You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -83,20 +83,20 @@ If your Windows Subsystem for Linux isn't installed yet, follow these steps:
83
83
84
84
3. Confirm that WSL is installed and running.
85
85
86
-
1. Using Terminal or Command Prompt, run `wsl –-update` to make sure you have the latest version.
86
+
1. Using Terminal or Command Prompt, run `wsl –-update` to make sure you have the latest version.
87
87
88
-
2. Run the `wsl` command to ensure WSL is running before testing.
88
+
2. Run the `wsl` command to ensure WSL is running before testing.
89
89
90
90
4. Install the plug-in by following these steps:
91
91
92
-
1. Install the MSI file downloaded from the onboarding section in the Microsoft Defender portal (**Settings** > **Endpoints** > **Onboarding** > **Windows Subsystem for Linux 2 (plug-in)**).
92
+
1. Install the MSI file downloaded from the onboarding section in the Microsoft Defender portal (**Settings** > **Endpoints** > **Onboarding** > **Windows Subsystem for Linux 2 (plug-in)**).
93
93
94
-
2. Open a command prompt/terminal and run `wsl`.
94
+
2. Open a command prompt/terminal and run `wsl`.
95
95
96
96
You can [deploy the package using Microsoft Intune](/mem/intune/apps/lob-apps-windows).
97
97
98
98
> [!NOTE]
99
-
> If `WslService` is running, it stops during the installation process. You do not need to onboard the subsystem separately; instead, the plug-in automatically onboards to the tenant the Windows host is onboarded to.
99
+
> If `WslService` is running, it stops during the installation process. You do not need to onboard the subsystem separately. Instead, the plug-in automatically onboards to the tenant the Windows host is onboarded to.
100
100
101
101
## Installation validation checklist
102
102
@@ -161,7 +161,7 @@ After installing the plug-in, the subsystem and all its running containers are o
You can see all WSL instances in your environment with an active Defender for Endpoint plug-in for WSL. These instances represent all distributions running inside WSL on a given host. The hostname of a *device* matches that of the Windows host. However, it's represented as a Linux device.
167
167
@@ -175,7 +175,7 @@ The timeline is populated, similar to Defender for Endpoint on Linux, with event
175
175
176
176
The plug-in onboards the WSL machine with the tag `WSL2`. Should you or your organization need a custom tag, please follow the steps outlined below:
177
177
178
-
1. Open Registry Editor as an administrator
178
+
1. Open Registry Editor as an administrator.
179
179
180
180
2. Create a registry key with the following details:
181
181
@@ -186,9 +186,9 @@ The plug-in onboards the WSL machine with the tag `WSL2`. Should you or your org
186
186
187
187
3. Once the registry is set, restart wsl using the following steps:
188
188
189
-
1. Open Command Prompt and run the command, `wsl --shutdown`.
189
+
1. Open Command Prompt and run the command, `wsl --shutdown`.
190
190
191
-
2. Run the `wsl` command.
191
+
2. Run the `wsl` command.
192
192
193
193
4. Wait for 5-10 minutes for the portal to reflect the changes.
194
194
@@ -255,81 +255,93 @@ DeviceProcessEvents
255
255
256
256
## Troubleshooting
257
257
258
-
1. The command `healthcheck.exe` shows the output, "Launch WSL distro with 'bash' command and retry in five minutes."
258
+
###The command `healthcheck.exe` shows the output, "Launch WSL distro with 'bash' command and retry in five minutes."
1. Open a terminal instance and run the command `wsl`.
261
263
262
-
2.If the previously mentioned error occurs, take the following steps:
264
+
2.Wait for at least five minutes before rerunning the health check.
263
265
264
-
1. Open a terminal instance and run the command `wsl`.
266
+
### The `healthcheck.exe` command might show the output, "Waiting for Telemetry. Please retry in five minutes."
265
267
266
-
2. Wait for at least five minutes before rerunning the health check.
268
+
:::image type="content" source="media/mdeplugin-wsl/wsl-health-check-telemetry.png" alt-text="Screenshot showing health telemetry status." lightbox="media/mdeplugin-wsl/wsl-health-check-telemetry.png":::
269
+
270
+
If that error occurs, wait for five minutes and rerun `healthcheck.exe`.
