Skip to content

Commit dd6e6eb

Browse files
garycentricgarycentric
authored
Merge pull request #1479 from MicrosoftDocs/main
Publish main to live 09/27/2024, 3:30 PM
2 parents b4539a9 + b5d5c65 commit dd6e6eb

9 files changed

+467
-99
lines changed

‎defender-endpoint/deployment-vdi-microsoft-defender-antivirus.md‎

Lines changed: 54 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Configure Microsoft Defender Antivirus on a remote desktop or virtual desktop infrastructure environment
33
description: Get an overview of how to configure Microsoft Defender Antivirus in a remote desktop or non-persistent virtual desktop environment.
44
ms.localizationpriority: medium
5-
ms.date: 08/22/2023
5+
ms.date: 09/27/2024
66
ms.topic: conceptual
77
author: denisebmsft
88
ms.author: deniseb
@@ -51,12 +51,31 @@ This guide describes how to configure Microsoft Defender Antivirus on your VMs f
5151
5252
## Set up a dedicated VDI file share for security intelligence
5353

54-
In Windows 10, version 1903, Microsoft introduced the shared security intelligence feature, which offloads the unpackaging of downloaded security intelligence updates onto a host machine. This method reduces the usage of CPU, disk, and memory resources on individual machines. Shared security intelligence now works on Windows 10, version 1703 and later. You can set up this capability by using Group Policy or PowerShell, as described in the following table:
54+
In Windows 10, version 1903, Microsoft introduced the shared security intelligence feature, which offloads the unpackaging of downloaded security intelligence updates onto a host machine. This method reduces the usage of CPU, disk, and memory resources on individual machines. Shared security intelligence now works on Windows 10, version 1703 and later. You can set up this capability by using Group Policy or PowerShell.
5555

56-
|Method | Procedure |
57-
|---------|---------|
58-
| Group Policy | 1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure, and then select **Edit**.<br/><br/>2. In the Group Policy Management Editor, go to **Computer configuration**.<br/><br/>Select **Administrative templates**.<br/><br/>Expand the tree to **Windows components** \> **Microsoft Defender Antivirus** \> **Security Intelligence Updates**.<br/><br/>3. Double-click **Define security intelligence location for VDI clients**, and then set the option to **Enabled**. A field automatically appears.<br/><br/>4. Enter `\\<sharedlocation\>\wdav-update` (for help with this value, see [Download and unpackage](#download-and-unpackage-the-latest-updates)).<br/><br/>5. Select **OK**.<br/><br/>Deploy the GPO to the VMs you want to test. |
59-
| PowerShell | 1. On each RDS or VDI device, use the following cmdlet to enable the feature: `Set-MpPreference -SharedSignaturesPath \\<shared location>\wdav-update`. <br/><br/>2. Push the update as you normally would push PowerShell-based configuration policies onto your VMs. (See the [Download and unpackage](#download-and-unpackage-the-latest-updates) section the \<shared location\> entry.) |
56+
### Group Policy
57+
58+
1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure, and then select **Edit**.
59+
60+
2. In the Group Policy Management Editor, go to **Computer configuration**.
61+
62+
3. Select **Administrative templates**. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates**.
63+
64+
4. Double-click **Define security intelligence location for VDI clients**, and then set the option to **Enabled**.
65+
66+
A field automatically appears.
67+
68+
5. Enter `\\<Windows File Server shared location\>\wdav-update` (for help with this value, see [Download and unpackage](#download-and-unpackage-the-latest-updates)).
69+
70+
6. Select **OK**, and then deploy the GPO to the VMs you want to test.
71+
72+
### PowerShell
73+
74+
1. On each RDS or VDI device, use the following cmdlet to enable the feature:
75+
76+
`Set-MpPreference -SharedSignaturesPath \\<Windows File Server shared location>\wdav-update`
77+
78+
2. Push the update as you normally would push PowerShell-based configuration policies onto your VMs. (See the [Download and unpackage](#download-and-unpackage-the-latest-updates) section in this article. Look for the *shared location* entry.)
6079

