Stackvora.tech

Microsoft Defender for Endpoint: onboard Windows clients

Microsoft Defender for Endpoint (MDE) provides robust protection for client devices, encompassing anti-malware, endpoint detection and response (EDR),…

Microsoft Defender for Endpoint (MDE) provides robust protection for client devices, encompassing anti-malware, endpoint detection and response (EDR), vulnerability management, and automated investigation capabilities. Effectively onboarding Windows clients into MDE is a critical first step to leveraging these features. This article details the primary methods for onboarding Windows 10/11 clients and Windows Server 2012 R2+ (with the unified agent) into MDE, focusing on practical implementation steps using Microsoft Intune and the local script method.

For context, MDE onboarding involves two main components: device registration with the MDE service and the installation/configuration of the MDE sensor. The sensor collects security telemetry and enforces policies. The methods discussed below facilitate both aspects, ensuring devices report to your MDE tenant.

Prerequisites and Licensing

Before initiating any onboarding process, ensure your environment meets the following requirements:

  • Licensing: Devices must have an MDE license assigned. This is typically included with Microsoft 365 E3/E5, Windows E5, or as a standalone MDE subscription. Confirm licenses are active for the users or devices intended for protection.
  • Network Connectivity: Endpoints require outbound connectivity to MDE service URLs. Essential URLs include *.securitycenter.windows.com, *.security.microsoft.com, *.blob.core.windows.net, *.s-microsoft.com, and various other endpoints for telemetry and updates. Refer to the official Microsoft documentation for the complete, up-to-date list, as these can change. Proxy servers and firewalls must permit traffic on TCP ports 443 (primarily) and potentially 80 for certificate validation.
  • Operating System:
    • Windows 10 (versions 1607+) / Windows 11 (all versions)
    • Windows Server 2012 R2, 2016, 2019, 2022 (requires the unified MDE agent. Server 2012 R2/2016 use a different agent package than 2019/2022 which have a built-in agent).
  • Tenant Access: Global Administrator or Security Administrator roles are needed in Microsoft 365 Defender portal (security.microsoft.com) to download onboarding packages and manage configurations.

Method 1: Onboarding with Microsoft Intune (Recommended for Modern Management)

Microsoft Intune provides the most streamlined and scalable method for onboarding Windows 10/11 clients, especially in cloud-managed or co-managed environments. This method leverages Intune's endpoint security capabilities to deploy the MDE configuration.

Step 1: Connect Intune to Microsoft Defender for Endpoint

First, establish the service-to-service connection between Intune and MDE. This allows MDE to receive device data from Intune and for Intune to deploy MDE policies.

  1. Navigate to the Microsoft Intune admin center (endpoint.microsoft.com).
  2. Go to Endpoint security > Microsoft Defender for Endpoint.
  3. Under "MDE Security Policy Settings," enable the toggle for Connect Windows devices to Microsoft Defender for Endpoint.
  4. Ensure "Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations" is also enabled if you plan to manage MDE settings directly from Intune's Endpoint Security profiles.
  5. Click Save.

This synchronization can take up to 24 hours to fully propagate, but often completes within minutes. Once connected, devices enrolled in Intune will automatically be marked for onboarding if MDE license requirements are met.

Step 2: Create an Endpoint Detection and Response (EDR) Policy in Intune

This policy specifically pushes the MDE onboarding configuration to target devices.

  1. In the Microsoft Intune admin center, go to Endpoint security > Endpoint detection and response.
  2. Click Create Policy.
  3. For Platform, select Windows 10, Windows 11, and Windows Server.
  4. For Profile, select Endpoint detection and response.
  5. Click Create.
  6. On the "Basics" tab, provide a Name (e.g., MDE - Windows Client Onboarding) and an optional Description. Click Next.
  7. On the "Configuration settings" tab:
    • Endpoint Detection and Response (MDE): This setting will likely show "Automatically onboard clients" or similar, indicating that the Intune-MDE connector handles the specifics. The critical part is that this policy ensures the MDE sensor is active and reporting.
    • For Windows Server 2012 R2 and 2016, you might need to use a "Custom" configuration profile to deploy the MDE unified agent installer separately, as Intune's built-in EDR profile primarily targets Windows 10/11 and Server 2019/2022 where the agent is OS-integrated.
  8. Click Next.
  9. On the "Assignments" tab, assign the policy to a device group (e.g., All Windows Devices or a specific test group). Avoid "All Users" for device-centric policies. Click Next.
  10. Review and click Create.

Once deployed, Intune-managed devices in the assigned group will receive the policy, download the necessary onboarding package, and register with MDE. This process typically completes within a few hours, depending on device sync cycles.

Method 2: Local Script Onboarding (Manual or GPO for Domain-Joined Devices)

The local script method is suitable for devices not managed by Intune, such as standalone PCs, devices managed by SCCM (without Intune co-management), or servers that need a quick, direct onboarding. This involves downloading a specific onboarding package from the MDE portal.

