Autopilot & Windows Defender Antimalware Engine missing issue

-


If you are managing Microsoft Defender AV and Microsoft Defender for Endpoint policies using Intune, then chances are that you may come across an issue where Windows Defender Real-Time Protection doesn't enable after a device has been provisioned using Autopilot. I started experiencing this issue lately which also resulted in device reporting as non-compliant. 


On further investigation, I found out that Windows Defender Antimalware Real-Time Protection was not getting enabled because of the missing of Antimalware Engine. This is clearly evident under Windows Security > Settings > About section.

It appears that the check for security intelligence updates was not getting initiated during and post provisioning and the updates were not coming down automatically. This is odd because I have got the policies for automatic update of Defender AV updates enabled as part of my policies in Intune.


I must state that in my case the operating system is Windows 11 Enterprise and the devices are being configured in Co-managed state. However, the policy for Co-management would not apply unless the ConfigMgr agent installs which I am doing as the last step in the Account setup phase in Autopilot. Until then, the intelligence security updates should get pulled directly from Internet which didn't seem to happen automatically. 

To circumvent the issue, I decided to push down a script to initiate a scan for intelligence security updates during the Autopilot provisioning process. It is literally a one liner that needed to be put in a .ps1 file which will then take care of the scan.

####
Update-MpSignature
####

Now let's import it in Intune.

2. Browse to Devices > Windows > PowerShell Scripts
3. Click on Add
4. Give a Name
5. Select the script
6. Set Run this script using the logged on credentials as No
7. Set Enforce script signature check to No
8. Set Run script in 64 bit PowerShell Host as Yes
9. Deploy to a user\device based group.


That's it. Your devices should now scan for updates during Autopilot and should report compliant as intended. The activity will get logged in event viewer as well.




Until next time..

Comments

  1. AnonymousJuly 9, 2023 at 4:03 AM

    wow nice catchup and solution thanks for sharing

    ReplyDelete

Post a Comment

Popular posts from this blog

How to force escrowing of BitLocker recovery keys using Intune

-
Image
Every now and then it so happens that BitLocker recovery keys do not escrow in AAD. The usual culprits are incorrect BitLocker policies and\or the device hardware configuration failing to meet the minimum requirements. The other scenario and something I recently experienced is when everything is setup right and still the recovery key doesn’t escrow in AAD. As I understand, this can happen if the escrow process got interrupted the first time due to network or local devices related issues and the process could not resume. To circumvent this issue, one can simply push a PowerShell script to the devices to force the escrow of the recovery keys to AAD. Here is a script to do so. try{ $BitlockerVol = Get-BitLockerVolume -MountPoint $env:SystemDrive         $KPID=""         foreach($KP in $BitlockerVol.KeyProtector){             if($KP.KeyProtectorType -eq "RecoveryPassword"){              ...
Read more

Prevent users from running certain programs or applications on Windows endpoints using Intune

-
Image
  When it comes to blocking or preventing users from running an application on Windows devices, one normally uses App locker policy, Windows Defender Application Control and not so new but pretty useful method called Defender Vulnerability management within Microsoft 365 Defender Portal. A recent question on the Tech Community Microsoft forum prompted me to look for all possible alternatives. I started reminiscing over the legacy GPO policies and that is when I stumbled upon the policy  Don’t run specified Windows applications  located under User Administrative Templates - The policy setting does come with its own caveat - " This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs, such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from st...
Read more

Intune: Configure Printers for Non-Administrative Users

-
Image
Configuring printers for end users or giving them the ability to do it themselves is a normal requirement for organizations. Now if your users are Administrators, then the configuration can be straight forward, but in case of Non-Administrators there are additional steps required as Non-Administrators will not be able to add a driver in the driver store despite being able to install a printer. In this blog, I will cover the steps that I took to address this requirement using Intune. The setup involves 2 steps -  1. Setup registries. 2. Install the driver and configure the printer Setting up registries – The registries that need to be configured are actually part of a GPO setting – Allow non-administrators to install drivers for these device setup classes It can be found under: Computer Configuration -> Policies -> Administrative Templates -> System -> Driver Installation I used a Powershell script to set the values and wrapped it in a Win32 application. $P...
Read more