From Symantec Endpoint Protection to Defender for Endpoint: prepare, set up, onboard

Replacing Symantec Endpoint Protection (SEP) with Microsoft Defender for Endpoint tends to go wrong in two ways: SEP comes off before Defender is ready, leaving devices unprotected, or SEP's own safeguards (uninstall password, Tamper Protection, its firewall) block the removal or leave a gap behind. In this guide I'll apply Microsoft's three migration phases (prepare, set up, onboard) to SEP and add the Symantec-specific steps: exclusions in both directions, passive mode while both products run, a policy mapping table, a safe removal, the switch to active mode, verification and rollback.

How the migration works#

Microsoft's process starts with SEP active. You put Microsoft Defender Antivirus into passive mode, configure Defender for Endpoint, onboard and verify devices, and only then remove SEP. What Defender Antivirus does along the way depends on the platform:

• Windows 10 and Windows 11: Defender Antivirus can't be removed. With SEP installed it's in an automatic disabled state; after onboarding it moves to passive mode, and when SEP is uninstalled it switches to active mode on its own.
• Windows Server: nothing is automatic. You may have to reinstall or re-enable the Defender Antivirus feature, and you set passive mode yourself with the ForceDefenderPassiveMode registry value before onboarding. Windows Server 2012 R2 and 2016 support passive mode only with the modern unified solution.

In passive mode Defender scans, updates and feeds EDR, but it doesn't block: SEP stays your antivirus until you remove it. With Defender for Endpoint Plan 2, EDR in block mode lets Defender remediate post-breach detections during that period. What works in each mode is in active, passive and EDR block mode.

Phase 1: prepare#

1. Inventory SEP. In Symantec Endpoint Protection Manager (SEPM), list client groups, client versions and platforms (Windows, Mac, Linux), and the policies each group uses: Virus and Spyware Protection, Firewall, Intrusion Prevention, Application and Device Control, Exceptions and Host Integrity, plus the client password settings. You'll map them in the table below.
2. Update devices and get your Defender for Endpoint Plan 1 or Plan 2 licenses in place.
3. Plan roles and give the security team access to the Microsoft Defender portal.
4. Open connectivity from devices to the Defender for Endpoint service through proxies and firewalls (see streamlined connectivity).
5. Capture baseline performance on pilot devices, so you can tell later whether running both products costs anything.
6. Define rings: an IT pilot, a representative business pilot, then broad waves, with servers in rings of their own.

Phase 2: set up#

1. Make sure Defender Antivirus is present and not turned off#

Check that no policy still turns Defender off: the Turn off Microsoft Defender Antivirus Group Policy setting must be disabled or not configured, and DisableAntiSpyware must not be set to 1 under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender. gpresult /h gpresult.html shows which GPO wins. On servers, set passive mode first, reinstall the feature if it was removed, then restart and onboard in the same change window, so Defender never runs in active mode next to SEP:

# 1. Passive mode for the coexistence period (must be set before onboarding)
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v ForceDefenderPassiveMode /t REG_DWORD /d 1 /f
# 2. Reinstall the feature if it was removed, then restart and onboard
Install-WindowsFeature -Name Windows-Defender

To confirm, look for event 5007 in the Microsoft-Windows-Windows Defender/Operational log showing ForceDefenderPassiveMode or PassiveMode set to 0x1.

2. Exclude Defender in SEP#

In SEPM, go to Policies › Exceptions, edit the Exceptions policy the pilot group uses, select Exceptions, and use Add › Windows Exceptions › File or Folder for each path below. Apply them to security risk scans, SONAR and application control. Wildcards such as 4.18.* need SEP 14.3 RU5 or later, and Broadcom notes that Auto-Protect trusted-process exclusions are set outside the Exceptions policy. This is Microsoft's list for Windows 10 version 1803 or later, Windows 11 and Windows Server 2019 or later; Windows Server 2012 R2 and 2016 with the unified solution need extra Platform paths, so check Microsoft's page for your versions.

EDR sensor
C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe
C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseTracer.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseDlpProcessor.exe
C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection

Defender Antivirus
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Windows Defender\NisSrv.exe
C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe
C:\Program Files\Windows Defender\MpCmdRun.exe
C:\Program Files\Windows Defender\MpDefenderCoreService.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MsMpEng.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\NisSrv.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\ConfigSecurityPolicy.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpCopyAccelerator.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpCmdRun.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpDefenderCoreService.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\mpextms.exe

Endpoint DLP (if you use Purview endpoint DLP)
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpDlpService.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpDlpCmd.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MipDlp.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\DlpUserAgent.exe

Microsoft also lists the registry path HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\* for products that support registry exclusions, and asks you to add the same exclusions to any other security product on the device.

