Live response in Defender for Endpoint: collecting evidence and running scripts safely

Live response opens a remote shell from the Microsoft Defender portal to a device onboarded to Defender for Endpoint, so you can inspect processes, pull files and run approved scripts without touching the machine. That makes it one of the most powerful permissions in your tenant. In this post I'll switch it on with guardrails, split the roles, build a trusted script library, collect evidence in a sensible order and show where every command is recorded.

Prerequisites#

• Licence: Defender for Endpoint Plan 2 (also part of Microsoft 365 E5 and E5 Security). Live response isn't a Plan 1 feature.
• Supported devices: Windows 11, Windows 10 1909 or later (older builds need specific updates), Windows Server 2019 (with the required update) and later, Windows Server 2016 and 2012 R2 with the unified agent, and macOS or Linux agents from 101.43.84 and 101.45.13 respectively.
• A healthy device: onboarded and reporting. If it shows as inactive, fix that first (see Device shows "Inactive" or "No sensor data").
• Rights to change settings: enabling live response needs Manage portal system settings (System settings in unified RBAC).

Step-by-step#

1. Turn live response on, but keep unsigned scripts off#

Open Settings › Endpoints › Advanced features, set the three toggles and select Save preferences:

Signature checking covers PowerShell only, so for macOS and Linux Bash scripts the review in step 3 is your control.

2. Split the permissions#

With unified RBAC, create custom roles under System › Permissions › Microsoft Defender XDR › Roles and scope each assignment to the device groups the team supports. The permissions sit in the Security operations group:

In legacy Defender for Endpoint roles (Settings › Endpoints › Roles) the same split is the Live response capabilities option, Basic or Advanced. The in-session Upload file to library button also needs Manage security settings (Core security settings in unified RBAC), but uploads from the Library management page don't, so decide explicitly who maintains the library.

3. Build a reviewed, signed script library#

The library is tenant-wide: any responder can run its scripts on any device in their scope. Keep scripts in source control, require a second reviewer and keep collection scripts read-only. A small triage script:

param([string]$OutDir = (Join-Path $env:TEMP 'LRTriage'))
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null
Get-Process | Select-Object Name, Id, Path, StartTime |
    Export-Csv (Join-Path $OutDir 'processes.csv') -NoTypeInformation
Get-NetTCPConnection -State Established |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess |
    Export-Csv (Join-Path $OutDir 'connections.csv') -NoTypeInformation
$zip = "$OutDir.zip"
Compress-Archive -Path (Join-Path $OutDir '*') -DestinationPath $zip -Force
Get-FileHash -Path $zip -Algorithm SHA256 | Format-List Path, Hash

Sign it with a code-signing certificate your devices trust (for example from your internal PKI) and check it:

$cert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
Set-AuthenticodeSignature -FilePath .\Collect-Triage.ps1 -Certificate $cert -HashAlgorithm SHA256
(Get-AuthenticodeSignature -FilePath .\Collect-Triage.ps1).Status

Good looks like Valid. Upload it with Upload file to library in a session or from the Library management page, add a description, choose whether to overwrite a file with the same name and, if the script takes parameters, tick the script parameters box and enter an example. File names may only use letters, numbers, hyphens, underscores and dots; library files are limited to 250 MB.

4. Collect evidence, least invasive first#

Go to Endpoints › Device inventory, open the device and select Initiate live response session. A typical sequence:

processes
connections
persistence
scheduledtasks
findfile updater.exe
fileinfo "C:\Users\Public\updater.exe"
getfile "C:\Users\Public\updater.exe" &
jobs
library
run Collect-Triage.ps1 -parameters "-OutDir C:\ProgramData\IR-1234"
getfile "C:\ProgramData\IR-1234.zip"

• Start with read-only views; add -output json when the table hides fields, or processes > processes.txt to write output to a file.
• Ending getfile with & downloads in the background. jobs lists background work, Ctrl+Z moves a running download there and fg with the command ID brings it back.
• Run collection scripts with run, then getfile their output and copy the printed SHA-256 hash into the incident.
• Act only once evidence is safe: remediate file "<path>" -auto deletes a file and runs the prerequisite command for you; on Windows, undo reverses a remediation.

Know the limits: most commands time out after 10 minutes (getfile, findfile and run after 30), idle sessions close after 30 minutes, getfile handles up to 3 GB, a device allows one session at a time, a user up to five, and at most 50 sessions run at once.

5. Close and audit the session#

The session dashboard shows who started the session, when and for how long, and the Command log tab records each command with its ID, command line, duration, status and input or output. Before you select Disconnect session, note in the incident what changed, which files you collected and their hashes. Sessions started from the device page aren't available through the MachineActions API, so API exports won't rebuild them later.

Verify#

• Settings: Advanced features shows Live Response and Live Response for Servers on, and unsigned script execution off.
• Roles: a triage analyst can connect and run processes but not run or putfile; a responder's library lists your script with its description.
• Signing: the signed script runs; an unsigned test copy is blocked.
• Evidence: downloads sit in a restricted location and the incident lists their hashes; hash direct downloads yourself:

Get-FileHash -Path .\IR-1234.zip -Algorithm SHA256

• Audit: every command in the Command log has a final status and no background job is still running.

Tips and gotchas#

• Command sets differ by platform. registry, services, scheduledtasks, persistence, startupfolders, connections, drivers, analyze and undo are Windows-only; collect and scan are macOS and Linux only, isolate and release macOS only. On Windows, use the device page actions instead.
• Ctrl+C only stops the portal. The command carries on at the device, so a cancelled remediate may still complete.
• putfile is temporary. Files land in a working folder and are deleted at restart by default; the limit is 300 MB on Windows, 10 MB elsewhere.
• Slow links. A getfile under 3 GB can still time out on a poor connection; compress or split large files first.
• Proxies on older servers. With a static proxy, live response doesn't work as expected on offline down-level servers onboarded with the streamlined method; Microsoft suggests a system proxy. See Moving Defender for Endpoint to streamlined connectivity.
• Clean up. Collection scripts leave files behind; keep a reviewed clean-up script in the library.
• Don't enable unsigned scripts "just this once". If an emergency forces it, record it in the incident and switch it off afterwards.

References#

• Investigate entities on devices using live response
• Permissions in Microsoft Defender unified role-based access control (RBAC)
• Map existing RBAC permissions to Microsoft Defender unified RBAC permissions