Skip to content

Commit ef1879e

Browse files
denisebmsftdenisebmsft
authored
Merge pull request #1432 from MicrosoftDocs/fixes
MDE on Mac troubleshooting NetExt
2 parents ea0cdbc + 5e621a1 commit ef1879e

File tree

3 files changed

+220
-3
lines changed

3 files changed

+220
-3
lines changed

‎defender-endpoint/TOC.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -422,13 +422,15 @@
422422

423423
- name: Troubleshoot Microsoft Defender for Endpoint on macOS
424424
items:
425+
- name: Troubleshoot NetExt issues with Defender for Endpoint on Mac
426+
href: mac-troubleshoot-netext-mde.md
425427
- name: Troubleshooting mode on macOS
426428
href: mac-troubleshoot-mode.md
427429
- name: Troubleshoot macOS installation issues
428430
href: mac-support-install.md
429431
- name: Troubleshoot macOS performance issues overview
430432
href: mac-support-perf-overview.md
431-
displayName: Troubleshoot performance issues for Microsoft Defender for Endpoint on macOS
433+
displayName: Troubleshoot performance issues for Defender for Endpoint on macOS
432434
- name: Troubleshoot performance issues
433435
href: mac-support-perf.md
434436
- name: Troubleshoot cloud connectivity

