You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/mde-plugin-wsl.md
+66-62Lines changed: 66 additions & 62 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -83,20 +83,20 @@ If your Windows Subsystem for Linux isn't installed yet, follow these steps:
83
83
84
84
3. Confirm that WSL is installed and running.
85
85
86
-
1. Using Terminal or Command Prompt, run `wsl –-update` to make sure you have the latest version.
86
+
1. Using Terminal or Command Prompt, run `wsl –-update` to make sure you have the latest version.
87
87
88
-
2. Run the `wsl` command to ensure WSL is running before testing.
88
+
2. Run the `wsl` command to ensure WSL is running before testing.
89
89
90
90
4. Install the plug-in by following these steps:
91
91
92
-
1. Install the MSI file downloaded from the onboarding section in the Microsoft Defender portal (**Settings** > **Endpoints** > **Onboarding** > **Windows Subsystem for Linux 2 (plug-in)**).
92
+
1. Install the MSI file downloaded from the onboarding section in the Microsoft Defender portal (**Settings** > **Endpoints** > **Onboarding** > **Windows Subsystem for Linux 2 (plug-in)**).
93
93
94
-
2. Open a command prompt/terminal and run `wsl`.
94
+
2. Open a command prompt/terminal and run `wsl`.
95
95
96
96
You can [deploy the package using Microsoft Intune](/mem/intune/apps/lob-apps-windows).
97
97
98
98
> [!NOTE]
99
-
> If `WslService` is running, it stops during the installation process. You do not need to onboard the subsystem separately; instead, the plug-in automatically onboards to the tenant the Windows host is onboarded to.
99
+
> If `WslService` is running, it stops during the installation process. You do not need to onboard the subsystem separately. Instead, the plug-in automatically onboards to the tenant the Windows host is onboarded to.
100
100
101
101
## Installation validation checklist
102
102
@@ -161,7 +161,7 @@ After installing the plug-in, the subsystem and all its running containers are o
You can see all WSL instances in your environment with an active Defender for Endpoint plug-in for WSL. These instances represent all distributions running inside WSL on a given host. The hostname of a *device* matches that of the Windows host. However, it's represented as a Linux device.
167
167
@@ -175,7 +175,7 @@ The timeline is populated, similar to Defender for Endpoint on Linux, with event
175
175
176
176
The plug-in onboards the WSL machine with the tag `WSL2`. Should you or your organization need a custom tag, please follow the steps outlined below:
177
177
178
-
1. Open Registry Editor as an administrator
178
+
1. Open Registry Editor as an administrator.
179
179
180
180
2. Create a registry key with the following details:
181
181
@@ -186,9 +186,9 @@ The plug-in onboards the WSL machine with the tag `WSL2`. Should you or your org
186
186
187
187
3. Once the registry is set, restart wsl using the following steps:
188
188
189
-
1. Open Command Prompt and run the command, `wsl --shutdown`.
189
+
1. Open Command Prompt and run the command, `wsl --shutdown`.
190
190
191
-
2. Run the `wsl` command.
191
+
2. Run the `wsl` command.
192
192
193
193
4. Wait for 5-10 minutes for the portal to reflect the changes.
194
194
@@ -255,87 +255,91 @@ DeviceProcessEvents
255
255
256
256
## Troubleshooting
257
257
258
-
1. The command `healthcheck.exe` shows the output, "Launch WSL distro with 'bash' command and retry in five minutes."
258
+
###The command `healthcheck.exe` shows the output, "Launch WSL distro with 'bash' command and retry in five minutes."
1.If the previously mentioned error occurs, take the following steps:
262
+
1.Open a terminal instance and run the command `wsl`.
263
263
264
-
1. Open a terminal instance and run the command `wsl`.
265
-
266
-
1. Wait for at least five minutes before rerunning the health check.
267
-
268
-
1. The `healthcheck.exe` command might show the output, "Waiting for Telemetry. Please retry in five minutes."
264
+
2. Wait for at least five minutes before rerunning the health check.
269
265
270
-
:::image type="content" source="media/mdeplugin-wsl/wsl-health-check-telemetry.png" alt-text="Screenshot showing health telemetry status." lightbox="media/mdeplugin-wsl/wsl-health-check-telemetry.png":::
271
-
272
-
If that error occurs, wait for five minutes and rerun `healthcheck.exe`.
