I'm going out of my mind trying to get Microsoft Defender for Endpoint (MDE) to work in my small 2203 LTSR/MCS/Windows Server 2019 deployment. Does anyone here have a favorite deployment guide that just plain works? I've worked with XenApp/CVAD for many years, but I know nothing about MDE, and I'm unable to get the "child VMs" to show up as unique machines in the Device Inventory at https://security.microsoft.com/. My lack of understanding of MDE is a big part of the problem..

Is your gold image enrolled into MDE? If so, offboard the gold image

Hi Aaron, and thank you for the guidance. : ) I've offboarded the gold image, and our SCCM admin (we push MDE via SCCM) has excluded the parent/gold images from [re]enrolling. I'm once again trying the GPO approach as you've suggested. (Something about using GPO didn't seem to work previously, but I think that was due to confusion on my part.) May I ask if I need to do any HAADJ-related tasks as part of this MDE effort? All our endpoints were Hybrid-Joined as part of the MDE rollout.

You don’t need to hybrid join to enrol into MDE, but it would be the better approach to hybrid join your VDAs/session hosts

I've just dropped the PS1/CMD from the VDI-Onboarding ZIP into my BIS-F Custom folder. Works 100% Golden Master is not EntraID joined. BIS-F Entra joins the MCS clones during start up. That's all I've ever done (besides configuration, but that's a different topic.)

Hi Marco, if I can't MDE to work by itself, BIS-F will definitely be my next stop. I've always heard good things about it.

It’s A bit outdated by now but Matthias promised to fix it in the upcoming months. Also the tipp with a GPP scheduled task also works wonders. I do that for static non citrix servers which also works very well.

@Marco Hofmann Hi Marco, I've installed BIS-F 7.1912.7 on my gold image (I assume that's where you install it). Could you tell me.. Should those two Defender PS1/CMD onboarding files go in C:\Program Files (x86)\Base Image Script Framework (BIS-F)\Framework\SubCall\*Personalization\Custom* or C:\Program Files (x86)\Base Image Script Framework (BIS-F)\Framework\SubCall\*Preparation\Custom*?

It’s the Personalization Custom folder, which triggers at startup of the clones. But just to make sure. Installing BISF is not enough. You also have to configure it via ADMX or JSON and you have to execute before master shutdown.

Thank you, Marco. I guessed right then. 🙂 I have dropped the ADMX and ADML files into the PolicyDefinitions folder on our domain and can edit the GPOs as needed. I don't see any general "enable/disable BIS-F" in the BIS-F GPO. If I don't need to enable any additional BIS-F functionality beyond the Out-of-the-Box options (I only need SCCM-related fixes), should I not make any changes to the GPO? Do I just run C:\Program Files (x86)\Base Image Script Framework (BIS-F)\PrepareBaseImage.cmd from the gold image?

In the past it was best practice to enable/disable every setting, because every setting has a default in BIS-F. That means even if you don’t configure anything, things might get executed, which you don’t expect. Therefore I always recommend to set everything in BIS-F. Even if it means disabling 99%.