6180
## Download and unpackage the latest updates
6281

@@ -75,54 +94,59 @@ Invoke-WebRequest -Uri 'https://go.microsoft.com/fwlink/?LinkID=121721&arch=x64'
7594
Start-Process -FilePath $vdmpackage -WorkingDirectory $vdmpath -ArgumentList "/x"
7695
```
7796

78-
You can set a scheduled task to run once a day so that whenever the package is downloaded and unpacked then the VMs will receive the new update.
79-
We suggest starting with once a day, but you should experiment with increasing or decreasing the frequency to understand the impact.
97+
You can set a scheduled task to run once a day so that whenever the package is downloaded and unpacked then the VMs receive the new update. We suggest starting with once a day, but you should experiment with increasing or decreasing the frequency to understand the impact.
8098

8199
Security intelligence packages are typically published once every three to four hours. Setting a frequency shorter than four hours isn't advisable because it will increase the network overhead on your management machine for no benefit.
82100

83101
You can also set up your single server or machine to fetch the updates on behalf of the VMs at an interval and place them in the file share for consumption.
84-
This configuration is possible when the devices have the share and read access (NTFS permissions) to the share so they can grab the updates. To set this configuration up, follow these steps:
102+
This configuration is possible when the devices have the share and read access (NTFS permissions) to the share so they can grab the updates. To set up this configuration, follow these steps:
85103

86104
1. Create an SMB/CIFS file share.
87105

88-
2. Use the following example to create a file share with the following share permissions.
106+
2. Use the following example to create a file share with the following share permissions.
89107

90-
```PowerShell
91-
PS c:\> Get-SmbShareAccess -Name mdatp$
108+
```PowerShell
109+
110+
PS c:\> Get-SmbShareAccess -Name mdatp$
92111
93-
Name ScopeName AccountName AccessControlType AccessRight
94-
---- --------- ----------- ----------------- -----------
95-
mdatp$ * Everyone Allow Read
96-
```
112+
Name ScopeName AccountName AccessControlType AccessRight
113+
---- --------- ----------- ----------------- -----------
114+
mdatp$ * Everyone Allow Read
115+
116+
```
97117

98-
> [!NOTE]
99-
> An NTFS permission is added for **Authenticated Users:Read:**.
118+
> [!NOTE]
119+
> An NTFS permission is added for **Authenticated Users:Read:**.
100120
101-
For this example, the file share is:
121+
For this example, the file share is `\\WindowsFileServer.fqdn\mdatp$\wdav-update`.
122+
123+
### Set a scheduled task to run the PowerShell script
102124

103-
`\\fileserver.fqdn\mdatp$\wdav-update`
125+
1. On the management machine, open the Start menu and type `Task Scheduler`. From the results, Task Scheduler and then select **Create task...** on the side panel.
104126

105-
### Set a scheduled task to run the PowerShell script
127+
2. Specify the name as `Security intelligence unpacker`.
128+
129+
3. On the **Trigger** tab, select **New...** > **Daily**, and select **OK**.
106130

107-
1. On the management machine, open the Start menu and type **Task Scheduler**. Open it and select **Create task...** on the side panel.
131+
4. On the **Actions** tab, select **New...**.
108132

109-
2. Enter the name as **Security intelligence unpacker**. Go to the **Trigger** tab. Select **New...** \> **Daily**, and select **OK**.
133+
5. Specify `PowerShell` in the **Program/Script** field.
110134

111-
3. Go to the **Actions** tab. Select **New...** Enter **PowerShell** in the **Program/Script** field. Enter `-ExecutionPolicy Bypass c:\wdav-update\vdmdlunpack.ps1` in the **Add arguments** field. Select **OK**.
135+
6. In the **Add arguments** field, type `-ExecutionPolicy Bypass c:\wdav-update\vdmdlunpack.ps1`, and then select **OK**.
112136

113-
4. Configure any other settings as appropriate.
137+
7. Configure any other settings as appropriate.
114138

115-
5. Select **OK** to save the scheduled task.
139+
8. Select **OK** to save the scheduled task.
116140

117-
You can initiate the update manually by right-clicking on the task and then selecting **Run**.
141+
To initiate the update manually, right-click on the task, and then select **Run**.
118142

119143
### Download and unpackage manually
120144

121145
If you would prefer to do everything manually, here's what to do to replicate the script's behavior:
122146

123-
1. Create a new folder on the system root called `wdav_update` to store intelligence updates, for example, create the folder `c:\wdav_update`.
147+
1. Create a new folder on the system root called `wdav_update` to store intelligence updates. For example, create the folder `c:\wdav_update`.
124148

125-
2. Create a subfolder under *wdav_update* with a GUID name, such as `{00000000-0000-0000-0000-000000000000}`
149+
2. Create a subfolder under `wdav_update` with a GUID name, such as `{00000000-0000-0000-0000-000000000000}`
126150

127151
Here's an example: `c:\wdav_update\{00000000-0000-0000-0000-000000000000}`
128152