3. Exclude SEP in Defender Antivirus#

Add SEP's program and data folders, taken from a pilot device, to Defender Antivirus exclusions with an Intune Antivirus policy, Configuration Manager antimalware policies or the Group Policy settings under Windows Components › Microsoft Defender Antivirus › Exclusions. Microsoft's advice: list process exclusions by full path, not just the file name, and add executables as both path and process exclusions so that the process and what it touches are excluded.

4. Configure Defender for Endpoint before onboarding#

• Confirm that Defender for Endpoint is provisioned: open Assets › Devices in the Defender portal, and if setup hasn't finished, wait before you continue.
• Turn on tamper protection for the organization under Settings › Endpoints › General › Advanced features, as Microsoft recommends. Read the server note in the rollback section first.
• Connect Intune: in the Intune admin center, go to Endpoint security › Setup › Microsoft Defender for Endpoint and turn on Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations. For devices that aren't enrolled in Intune, set the Enforcement scope under Settings › Endpoints › Configuration management (security settings management).
• Turn on at least Microsoft's standard protection ASR rules: Block credential stealing from the Windows local security authority subsystem, Block abuse of exploited vulnerable signed drivers and Block persistence through WMI event subscription (rolling out ASR rules).
• Next-generation protection: cloud-delivered protection, automatic sample submission and potentially unwanted app protection (block or audit). In Configuration Manager antimalware policies, also enable block at first sight.
• With Plan 2, add an EDR policy and set up automated investigation and remediation.

Settings that need active mode, such as ASR rules, network protection and cloud protection, have no effect in passive mode. They start working the moment SEP is gone, so pilot them on the first ring you cut over.

5. Create device groups#

Under Settings › Endpoints › Permissions › Device groups, add a group per ring, choose the automation level (Microsoft recommends Full - remediate threats automatically), match devices by domain, OS or tag, and assign user access.

Map SEP policies to Defender#

Phase 3: onboard#

1. Onboard the pilot ring. In the Defender portal, go to Settings › Endpoints › Onboarding, pick the operating system and a deployment method: Intune, Configuration Manager, Group Policy, VDI scripts or, for up to 10 devices, the local script (proof of concept only). The Intune route is in onboarding Windows devices with Intune; failures are decoded in SENSE event IDs.
2. Run Microsoft's detection test from an elevated Command Prompt. The window closes by itself, and an alert should appear for the device in the Defender portal in about 10 minutes:
   Command Prompt

   powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference = 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-MDATP-test\\invoice.exe');Start-Process 'C:\\test-MDATP-test\\invoice.exe'

3. Confirm passive mode with Get-MpComputerStatus | Select-Object AMRunningMode: it should report passive mode, or EDR Block Mode if you turned that on.
4. Keep Defender updated. Security intelligence and product updates matter in passive mode too.

What good looks like: the device is in the inventory with an active sensor, the test alert arrived, Defender is passive with current security intelligence, and performance is close to the Phase 1 baseline. If it isn't, profile before you add exclusions (performance analyzer).

Remove SEP safely#

1. Prepare Windows Firewall#

SEP's firewall policy takes over Windows Firewall (the default Windows Integration setting is Disable Once Only), and Broadcom says uninstalling SEP restores Windows Firewall to the state it was in before SEP was installed. That state may be off. Assign an Intune firewall policy that turns Windows Firewall on for all three profiles, with the rules you mapped, to the ring before you remove SEP.

2. Unlock the client#

In SEPM, go to Clients, select the ring's group, open the Policies tab and click Password. Clear Require a password to uninstall the client, or have the password ready, and wait until clients have picked up the policy. Broadcom notes that some releases (14.3 RU10) don't let you turn the uninstall password off. Its command-line uninstall article also says to turn off password protection and Tamper Protection before its PowerShell method, so turn both off for the ring.

