Download Windows Defender For Server 2012 R2

0 views

Skip to first unread message

Rosamunda Froats

unread,

Aug 3, 2024, 5:38:47 PM8/3/24

to ofofbrevwon

We have been running Simplehelp for many years and are generally happy with the system. In the last month Microsoft Defender has found a number of files to be malware:
Remote Access-windows32-offline.exe
Remote Work-windows32-offline.exe
Remote Support-windows32-offline.exe

I do not believe that these files are malware but I am also unwilling to exclude this directory from Defender scans. I just allowed defender to delete the files and that has not impacted the product at all so far. These files seem to exist in all SimpleHelp installations. I picked these up while running a weekly FULL defender scan on my servers. Is anyone else experiencing this issue? I contacted support and their answer was for me to submit the files to Microsoft.

When we finally were able to get 5.4.11 installed that fixed our problems with Defender (At least for now). Previous versions were breaking our SSO as well and 5.4.11 also fixed that issue. If you have not, I would suggest you that you upgrade.

As of yet, I have not heard what the official installation procedure should be considering the content of this Knowledgebase article, which indicates that Server 2019 no longer plays nice by disabling it's internal antivirus and firewall components when 3rd party security clients are installed.

I had not seen or heard of this behavior before installing CPEP on a windows server 2019 VM hosting our Blackberry UEM MDM platform, so CPEP went in on top of the MS components. I have since only disabled the Windows Defender Firewall for just "domain" network profile for that VM.)

The SK also mentions that this can be done "via GPO" but does not cover how. (caveat, I have yet to, but will fully read through the whole admin guide and whatever other documentation I can find for the latest releases of CPEP to see if it is covered there and will report back if I have a definitive answer)

Which somewhat ambiguously seems to state that you can uninstall windows defender completely using the add remove roles and features Wizard, after suggesting earlier in the post that removing the feature components only removes the user interface.

Anyway, would anyone from Check Point proper like to suggest the specific steps one should take if we intend to deploy CPEP to even a newly built Windows 2016 or 2019 server with nothing but the OS installed yet?

Also, regarding the aforementioned Blackberry UEM server: I deployed the client while actually working with CP support on a Zoom remote support session. I happened to notice that windows firewall was still running during the same remote session; I was told at that stage that the wscsvc service was removed in the OS and this is Microsoft's doing and by their design. At the end of the day I am therefore at a disadvantage in the case of this specific production server if I was supposed to turn off Windows Defender Anti-Malware BEFORE installing CPEP.

So, a specific question, did I break anything by having installed CPEP on a windows Server 2019 machine before "turning off" Windows Defender Anti-Malware? I would assume not if the TAC engineer did not indicate this, but I want to be sure. Once I know what the correct "turn off" method is for Defender per CP, I just hope there is nothing I need to worry about having done things in the wrong order.

I would be interested to hear anyone's experiences with CPEP and Windows Server 2016 / 2019 and whether you noticed any issues, or whether you realized that Windows Defender components were still running.

I have not tried removing the Windows Defender Feature yet. I will try that now, but if there is a best practice way of disabling any Windows based security client components that might interfere with any of the full set of CPEP blades (via GPO) I would like to know.

Disabling Windows Defender Anti-Malware and Windows Defender Firewall is needed for Windows Server 2016/2019 machines only, if you plan to install Endpoint Security client on it with Anti-Malware and Firewall Blades.

If you wish to mass disable Windows Defender Firewall\uninstall Windows Defender Anti-Malware - Powershell scripts can be used from the instructions above for all Windows Servers 2016\2019. The scripts can be applied via GPO.

Yes, on Windows 10 machines, in case Endpoint Security Firewall or\and Endpoint Security Anti-Malware blades are installed - Windows Defender (AV) or\and Firewall will be turned off (this is done with wscsvc (Windows Security Service) service that must be running, which is absent in Windows Server 2016 and 2019, as per Solution section in SK159373 mentioned above).

Hi Kiril, We've recently started pushing out endpoint client upgrades to users who are on older version to E84.00 and some users have reported they are getting windows security popup after the update any idea why it might be coming?

yes the popup is related to windows defender firewall and mitel connect application but is it not supposed to happen when endpoint client is installed? we thought windows firewall service is turned off by checkpoint endpoint client.

I have seen this behavior on Windows Server 2016 and 2019 because (from what both TAC and development has told me) Microsoft removed the API call to hand off control of firewall and antimalware to third party products at install time. You need to manually disable them. Windows 10 however still plays nice and the Windows Security panel will indicate who is providing firewall and antivirus services. Take a look at that and see if it mentions Check Point as providing firewall. If so, that is an even more strange occurrence considering the dialog box you saw.

Whenever I have Docker running and several containers up, the server gets very slow to the point of responsiveness, with the Antimalware Service Executable from the Windows Defender Service taking up almost all available resources.

I discovered which processes to add to the exclusion list by running the Microsoft Defender Performance Analyzer. Performance analyzer for Microsoft Defender Antivirus - Microsoft Defender for Endpoint Microsoft Learn

Once ran and analyzed it was clear that defender was scanning all the files that node was writing to yarn cache even though it was all happening within the container. This slowed down the write so much that yarn install failed with a network error (this is a known issue in yarn v1).

Contents:

Enable Windows Defender GUI on Windows Server
How to Uninstall Windows Defender Antivirus on Windows Server 2019 and 2016?
Managing Windows Defender Antivirus with PowerShell
How to Exclude Files and Folders from Windows Defender Antivirus Scans
Get Windows Defender Status Reports from Remote Computers via PowerShell
Updating Windows Defender Antivirus Definitions
Configure Windows Defender Using Group Policy

The cmdlet displays the version and the date of the latest antivirus database update (AntivirusSignatureLastUpdated, AntispywareSignatureLastUpdated), enabled antivirus components, the time of the last scan (QuickScanStartTime), etc.

You can get the Microsoft Defender Antivirus status from remote computers using PowerShell. The following simple script will find all Windows Server hosts in the AD domain and get the Defender state through WinRM (using the Invoke-Command cmdlet):

Windows Defender Antivirus can automatically update online from Windows Update servers. If there is an internal WSUS server in your network, the Microsoft antivirus can receive updates from it. You just need to make sure that the installation of updates has been approved on your WSUS server (Windows Defender Antivirus updates are called Definition Updates in the WSUS console), and clients are targeted to the correct WSUS server using GPO.

Download Windows Defender updates manually ( -us/wdsi/defenderupdates) and place them to a shared network folder. Set the path to the shared folder with Defender updates:
Set-MpPreference -SignatureDefinitionUpdateFileSharesSources \\mun-fs01\Defender

Windows especially have fantastic preinstalled Windows Defender Antivirus on their major operating system. Keeping the server secure from the well-known attacks Windows Defender will surely help you. It has a very simplistic mechanism and configuration which you can do as per requirements.

In some OS settings windows defender antivirus is disabled due make the performance better. But we can go ahead and check the status of Windows Defender using the following steps whether it is installed or available to install,

3. Now you can see all the available or installed status of windows defender antivirus and modules/addons of the windows defender antivirus. All the items with Available Status you can install using following methods,

In the windows server operating systems (2012, 2016, etc) there is no GUI is installed/enabled by default for Windows Defender Antivirus. But, windows offer us options to install/enable the GUI using server manager or Powershell. If the above command turned output as Available for Windows Defender and its add-on modules, you can install it from server manager or Powershell.

This is a crucial part of Windows Defender Antivirus working. The default settings offered by windows are quite decent and should work properly as per security concerns but we can take the configuration to next level and make sure to increase server security with manual configuration.

If any real-time malware activity got detected then its information will be shared with Microsoft, the collectively provided data from other servers as well will help Microsoft to stop or workaround to those potential risks.

We've noticed that in windows update we're constantly reminded to install intelligence updates for windows defender. Looking further, Windows defender seems to be still enabled. This happens on all of our 3 server 2019 systems.

Server Windows OS do not contain the Security center known from consumer Windows. To my best knowledge ESET products v8 and older disable Defender via its settings as well as the appropriate Scheduler tasks so if MsMpEng.exe is still running, probably disabling Defender failed. I'd recommend raising a support ticket for further investigation.