Start with this: https://www.linen.dev/s/worldofeuc/t/7982641/anyone-found-a-good-way-to-tell-what-is-consuming-pvs-cache-#624bcb6a-ab98-46db-9310-dff2372ef7d7 Those few posts show my GPO settings for Defender, along with my sealing script for the master/golden image, as those particular settings must be baked into the image. They can be reinforced via GPO, but they must be baked in to work properly.

As for the updates share, etc., use these links: https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/onboarding-and-servicing-non-persistent-vdi-machines-with/ba-p/1360721 https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/configuring-microsoft-defender-antivirus-for-non-persistent-vdi/ba-p/1489633

I did not onboard the master image, and would never recommend it. Instead, I used the GPO startup script method, where you download the onboarding scripts from your Defender portal and use Onboard-NonPersistentMachine.ps1 in a startup script.

I created a scheduled task to download Defender updates, and ran it on one of my management servers, using an account that had full control over the share that was used for them: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus?view=o365-worldwide

If you have any questions, fire away and I'll answer what I can recall. We don't use Defender at the new place, so I can probably only be so helpful.

Also, this is the PS script I used for the scheduled task: https://github.com/JesseEsquivel/MDATP/blob/master/Scripts/VDI/MDATP-Sec-Intel-Packages.ps1 I did modify it so that if it failed it e-mailed myself and another person. If you want a copy of that, let me know and I'll attach it here.

And yes, I feel guilty about not blogging this. Somewhere, Kasper is shaking his head at me.

@Nick Panaccio dumb question time...what should go in the scrip parameters portion if anything?

also i put this powershell ona network drive, not on the gold image bc i dont want the gold being onboarded

ok i got it working. im just dumb...thought i didn't need the .CMD file that is part of the vdi onboarding. Thought its either the Powershell file or the CMD. lol

I totally forgot that it has to live with the PS1 file since it calls the cmd.

Because why the hell would MS not just do everything in one script.

And bam, there's your logging from the cmd file: eventcreate /l Application /so WDATPOnboarding /t Information /id 20 /d "%successOutput%" >NUL 2>&1

I saw a cool post on reddit with someone who made their own script logic to avoid onboarding the gold image https://pastebin.com/Y9u2mY7f 1. if ($env:computerName.contains("GOLD")) { 2. Write-Host "This is a Citrix Gold Server, onboarding will be skipped" 3. Exit 4. } 5. else { 6. Write-Host "Onboarding has started" 7. & "C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup\Onboard-NonPersistentMachine.ps1" 8. 9. }

Thanks for your help @Nick Panaccio I still have to look at other parts you linked. the VDI won't update defender itself from microsoft? It needs all those other steps?

I don't know anyone who leaves Windows Update on in Citrix, so that option is basically DOA.

I stopped providing the Signature share, way too much work, I just set everything in GPO to MMPC updates, and monitore the signature age, didn't have any problems since then.

im thinking of a using the same server to download and host the share. I could just set up the files to download directly to the share right?

@Marco Hofmann does it require rebooting the vda or "baking" in the gpo?

Compared to using the shares.