@@ -131,7 +155,7 @@ If you would prefer to do everything manually, here's what to do to replicate th
131155
132156
3. Download a security intelligence package from [https://www.microsoft.com/wdsi/definitions](https://www.microsoft.com/wdsi/definitions) into the GUID folder. The file should be named `mpam-fe.exe`.
133157

134-
4. Open a cmd prompt window and navigate to the GUID folder you created. Use the **/X** extraction command to extract the files, for example `mpam-fe.exe /X`.
158+
4. Open a Command Prompt window and navigate to the GUID folder you created. Use the `/X` extraction command to extract the files. For example `mpam-fe.exe /X`.
135159

136160
> [!NOTE]
137161
> The VMs will pick up the updated package whenever a new GUID folder is created with an extracted update package or whenever an existing folder is updated with a new extracted package.

‎defender-endpoint/manage-protection-updates-microsoft-defender-antivirus.md‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ ms.collection:
1414
- m365-security
1515
- tier2
1616
search.appverid: met150
17-
ms.date: 09/09/2024
17+
ms.date: 09/27/2024
1818
---
1919

2020
# Manage the sources for Microsoft Defender Antivirus protection updates
@@ -63,15 +63,14 @@ There are five locations where you can specify where an endpoint should obtain u
6363
- [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft anti-malware](manage-protection-update-schedule-microsoft-defender-antivirus.md) (See note 2 below)
6464

6565
> [!NOTE]
66-
> 1. Intune Internal Definition Update Server. If you use SCCM/SUP to get definition updates for Microsoft Defender Antivirus, and you must access Windows Update on blocked client devices, you can transition to co-management and offload the endpoint protection workload to Intune. In the antimalware policy configured in Intune there is an "internal definition update server" option that you can set to use on-premises WSUS as the update source. This configuration helps you control which updates from the official WU server are approved for the enterprise, and also helps proxy and save network traffic to the official Windows Updates network.
66+
> - Intune Internal Definition Update Server. If you use SCCM/SUP to get definition updates for Microsoft Defender Antivirus, and you must access Windows Update on blocked client devices, you can transition to co-management and offload the endpoint protection workload to Intune. In the antimalware policy configured in Intune there is an "internal definition update server" option that you can set to use on-premises WSUS as the update source. This configuration helps you control which updates from the official WU server are approved for the enterprise, and also helps proxy and save network traffic to the official Windows Updates network.
6767
>
68-
> 2. Your policy and registry might have this listed as Microsoft Malware Protection Center (MMPC) security intelligence, its former name.
68+
> - Your policy and registry might have this listed as Microsoft Malware Protection Center (MMPC) security intelligence, its former name.
6969
7070
To ensure the best level of protection, Microsoft Update allows for rapid releases, which means smaller downloads on a frequent basis. The Windows Server Update Service, Microsoft Endpoint Configuration Manager, Microsoft security intelligence updates, and platform updates sources deliver less frequent updates. Thus, the delta might be larger, resulting in larger downloads.
7171

7272
Platform updates and engine updates are released on a monthly cadence. Security intelligence updates are delivered multiple times a day, but this delta package doesn't contain an engine update. See [Microsoft Defender Antivirus security intelligence and product updates](microsoft-defender-antivirus-updates.md).
7373

74-
7574
> [!IMPORTANT]
7675
> If you have set [Microsoft Security intelligence page](https://www.microsoft.com/security/portal/definitions/adl.aspx) updates as a fallback source after Windows Server Update Service or Microsoft Update, updates are only downloaded from security intelligence updates and platform updates when the current update is considered out-of-date. (By default, this is seven consecutive days of not being able to apply updates from the Windows Server Update Service or Microsoft Update services).
7776
> You can, however, [set the number of days before protection is reported as out-of-date](manage-outdated-endpoints-microsoft-defender-antivirus.md).<p>
@@ -100,27 +99,30 @@ The procedures in this article first describe how to set the order, and then how
10099

101100
1. In the **Group Policy Management Editor**, go to **Computer configuration**.
102101

103-
1. Select **Policies** then **Administrative templates**.
102+
2. Select **Policies** then **Administrative templates**.
103+
104+
3. Expand the tree to **Windows components** > **Windows Defender** > **Signature updates**.
104105

105-
1. Expand the tree to **Windows components** > **Windows Defender** > **Signature updates** and then configure the following settings:
106+
> [!NOTE]
107+
> - For Windows 10, versions 1703 up to and including 1809, the policy path is **Windows Components > Microsoft Defender Antivirus > Signature Updates**