‎defender-endpoint/mac-troubleshoot-netext-mde.md‎

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
---
2+
title: Troubleshoot Network Extension issues in Microsoft Defender for Endpoint on Mac
3+
description: Learn how to troubleshoot issues with the network extension (NetExt) that's installed as part of Microsoft Defender for Endpoint on macOS.
4+
ms.service: defender-endpoint
5+
author: denisebmsft
6+
ms.author: deniseb
7+
manager: deniseb
8+
ms.reviewer: yongrhee
9+
ms.localizationpriority: medium
10+
audience: ITPro
11+
ms.collection:
12+
- m365-security
13+
- tier3
14+
- mde-macos
15+
ms.topic: conceptual
16+
ms.subservice: macos
17+
search.appverid: met150
18+
ms.date: 09/20/2024
19+
---
20+
21+
# Troubleshoot Network Extension (NetExt) issues in Defender for Endpoint on Mac
22+
23+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
24+
25+
**Applies to:**
26+
27+
- [Microsoft Defender for Endpoint on macOS](microsoft-defender-endpoint-mac.md)
28+
- [Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
29+
- [Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
30+
- [Microsoft Defender XDR](/defender-xdr)
31+
32+
> [!NOTE]
33+
> You can submit feedback by opening Microsoft Defender for Endpoint on Mac on your device, and going to **Help** > **Send feedback**. Another option is to submit feedback via the Microsoft Defender portal. Go to [security.microsoft.com](https://security.microsoft.com), and selecting the **Give feedback** tab.
34+
35+
## Overview
36+
37+
This article provides information on how to troubleshoot issues with the network extension (NetExt) that's installed as part of Microsoft Defender for Endpoint on macOS.
38+
39+
NetExt is used by [Network Protection](network-protection-macos.md) is enabled on Mac devices.
40+
41+
**Symptom**:
42+
43+
You might notice issues with network related latencies when using your browser or copying files over the network or using a chat/meeting application.
44+
45+
**Temporary solution**:
46+
47+
This article describes how to temporarily disable NetExt which will temporarily disable network protection, and resolve network stack-related issues by using Intune, JamF, or a manual process on Mac.
48+
49+
At a high level, these are the steps to follow for [Intune](#intune-method) and [JamF](#jamf-method):
50+
51+
1. Create a new "Devices with NetExt disabled" group.
52+
2. Exclude that group from the existing NetExt configuration.
53+
3. Assign the existing configuration to the "Devices with NetExt disabled" device group.
54+
55+
The following sections describe these steps in more detail.
56+
57+
## Intune method
58+
59+
The following sections describe how to set up a new "Devices with NetExt disabled" device group, exclude it from the NetExt configuration, and then assign the existing configuration to your new device group.
60+
61+
### Create a device group called "Devices with NetExt disabled"
62+
63+
1. In the [Intune admin center](https://intune.microsoft.com), select **Groups**, and then select **New group**.
64+
65+
2. Set up the device group as follows:
66+
67+
- Group type: `Security`
68+
- Group name: `Devices with NetExt disabled`
69+
- Group description: Add a description.
70+
- Membership type: `Assigned`
71+
72+
Then select **Refresh**.
73+
74+
3. Double-click on your new group `Devices with NetExt disabled`.
75+
76+
4. Select **Members**, and then select **Add members**.
77+
78+
5. On the **Devices** tab, select the devices for which you want to disable NetExt. Then click **Select**.
79+
80+
6. Select **Refresh**. You should now be able to see your devices.
81+
82+
### Exclude the "Devices with NetExt disabled" device group from the existing NetExt configuration
83+
84+
1. In the [Intune admin center](https://intune.microsoft.com), select **Devices**.
85+
86+
2. Under **By platform**, select **macOS**, and then select **Configuration**.
87+
88+
3. Select your current policy for NetExt. For example, `NetFilter-prod-macOS-Default-MDE`.
89+
90+
4. Next to **Assignments**, select **Edit**.
91+
92+
5. Under **Excluded groups**, select **Add groups**, and then select the "Devices with NetExt disabled" device group. Then click **Select**.
93+
94+
6. Select **Review + save**, and then select **Save**.
95+
96+
### Assign the existing configuration to the "Devices with NetExt disabled" device group
97+
98+
1. In the [Intune admin center](https://intune.microsoft.com), select **Devices**.
99+
100+
2. Under **By platform**, select **macOS**, and then select **Configuration**.
101+
102+
3. Select a current policy, such as your policy for Accessibility. For example, `Accessibility-prod-macOS-Default-MDE`.
103+
104+
4. Next to **Assignments**, select **Edit**.
105+
106+
5. Under **Add groups**, select the device group that you created earlier (for example, `Devices with NetExt disabled`). Then click **Select**.
107+
108+
6. Select **Review + save**, and then select **Save**.
109+
110+
7. Repeat this procedure for each of your existing policies for Defender for Endpoint on Mac. Examples include:
111+
112+
- Auto-Update
113+
- Background Services
114+
- Behavior Monitoring
115+
- Device Control
116+
- Full Disk Access
117+
- Network Protection
118+
- Notifications
119+
- Scheduled Scan
120+
- Settings Preferences
121+
- System Extensions
122+
123+
> [!CAUTION]
124+
> Do not repeat this procedure for NetExt.
125+
126+
After you complete these steps, see if you're able to reproduce the issue.
127+
128+
## JamF method
129+
130+
The following sections describe how to create a new "Devices with NetExt disabled" group, exclude the group from the existing NetExt configuration, and then assign the existing configuration to the new group.
131+
132+
### Create a "Devices with NetExt disabled" group
133+
134+
1. In your JamF portal, select **Computers**, and then select **Static device groups**.
135+
136+
2. Select **New**.
137+
138+
3. On the **Computer Group** tab (default), under **Display name**, add the group name `Devices with NetExt disabled`.
139+
140+
4. Select the **Assignments** tab.
141+
142+
5. Select the devices select the devices for which you want to disable NetExt. Then select **Save**.
143+
144+
Under **Computers - Static Computer Groups**, you should be able to see your new group.
145+
146+
### Exclude your "Devices with NetExt disabled" group from the existing NetExt configuration
147+
148+
1. In your JamF portal, select **Computers**, and then select **Configuration Profiles**.
149+
150+
2. Select your current policy for NetExt. For example, `NetFilter-prod-macOS-Default-MDE`.
151+
152+
3. On the **Scope** tab, select **Edit**.
153+
154+
4. On the **Exclusions** tab, select **Add**, and then select **Computer Groups**.
155+
156+
5. Find your "Devices with NetExt disabled" group, and then select **Add**.
157+
158+
6. Select **Done**, and then select **Save**.
159+
160+
### Assign the existing configuration to the "Devices with NetExt disabled" group
161+
162+
1. In your JamF portal, select **Computers**, and then select **Configuration Profiles**.
163+
164+
2. Select a current policy, such as one for Accessibility. For example, `Accessibility-prod-macOS-Default-MDE`.
165+
166+
3. On the **Scope** tab, select **Edit**.
167+
168+
4. On the **Targets** tab, select **Add**, and then select **Computer Groups**.
169+
170+
5. Find your "Devices with NetExt disabled" group, and then select **Add**.
171+
172+
6. Select **Done**, and then select **Save**.
173+
174+
7. Repeat this procedure for each of your existing policies for Defender for Endpoint on Mac. Examples include:
175+
176+
- Auto-Update
177+
- Background Services
178+
- Behavior Monitoring
179+
- Device Control
180+
- Full Disk Access
181+
- Network Protection
182+
- Notifications
183+
- Scheduled Scan
184+
- Settings Preferences
185+
- System Extensions
186+
187+
> [!CAUTION]
188+
> Do not repeat this procedure for NetExt.
189+
190+
After you complete these steps, see if you're able to reproduce the issue.
191+
192+
## Manual method
193+
194+
If you have Defender for Endpoint installed on your Mac, you can remove the NetExt extension temporarily by following these steps:
195+
196+
1. On your Mac, open **System Settings**.
197+
198+
2. Go to **General** > **Login items & Extensions**, and then scroll down until you see **Network Extensions**. There, you see the following extensions:
199+
200+
- Microsoft Defender
201+
- Microsoft Defender Network Extension
202+
203+
3. Set the toggle to turn off Microsoft Defender Network Extension. Type your password, and then select **OK**.
204+
205+
4. You should see the following message:
206+
207+
`Note: Disabling the system extension will make sure that it will not be launched after reboot, but it does not guarantee that it will be terminated immediately.`
208+
209+
5. Select **OK**, and then select **Done**.
210+
211+
After you complete these steps, see if you're able to reproduce the issue.
212+
213+
## See also
214+
215+
[What's new in Microsoft Defender for Endpoint on Mac](mac-whatsnew.md)