267
271
268
-
3. The `healthcheck.exe` command might show the output, "Waiting for Telemetry. Please retry in five minutes."
272
+
### You don't see any devices in the Microsoft Defender portal, or you don't see any events in the timeline
269
273
270
-
:::image type="content" source="media/mdeplugin-wsl/wsl-health-check-telemetry.png" alt-text="Screenshot showing health telemetry status." lightbox="media/mdeplugin-wsl/wsl-health-check-telemetry.png":::
274
+
Check the following things:
271
275
272
-
If that error occurs, wait for five minutes and rerun `healthcheck.exe`.
273
-
274
-
4. If you don't see any devices in the Microsoft Defender portal, or you don't see any events in the timeline, check the following things:
275
-
276
-
- If you aren't seeing a machine object, make sure sufficient time has passed for onboarding to complete (typically up to 10 minutes).
276
+
- If you aren't seeing a machine object, make sure sufficient time has passed for onboarding to complete (typically up to 10 minutes).
277
+
278
+
- Make sure to use the right filters, and that you have the appropriate permissions assigned to view all device objects. (For example, is your account/group is restricted to a specific group?)
279
+
280
+
- Use the health check tool to provide an overview of overall plug-in health. Open Terminal, and run the `healthcheck.exe` tool from `%ProgramFiles%\Microsoft Defender for Endpoint plug-in for WSL\tools`.
281
+
282
+
:::image type="content" source="media/mdeplugin-wsl/wsl-health-check-support.png" alt-text="Screenshot showing status in PowerShell." lightbox="media/mdeplugin-wsl/wsl-health-check-support.png":::
283
+
284
+
- Enable the connectivity test and check for Defender for Endpoint connectivity in WSL. If the connectivity test fails, provide the output of the health check tool to our support team.
277
285
278
-
- Make sure to use the right filters, and that you have the appropriate permissions assigned to view all device objects. (For example, is your account/group is restricted to a specific group?)
286
+
### Connectivity test reports "invalid" in health check
279
287
280
-
- Use the health check tool to provide an overview of overall plug-in health. Open Terminal, and run the `healthcheck.exe` tool from `%ProgramFiles%\Microsoft Defender for Endpoint plug-in for WSL\tools`.
288
+
- If your machine has a proxy setup, run the command `healthCheck --extendedProxy`. This will provide information on which proxy(s) is set on your machine and whether these configurations are invalid for WSL defender.
281
289
282
-
:::image type="content" source="media/mdeplugin-wsl/wsl-health-check-support.png" alt-text="Screenshot showing status in PowerShell." lightbox="media/mdeplugin-wsl/wsl-health-check-support.png":::
- If the steps mentioned above do not fix the problem, include the following configuration settings in the `.wslconfig` located in your `%UserProfile%` and restart WSL. Details about settings can be found in [WSL Settings](/windows/wsl/wsl-config#main-wsl-settings).
283
293
284
-
- Enable the connectivity test and check for Defender for Endpoint connectivity in WSL. If the connectivity test fails, provide the output of the health check tool to our support team.
294
+
**In Windows 11**
285
295
286
-
- If the connectivity test reports "invalid" in health check, include the following configuration settings in the `.wslconfig` located in your `%UserProfile%` and restart WSL. Details about settings can be found in [WSL Settings](/windows/wsl/wsl-config#main-wsl-settings).
296
+
```
287
297
288
-
- In Windows 11
298
+
# Settings apply across all Linux distros running on WSL 2
299
+
[wsl2]
289
300
290
-
```bash
291
-
# Settings apply across all Linux distros running on WSL 2
292
-
[wsl2]
301
+
dnsTunneling=true
293
302
294
-
dnsTunneling=true
303
+
networkingMode=mirrored
304
+
```
295
305
296
-
networkingMode=mirrored
297
-
```
306
+
**In Windows 10**
298
307
299
-
- In Windows 10
308
+
```bash
309
+
# Settings apply across all Linux distros running on WSL 2
310
+
[wsl2]
311
+
312
+
dnsProxy=false
313
+
314
+
```
300
315
301
-
```bash
302
-
# Settings apply across all Linux distros running on WSL 2
303
-
[wsl2]
316
+
### Connectivity issues persist
304
317
305
-
dnsProxy=false
306
-
```
318
+
Collect the networking logs by following these steps:
307
319
308
-
- If the connectivity issues persist, run the following steps to collect the networking logs
320
+
1. Open an elevated(admin) PowerShell prompt.
309
321
310
-
1. Open an elevated(admin) PowerShell prompt
311
-
312
-
2. Download and Run: `.\collect-networking-logs.ps1`
322
+
2. Download and run: `.\collect-networking-logs.ps1`
3.Open a new command prompt and run the following command: `wsl`.