Step 1: Download the Onboarding Package

  1. Navigate to the Microsoft 365 Defender portal (security.microsoft.com).
  2. Go to Settings > Endpoints > Onboarding.
  3. From the "Select operating system to start onboarding process" dropdown, choose Windows 10 and 11 (for clients and unified agent for servers).
  4. From the "Deployment method" dropdown, select Local Script (for up to 10 devices) or Group Policy if you plan to deploy via GPO.
  5. Click Download onboarding package. This downloads a WindowsDefenderATPOnboardingPackage.zip file.

The ZIP file contains a single file: WindowsDefenderATPOnboardingScript.cmd.

Step 2: Deploy the Script

Option A: Manual Execution (for a few devices)

  1. Extract the WindowsDefenderATPOnboardingScript.cmd from the ZIP file.
  2. Copy the .cmd file to the target Windows client or server.
  3. Run the .cmd file as an administrator.
  4. A command prompt window will briefly appear, execute the script, and then close. No user interaction is required.

Option B: Group Policy Object (GPO) for Domain-Joined Devices

This is effective for scaling local script deployment across many domain-joined machines.

  1. Create a shared network folder accessible by all target devices (e.g., \\YourDomain\NETLOGON\MDE).
  2. Extract WindowsDefenderATPOnboardingScript.cmd into this shared folder.
  3. On a Domain Controller, open Group Policy Management (gpmc.msc).
  4. Create a new GPO (e.g., MDE - Onboarding GPO) and link it to an OU containing your target computers (e.g., Computers OU).
  5. Edit the new GPO.
  6. Navigate to Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown).
  7. Double-click Startup.
  8. Click Show Files... and copy the WindowsDefenderATPOnboardingScript.cmd into the opened folder (this copies it to the GPO's SYSVOL share).
  9. Back in the Startup Properties window, click Add....
  10. Click Browse... and select WindowsDefenderATPOnboardingScript.cmd. Click OK.
  11. Click OK again to close the Startup Properties.

Devices in the linked OU will execute this script upon next startup, onboarding them into MDE. It's crucial that the script is placed in a location accessible by the SYSTEM account of the client machines (SYSVOL is ideal for this).

Verifying Onboarding Status

After deploying an onboarding method, verify that devices are successfully reporting to MDE.

  1. On the Client Device:
    • Check the MDE service status: Open an elevated PowerShell and run Get-Service Sense. It should show Running.
    • Verify Sensor health: Run C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM\SenseIR.exe -h. This command is more relevant for older MDE versions or specific troubleshooting. For modern Windows 10/11, check the Event Viewer (Applications and Services Logs > Microsoft > Windows > SENSE > Operational). Look for Event ID 10 indicating successful onboarding.
    • Run a detection test: From the MDE portal (security.microsoft.com), go to Settings > Endpoints > Onboarding, select "Windows 10 and 11," and scroll down to the "Run a detection test" section for instructions on downloading a safe test file.
  2. In the Microsoft 365 Defender Portal:
    • Navigate to Assets > Devices.
    • Search for the device name. It should appear within minutes to a few hours of successful onboarding.
    • Click on the device to view its details, including sensor health status, last check-in, and discovered vulnerabilities.

Offboarding Devices

Sometimes it's necessary to remove a device from MDE, for example, when decommissioning hardware or reassigning it. The process also uses a script or Intune policy.

  1. Navigate to the Microsoft 365 Defender portal (security.microsoft.com).
  2. Go to Settings > Endpoints > Offboarding.
  3. Select the operating system (e.g., Windows 10 and 11).
  4. Choose your deployment method (e.g., Local Script or Group Policy).
  5. Click Download offboarding package. This downloads a WindowsDefenderATPOffboardingScript.cmd.
  6. Deploy this script using the same methods as onboarding (manual execution or GPO). The script removes the MDE sensor and configurations, ceasing reporting to your MDE tenant.

For Intune-managed devices, you can create an Endpoint Security policy (or modify an existing one) to set the "Endpoint Detection and Response" setting to "Offboard."

Common Pitfalls and Troubleshooting

  • Network Connectivity Issues: The most frequent cause of failed onboarding. Ensure firewalls, proxies, and network ACLs permit outbound traffic to MDE service URLs on TCP 443. Use Test-NetConnection -ComputerName <MDE_URL> -Port 443 from PowerShell to test connectivity.
  • Licensing: Verify that the device or user has an active MDE license. Unlicensed devices will not onboard.
  • Intune Sync Delays: When using Intune, policy application can take time. Force a sync from the device (Settings > Accounts > Access work or school > Info > Sync) or wait for the next scheduled sync.
  • Corrupted Onboarding Package: Redownload the package from the portal if you suspect corruption.
  • Conflicting Security Software: Other antivirus or EDR solutions can interfere with MDE installation or operation. Ensure they are properly removed or configured for co-existence (e.g., passive mode for MDE).
  • Server 2012 R2/2016 Agent: Remember that these OS versions require a separate installation of the "unified agent" (which replaces the Log Analytics agent dependency) *before* the onboarding script or Intune policy will fully function for MDE. The agent download is found under "Server 2012 R2 and 2016" in the MDE onboarding settings.
  • Event Viewer Logs: Always check the "Microsoft > Windows > SENSE > Operational" event log on the client for detailed errors related to MDE. Key event IDs include 10 (onboarded), 12 (offboarded), 307 (connectivity issue).

Back to the knowledge base · Ask the AI assistant