108+
> - For Windows 10, version 1903, the policy path is **Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates**
106109
107-
1. Edit the **Define the order of sources for downloading security intelligence updates** setting. Set the option to **Enabled**.
110+
4. Edit the **Define the order of sources for downloading security intelligence updates** setting. Set the option to **Enabled**.
108111

109-
2. Specify the order of sources, separated by a single pipe, for example: `InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC`, as shown in the following screenshot.
112+
5. Specify the order of sources, separated by a single pipe, for example: `InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC`, as shown in the following screenshot.
110113

111-
:::image type="content" source="/defender/media/wdav-order-update-sources.png" alt-text="Group policy setting listing the order of sources" lightbox="/defender/media/wdav-order-update-sources.png":::
114+
:::image type="content" source="/defender/media/wdav-order-update-sources.png" alt-text="Group policy setting listing the order of sources" lightbox="/defender/media/wdav-order-update-sources.png":::
112115

113-
1. Select **OK**. This action sets the order of protection update sources.
114-
115-
1. Edit the **Define file shares for downloading security intelligence updates** setting and then set the option to **Enabled**.
116-
117-
1. Specify the file share source. If you have multiple sources, specify each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc) for denoting the path, for example: `\\host-name1\share-name\object-name|\\host-name2\share-name\object-name`. If you don't enter any paths, then this source is skipped when the VM downloads updates.
116+
6. Select **OK**. This action sets the order of protection update sources.
117+
118+
7. Edit the **Define file shares for downloading security intelligence updates** setting and then set the option to **Enabled**.
119+
120+
8. On a Windows Server, specify the file share source. If you have multiple sources, specify each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc) for denoting the path. For example: `\\host-name1\share-name\object-name|\\host-name2\share-name\object-name`.
121+
122+
If you don't enter any paths, then this source is skipped when the VM downloads updates.
118123

119-
6. Select **OK**. This action sets the order of file shares when that source is referenced in the **Define the order of sources...** group policy setting.
124+
9. Select **OK**. This action sets the order of file shares when that source is referenced in the **Define the order of sources...** group policy setting.
120125

121-
> [!NOTE]
122-
> For Windows 10, versions 1703 up to and including 1809, the policy path is **Windows Components > Microsoft Defender Antivirus > Signature Updates**
123-
> For Windows 10, version 1903, the policy path is **Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates**
124126

125127
## Use Configuration Manager to manage the update location
126128

@@ -172,18 +174,18 @@ For example, suppose that Contoso has hired Fabrikam to manage their security so
172174

173175
## Create a UNC share for security intelligence and platform updates
174176

175-
Set up a network file share (UNC/mapped drive) to download security intelligence and platform updates from the MMPC site by using a scheduled task.
177+
On a Windows Server set up a network file share (UNC/mapped drive) to download security intelligence and platform updates from the MMPC site by using a scheduled task.
176178

177179
1. On the system for which you want to provision the share and download the updates, create a folder for the script.
178180

179-
```console
181+
```cmd
180182
Start, CMD (Run as admin)
181183
MD C:\Tool\PS-Scripts\
182184
```
183185
184186
2. Create a folder for signature updates.
185187
186-
```console
188+
```cmd
187189
MD C:\Temp\TempSigs\x64
188190
MD C:\Temp\TempSigs\x86
189191
```
@@ -253,7 +255,7 @@ Set up a network file share (UNC/mapped drive) to download security intelligence
253255
254256
If the scheduled task fails, run the following commands:
255257
256-
```console
258+
```powershell
257259
C:\windows\system32\windowspowershell\v1.0\powershell.exe -NoProfile -executionpolicy allsigned -command "&\"C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1\" -action run -arch x64 -isDelta $False -destDir C:\Temp\TempSigs\x64"
258260
259261
C:\windows\system32\windowspowershell\v1.0\powershell.exe -NoProfile -executionpolicy allsigned -command "&\"C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1\" -action run -arch x64 -isDelta $True -destDir C:\Temp\TempSigs\x64"
@@ -271,9 +273,7 @@ Set up a network file share (UNC/mapped drive) to download security intelligence
271273
11. Set the share location in the policy to the share.
272274
273275
> [!NOTE]
274-
> Do not add the x64 (or x86) folder in the path. The mpcmdrun.exe process adds it automatically.
275-
276-
276+
> Do not add the x64 (or x86) folder in the path. The `mpcmdrun.exe` process adds it automatically.
277277
278278
## Related articles
279279

0 commit comments

Comments
 (0)