266
+
### The `healthcheck.exe` command might show the output, "Waiting for Telemetry. Please retry in five minutes."
267
+
268
+
:::image type="content" source="media/mdeplugin-wsl/wsl-health-check-telemetry.png" alt-text="Screenshot showing health telemetry status." lightbox="media/mdeplugin-wsl/wsl-health-check-telemetry.png":::
273
269
274
-
1. If you don't see any devices in the Microsoft Defender portal, or you don't see any events in the timeline, check the following things:
270
+
If that error occurs, wait for five minutes and rerun `healthcheck.exe`.
271
+
272
+
### You don't see any devices in the Microsoft Defender portal, or you don't see any events in the timeline
273
+
274
+
Check the following things:
275
275
276
-
- If you aren't seeing a machine object, make sure sufficient time has passed for onboarding to complete (typically up to 10 minutes).
276
+
- If you aren't seeing a machine object, make sure sufficient time has passed for onboarding to complete (typically up to 10 minutes).
277
277
278
-
- Make sure to use the right filters, and that you have the appropriate permissions assigned to view all device objects. (For example, is your account/group is restricted to a specific group?)
278
+
- Make sure to use the right filters, and that you have the appropriate permissions assigned to view all device objects. (For example, is your account/group is restricted to a specific group?)
279
279
280
-
- Use the health check tool to provide an overview of overall plug-in health. Open Terminal, and run the `healthcheck.exe` tool from `%ProgramFiles%\Microsoft Defender for Endpoint plug-in for WSL\tools`.
280
+
- Use the health check tool to provide an overview of overall plug-in health. Open Terminal, and run the `healthcheck.exe` tool from `%ProgramFiles%\Microsoft Defender for Endpoint plug-in for WSL\tools`.
281
281
282
-
:::image type="content" source="media/mdeplugin-wsl/wsl-health-check-support.png" alt-text="Screenshot showing status in PowerShell." lightbox="media/mdeplugin-wsl/wsl-health-check-support.png":::
282
+
:::image type="content" source="media/mdeplugin-wsl/wsl-health-check-support.png" alt-text="Screenshot showing status in PowerShell." lightbox="media/mdeplugin-wsl/wsl-health-check-support.png":::
283
283
284
-
- Enable the connectivity test and check for Defender for Endpoint connectivity in WSL. If the connectivity test fails, provide the output of the health check tool to our support team.
284
+
- Enable the connectivity test and check for Defender for Endpoint connectivity in WSL. If the connectivity test fails, provide the output of the health check tool to our support team.
285
285
286
-
- If the connectivity test reports "invalid" in health check:
287
-
288
-
- If your machine has a proxy setup, run the command `healthCheck --extendedProxy`. This will provide information on which proxy(s) is set on your machine and whether these configurations are invalid for WSL defender.
### Connectivity test reports "invalid" in health check
287
+
288
+
- If your machine has a proxy setup, run the command `healthCheck --extendedProxy`. This will provide information on which proxy(s) is set on your machine and whether these configurations are invalid for WSL defender.
- If the steps mentioned above do not fix the problem, include the following configuration settings in the `.wslconfig` located in your `%UserProfile%` and restart WSL. Details about settings can be found in [WSL Settings](/windows/wsl/wsl-config#main-wsl-settings).
292
+
- If the steps mentioned above do not fix the problem, include the following configuration settings in the `.wslconfig` located in your `%UserProfile%` and restart WSL. Details about settings can be found in [WSL Settings](/windows/wsl/wsl-config#main-wsl-settings).
294
293
294
+
**In Windows 11**
295
295
296
-
```
297
-
- In Windows 11
296
+
```
298
297
299
-
```bash
300
-
# Settings apply across all Linux distros running on WSL 2
301
-
[wsl2]
298
+
# Settings apply across all Linux distros running on WSL 2
299
+
[wsl2]
302
300
303
-
dnsTunneling=true
301
+
dnsTunneling=true
304
302
305
-
networkingMode=mirrored
306
-
```
303
+
networkingMode=mirrored
304
+
```
307
305
308
-
- In Windows 10
306
+
**In Windows 10**
309
307
310
-
```bash
311
-
# Settings apply across all Linux distros running on WSL 2
312
-
[wsl2]
308
+
```bash
309
+
# Settings apply across all Linux distros running on WSL 2
310
+
[wsl2]
311
+
312
+
dnsProxy=false
313
+
314
+
```
313
315
314
-
dnsProxy=false
315
-
```
316
-
``` - If the connectivity issues persist, run the following steps to collect the networking logs
316
+
### Connectivity issues persist
317
317
318
-
1. Open an elevated(admin) PowerShell prompt
319
-
320
-
2. Download and Run: `.\collect-networking-logs.ps1`
318
+
Collect the networking logs by following these steps:
0 commit comments