3. Uninstall at scale#

For a few devices, Programs and Features is fine. At scale, Broadcom documents a Group Policy software removal and an MSI uninstall that you can wrap in an Intune Win32 app or a Configuration Manager deployment. Find the product code in the Uninstall registry entry whose DisplayName is Symantec Endpoint Protection:

Get-ChildItem HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall |
  Get-ItemProperty | Where-Object { $_.DisplayName -eq 'Symantec Endpoint Protection' } |
  Select-Object DisplayName, DisplayVersion, PSChildName

msiexec /x {PRODUCT-CODE} /qn /lv!* C:\Windows\Temp\uninstallSEP.log

Use Broadcom's CleanWipe tool only when the standard uninstall fails; if your policy requires a password for CleanWipe (14.3 RU5 or later), you'll need it there too. Cloud-managed SEP 16 on the Endpoint Security Agent is removed with seasetup.exe --uninstall --product sep --quiet --password <password> from the agent's bin64 folder. Restart after removal. Uninstalling doesn't delete the client from SEPM, so delete it there or let SEPM purge clients that stop connecting.

4. Switch Defender to active mode#

Windows clients switch to active mode automatically. On servers, set ForceDefenderPassiveMode to 0 and restart. If Defender was disabled on Windows Server 2016, Microsoft's fix is MpCmdRun.exe -WdEnable from the latest platform folder; if it was uninstalled, enable the Windows-Defender-Features, Windows-Defender and Windows-Defender-Gui features with DISM, then restart.

Get-MpComputerStatus |
  Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled, IsTamperProtected, AntivirusSignatureLastUpdated
Get-NetFirewallProfile | Format-Table Name, Enabled
Get-Service -Name WinDefend, Sense

What good looks like: AMRunningMode is Normal, real-time protection and tamper protection are on, all three firewall profiles are enabled, both services are running, and Windows Security lists Microsoft Defender Antivirus as the active provider.

Verify at scale#

• The Device health report in the Defender portal shows the antivirus mode and engine version for every onboarded device; anything still passive after SEP removal needs a look.
• The device inventory shows onboarding status and sensor health. With Plan 2, also search the software inventory in Defender Vulnerability Management for Symantec products left behind.
• Run the detection test on a sample from each ring, and check that ASR rules and network protection now raise events (ASR rules and event IDs).

If Defender won't start or stays passive#

Microsoft lists these messages for a Defender Antivirus that doesn't start because it was turned off, either automatically for compatibility with another antivirus or by policy:

Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_OFF.
Microsoft Defender Antivirus scanning for spyware and other potentially unwanted software is disabled.
The Microsoft Defender Antivirus Service service on Local Computer started and then stopped.

The first is event 15 from Security Center in the Application log, the second is event 5010 in the Windows Defender/Operational log, and the third is the warning the Services app shows when you try to start the service. If SEP is still installed on a device that isn't onboarded, that's expected. Otherwise, run gpresult /h gpresult.html and look for Turn off Microsoft Defender Antivirus set to Enabled, or a Group Policy preference writing DisableAntiSpyware = 1; your image or task sequence may also set it locally. Remove it, and don't edit the start values of the Defender services in the registry: Microsoft calls that unsupported and warns it can force a reimage. If Defender stays passive after SEP is gone, set ForceDefenderPassiveMode to 0 and restart. More codes: Defender Antivirus event IDs and settings not applying.

Rollback#

• Before SEP is removed, SEP is still your antivirus, so rollback mostly means fixing exclusions or pausing a ring. A device can leave Defender for Endpoint with the offboarding package if you have to.
• After removal, reinstall SEP from the SEPM package you kept and reassign the ring's SEP policies, including its firewall policy. Onboarded Windows clients drop back to passive mode automatically.
• Servers need a plan first. From platform 4.18.2208.0, tamper protection on an onboarded server allows a switch to active mode but not back to passive, even with ForceDefenderPassiveMode set to 1. Before a server rollback, take the server out of tamper protection by excluding it from the tamper protection assignment; troubleshooting mode lasts only four hours (tamper protection and Intune).
• Keep SEPM, the client packages and their licenses until the last ring has been stable for an agreed period.

Tips and gotchas#

• Remove the SEP exclusions from Defender Antivirus once SEP is gone; otherwise they stay as blind spots.
• Macs: SEP for Mac is uninstalled from its own client menu. Broadcom warns that RemoveSymantecMacFiles removes every Symantec product from a Mac. Onboarding: macOS with Intune and Linux.
• Connectivity problems after onboarding are quickest to pin down with the client analyzer.
• Replacing Symantec DLP as well? Purview endpoint DLP runs on the same Defender platform: migrating from Symantec DLP to Purview DLP.

References#

• Migrate to Microsoft Defender for Endpoint from non-Microsoft endpoint protection (Microsoft Learn)
• Migrate to Microsoft Defender for Endpoint - Phase 2: Setup (Microsoft Learn)
• Uninstalling Symantec Endpoint Protection (Broadcom Tech Docs)
• Disabling the Windows Firewall (Broadcom Tech Docs)