https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# _general
s
This message was deleted.
n
I don't know if this can be trusted, either. If I open Windows Security, both Real-time and tamper protection show as enabled (greyed out, managed by admin).
o
Hmm, i've only ever used the Get-MpPreference to confirm that exclusions have been set, i've always trusted that particular cmdlet, not used the above.
n
And Get-MpPreference has DisableRealtimeMonitoring set as False.
I was logged into a VM that showed False for an hour, ran it again and it then changed to True. Just weird because I did not see this in testing at all.
Here's an example of PS saying one thing, and the GUI saying another:
k
Which property are you looking at?
n
RealtimeProtectionEnabled
k
Hmmm...strangely enough I'm not even seeing that property on my W11 machine
Let me just check with local admin permissions
n
I see the same running as local admin, too, FWIW.
Also, W11? You disappoint me...
k
Nope, not seeing it as a local admin either
n
Conversely, here's a good VM:
k
Nothing wrong with W11. On a Surface device it runs smooth
💯 1
n
The tamper source being ATP, I believe, is expected. On many other VMs I'm seeing it set to UI.
I have a critical ticket open with MS right now.
k
Not seeing RealtimeProtectionEnabled on WS2022 either
n
lol
k
checking WS0219
Seeing it on WS2019
Haha...the property has another name in WS2022 and WS11, why would Microsoft do that?
In WS2022 and W11 it's called "DisableRealtimeMonitoring"
n
Why? Oh, we know why...
😞 2
k
Why do they keep doing this to us??
n
They all own those 'the beatings will continue until morale improves' t-shirts.
😄 1
k
I assume you are applying a group policy configuration for Defender?
n
I am, yes.
If I run Get-MpComputerStatus right before I shut down my image during sealing, everything looks fine. All protection enabled, etc.
I thought maybe the onboarding script was causing it, but booting a VM without it resulted in the same,.
k
Hmmm...
n
I'll see what MS says, as I uploaded the latest MDEAnalyzer logs.
k
I am booting my W10 test VM it runs 21H2. If I remember correctly you are on another build, right?
n
Yep, 20H2.
Installed the March updates in my OS layer, generated a new image, and now in QA everything (so far) is showing Enabled/True
k
20H2?? I'll see if I can dig up an old ISO somewhere 😛
n
Tamper source is still UI, which is weird to me, but whatever.
k
Could it be tamper protection acting up?
Or has that feature not found its way into Defender for W10 yet?
n
Tamper Protection is definitely included in W10/20H2, but I don't know that UI/ATP matter here. I just think it's odd that I'm seeing different values.
k
I agree and it doesn't look god from a monitoring perspective
I am also wondering why you are seeing this value changing
n
Welp, ran the detector test (https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/run-detection-test?view=o365-worldwide) on this VM 18 minutes ago, still no alert in the portal.
Running a PS script against all online VMs to check the realtime protection status. False in PS is indeed false, so I had to put an entire site in maintenance mode. Just want to verify that it's only affecting VMs in one datacenter and not the other, and if so, that makes it more likely that the issue is on my end of things. I still don't see what would cause realtime protection to become disabled, though, especially if it's some sort of network issue. Maybe if MS ever gets back to me on my critical ticket we can investigate together.
I take back everything positive I said about Defender, this shit is pure trash when it comes to consistency.
"I've never seen this before" - exactly what I want to hear from Microsoft support.
😄 1
3 Views
Open in Slack
PreviousNext
Powered by