Defender for Endpoint not being able to remove detected malware.

Question

We have all our devices enrolled in MEM, and are using Defender for endpoint. On 2 devices we see reoccurring malware files. Security Center shows the files as blocked / prevented. But Defender does not seem to be able to quarantine the files. Nor remove them;
A full system scan does not clean up the files either.
How can we clean these files, without manually deleting them from the pc?

Answer 1

You may consider walking the user through an offline scan: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-offline

Many organizations also reimage systems with persistent issues.