F2BC-07AE-5148-8EA8-4541F016EE25","productGuid":"c65eac3e-401e-4a0c-82e3-f106f693222f", "platform": "mac"},"reports":[{"$type":"installationReport", "correlation_id": "F6253205-F32C-4949-8D78-4C8E4EB3B104", "version": "101.10.72", "severity": "I", "code":"StopDaemon", "text":"Result=0"}]}
    % Total % Received % Xferd Average Speed Time Time Time Current
    Dload Upload Total Spent Left Speed

    0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
    0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
    0 0 0 0 0 0 0 0 --:--:-- 0:00:02 --:--:-- 0
    0 0 0 0 0 0 0 0 --:--:-- 0:00:03 --:--:-- 0
    0 0 0 0 0 0 0 0 --:--:-- 0:00:04 --:--:-- 0
    0 0 0 0 0 0 0 0 --:--:-- 0:00:05 --:--:-- 0

    0 comments No comments

  2. Lu Dai-MSFT 28,366 Reputation points
    2021-03-05T02:19:13.763+00:00

    anonymous user Thanks for posting in our Q&A.

    For this issue, it is needed to do more detailed logs analysis to confirm what is causing this. With Q&A limitation, Q&A is not the best channel for such log analysis case. So we suggest to open a case to check on this. It is free. The following link describes how to open a case, we can refer to it:
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/get-support

    Thanks for understanding and have a nice day.


    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments