|
| 1 | +--- |
| 2 | +title: Deploy Microsoft Defender for Endpoint on Linux using golden images |
| 3 | +description: Learn how to use preconfigured virtual machine templates (golden images) for rapid, consistent Microsoft Defender for Endpoint deployment on Linux. |
| 4 | +ms.service: defender-endpoint |
| 5 | +ms.author: painbar |
| 6 | +author: paulinbar |
| 7 | +ms.reviewer: meghapriya |
| 8 | +ms.localizationpriority: medium |
| 9 | +manager: bagol |
| 10 | +audience: ITPro |
| 11 | +ms.collection: |
| 12 | +- m365-security |
| 13 | +- tier3 |
| 14 | +- mde-linux |
| 15 | +ms.topic: install-set-up-deploy |
| 16 | +ms.subservice: linux |
| 17 | +search.appverid: met150 |
| 18 | +ms.date: 09/04/2025 |
| 19 | +--- |
| 20 | + |
| 21 | +# Deploy Microsoft Defender for Endpoint on Linux using golden images |
| 22 | + |
| 23 | +[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)] |
| 24 | + |
| 25 | +**Applies to:** |
| 26 | + |
| 27 | +- Microsoft Defender for Endpoint for servers |
| 28 | +- Microsoft Defender for Servers Plan 1 or Plan 2 |
| 29 | + |
| 30 | +Golden images are preconfigured virtual machine templates used to rapidly deploy consistent environments. Microsoft Defender for Endpoint on Linux supports golden image deployment across cloud and on-premises environments, with improved handling of machine identifiers and hostnames, ensuring reliable telemetry and device correlation. |
| 31 | + |
| 32 | +This guide walks you through: |
| 33 | + |
| 34 | +- Deploying Microsoft Defender for Endpoint on a golden image. |
| 35 | + |
| 36 | +- Preparing the image for cloning. |
| 37 | + |
| 38 | +- Ensuring unique identifiers for each virtual machine instance. |
| 39 | + |
| 40 | +- Specific steps for cloud and on-premises environments. |
| 41 | + |
| 42 | +## Step 1: Deploy Microsoft Defender for Endpoint on a golden image |
| 43 | + |
| 44 | +1. Prepare the base virtual machine |
| 45 | + |
| 46 | + - Install your preferred [supported Linux distribution](./mde-linux-prerequisites.md#supported-linux-distributions) and apply all necessary system updates. |
| 47 | + |
| 48 | +1. Deploy Microsoft Defender for Endpoint on a golden image |
| 49 | + |
| 50 | + There are several methods and tools that you can use to deploy Microsoft Defender for Endpoint on Linux (applicable to AMD64 and ARM64 Linux servers): |
| 51 | + |
| 52 | + - [Installer script based deployment](./linux-installer-script.md) |
| 53 | + |
| 54 | + - [Ansible based deployment](./linux-install-with-ansible.md) |
| 55 | + |
| 56 | + - [Chef based deployment](./linux-deploy-defender-for-endpoint-with-chef.md) |
| 57 | + |
| 58 | + - [Puppet based deployment](./linux-install-with-puppet.md) |
| 59 | + |
| 60 | + - [SaltStack based deployment](./linux-install-with-saltack.md) |
| 61 | + |
| 62 | + - [Manual deployment](./linux-install-manually.md) |
| 63 | + |
| 64 | + - [Direct onboarding with Defender for Cloud](/azure/defender-for-cloud/onboard-machines-with-defender-for-endpoint) |
| 65 | + |
| 66 | + - [Guidance for Defender for Endpoint on Linux Server with SAP](./mde-linux-deployment-on-sap.md) |
| 67 | + |
| 68 | +1. Validate the deployment |
| 69 | + |
| 70 | + Check the health status of the product by running the following command. A return value of `true` denotes that the product is functioning as expected: |
| 71 | + |
| 72 | + ```bash |
| 73 | + mdatp health |
| 74 | + ``` |
| 75 | + |
| 76 | +> [!NOTE] |
| 77 | +> Once Defender is successfully deployed on the golden image, there's no requirement to install and onboard it individually on each cloned machine. |
| 78 | +
|
| 79 | +## Step 2: Prepare the golden image for cloning |
| 80 | + |
| 81 | +When deploying Defender for Endpoint on virtual machines, the hardware UUID reported by the system (system-uuid from dmidecode) is used to uniquely identify each instance. |
| 82 | + |
| 83 | +Before making a snapshot of the virtual machine, ensure that each virtual machine clone gets a unique hardware UUID, as described in the following sections. |
| 84 | + |
| 85 | +### On-premises machines |
| 86 | + |
| 87 | +For on-premises environments, configure your virtualization platform so that each clone receives a unique hardware UUID from the underlying hypervisor. Follow these guidelines: |
| 88 | + |
| 89 | +**KVM/libvirt** |
| 90 | + |
| 91 | +- Don't hard-code the `<uuid>` element in the virtual machine's domain XML; if it's omitted, libvirt generates a random one at definition time. |
| 92 | + |
| 93 | +- Alternatively, explicitly create a new UUID using `uuidgen`. |
| 94 | + |
| 95 | +- For streamlined cloning, use `virt-clone` or `virt-manager`, which automatically assign unique UUIDs. |
| 96 | + |
| 97 | +**VMware** |
| 98 | + |
| 99 | +- During cloning, VMware prompts whether to keep the existing UUID or to create a new one. Always select **Create**, or configure `uuid.action = "create"` in the virtual machine's *.vmx* file. |
| 100 | + |
| 101 | +- In VMware Cloud Director, set `backend.cloneBiosUuidOnVmCopy = 0` to force the creation of new UUIDs. |
| 102 | + |
| 103 | +**Hyper-V** |
| 104 | + |
| 105 | +Hyper-V automatically generates a new hardware UUID when you create a virtual machine using Hyper-V Manager or PowerShell ([New-VM](/powershell/module/hyper-v/new-vm)). |
| 106 | + |
| 107 | +### Cloud virtual machines |
| 108 | + |
| 109 | +Cloud platforms (for example, Azure, AWS, GCP) automatically inject unique metadata and identifiers via their instance metadata services (IMDS). No manual steps are required. Microsoft Defender for Endpoint automatically detects and uses these values to generate unique machine IDs. |
| 110 | + |
| 111 | +## Hostname Management |
| 112 | + |
| 113 | +If the hostname of a Linux server is changed after successful deployment of Defender, then you must restart the `mdatp` service to ensure the new hostname is correctly recognized by product. |
| 114 | + |
| 115 | +## Related content |
| 116 | + |
| 117 | +[!INCLUDE [Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)] |
0 commit comments