‎defender-endpoint/mac-whatsnew.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,11 @@ For more information on Microsoft Defender for Endpoint on other operating syste
3737

3838
**Known issues**
3939

40-
> [!NOTE]
4140
- Apple fixed an issue on macOS [Ventura upgrade](https://developer.apple.com/documentation/macos-release-notes/macos-13_1-release-notes) and macOS [Sonoma upgrade](https://developer.apple.com/forums/thread/737824#773449022) with the latest OS update. The issue impacts Microsoft Defender for Endpoint security extensions, and might result in losing Full Disk Access Authorization, impacting its ability to function properly.
41+
4242
- In macOS Sonoma 14.3.1, Apple made a change to the [handling of Bluetooth devices](https://developer.apple.com/forums/thread/738748) that impacts Defender for Endpoint device controls ability to intercept and block access to Bluetooth devices. At this time, the recommended mitigation is to use a version of macOS earlier than 14.3.1.
4343

44-
- In macOS Sequoia (version 15.0), if you have Network Protection enabled, you might see crashes of the network extension (NetExt). This will result in intermittent network connectivity issues for end users. We are recommending that customers who have Network Protection enabled in their organization refrain from upgrading to Sequoia builds at this time.
44+
- In macOS Sequoia (version 15.0), if you have Network Protection enabled, you might see crashes of the network extension (NetExt). This will result in intermittent network connectivity issues for end users. We are recommending that customers who have Network Protection enabled in their organization refrain from upgrading to Sequoia builds at this time. To work around the issue, see [Troubleshoot NetExt issues in Microsoft Defender for Endpoint on Mac](mac-troubleshoot-netext-mde.md).
4545

4646
**Sequoia support**
4747

0 commit comments

Comments
 (0)