321
333
322
-
4. Open an elevated(admin) command prompt and run: `wsl --debug-shell`
334
+
4.Open an elevated(admin) command prompt and run the following command: `wsl --debug-shell`.
323
335
324
-
5. In debug shell, run: `mdatp connectivity test`
336
+
5.In debug shell, run: `mdatp connectivity test`.
325
337
326
-
6. Allow the connectivity test to be completed
338
+
6.Allow the connectivity test to be completed.
327
339
328
-
7. Stop the .ps1 ran in step #2
340
+
7.Stop the .ps1 ran in step #2.
329
341
330
-
8. Share the generated .zip file along with support bundle that can be collected as mentioned in [steps](#support-bundle-collection).
342
+
8.Share the generated .zip file along with support bundle that can be collected as mentioned in [steps](#collect-a-support-bundle).
331
343
332
-
### Support bundle collection
344
+
### Collect a support bundle
333
345
334
346
1. If you run into any other challenges or issues, open Terminal, and run the following commands to generate a support bundle:
335
347
@@ -379,7 +391,7 @@ DeviceProcessEvents
379
391
4. If you see an error on launching WSL, such as "A fatal error was returned by plugin 'DefenderforEndpointPlug-in' Error code: Wsl/Service/CreateInstance/CreateVm/Plugin/ERROR_FILE_NOT_FOUND", it means the Defender for Endpoint plug-in for WSL installation is faulty. To repair it, follow these steps:
380
392
381
393
1. In Control Panel, go to **Programs** > **Programs and Features**.
382
-
394
+
383
395
2. Search for and select **Microsoft Defender for Endpoint plug-in for WSL**. Then select **Repair**. This action should fix the problem by placing the right files in the expected directories.
384
396
385
-
:::image type="content" source="media/mdeplugin-wsl/plug-in-repair-control-panel.png" alt-text="Screenshot showing MDE plug-in for WSL repair option in control panel." lightbox="media/mdeplugin-wsl/plug-in-repair-control-panel.png":::
397
+
:::image type="content" source="media/mdeplugin-wsl/plug-in-repair-control-panel.png" alt-text="Screenshot showing MDE plug-in for WSL repair option in control panel." lightbox="media/mdeplugin-wsl/plug-in-repair-control-panel.png":::
> In some cases, depending on your infrastructure, volume of traffic, and other conditions, `Set-MpPreference -AllowDatagramProcessingOnWinServer 1` can have an effect on network performance.
336
+
> [!NOTE]
337
+
> In some cases, depending on your infrastructure, volume of traffic, and other conditions, `Set-MpPreference -AllowDatagramProcessingOnWinServer 1` can have an effect on network performance.
338
338
339
339
### Network protection for Windows Servers
340
340
@@ -390,6 +390,9 @@ For Windows Servers and Windows Multi-session, there are additional items that y
390
390
391
391
Due to the environment where network protection runs, the feature might not be able to detect operating system proxy settings. In some cases, network protection clients are unable to reach the cloud service. To resolve the connectivity problem, [configure a static proxy for Microsoft Defender Antivirus](configure-proxy-internet.md#configure-a-static-proxy-for-microsoft-defender-antivirus).
392
392
393
+
> [!NOTE]
394
+
> Before starting troubleshooting, make sure to set the QUIC protocol to disabled in browsers that are used. QUIC protocol is not supported with Network Protection functionality.
395
+
393
396
## Optimizing network protection performance
394
397
395
398
Network protection now has a performance optimization that allows Block mode to start asynchronously inspecting long-lived connections, which might provide a performance improvement and can also help with app compatibility problems. This optimization capability is on by default. You can turn off this capability by using the following PowerShell cmdlet:
0 commit comments