Onboarding Windows Server 2012 R2 and 2016 to Defender for Endpoint: the unified solution

Windows Server 2012 R2 and 2016 don't have the Defender for Endpoint sensor built in. Since April 2022 they onboard with the modern unified solution, an MSI package that replaces the old Microsoft Monitoring Agent (MMA) approach, removes its dependencies and adds a much broader feature set. In this post I'll cover the prerequisites, the deployment options, the migration from MMA, the install errors you're most likely to meet, and how to prove a server is protected.

How the unified solution works#

In the Microsoft Defender portal, go to Settings › Endpoints › Device management › Onboarding, select Windows Server 2016 and Windows Server 2012 R2, choose the connectivity type (Streamlined or Standard) and a deployment method, then download two files: the installation package md4ws.msi and the onboarding package. What the MSI installs depends on the server:

Microsoft updates the installation package monthly, so download a fresh copy before each new rollout. Once installed, the sensor updates through Windows Update as KB5005292 ("Microsoft Defender for Endpoint update for EDR Sensor", under the Microsoft Defender for Endpoint category in WSUS and Configuration Manager), while Defender Antivirus takes its normal platform, engine and security intelligence updates.

Prerequisites#

• License: Defender for Servers Plan 1 or Plan 2 (Defender for Cloud), Defender for Endpoint for servers, or Defender for Business servers.
• Updates: a servicing stack update from 14 September 2021 or later and a cumulative update from 20 September 2018 or later; Microsoft recommends the latest of both.
• Windows Server 2016: the Defender Antivirus feature must be installed, enabled and fully updated before you install the MSI. If it was removed, run Install-WindowsFeature -Name Windows-Defender.
• Connectivity: the same Defender for Endpoint URLs as other Windows devices; see streamlined connectivity.
• Another antivirus? Decide on passive mode now: it must be set before onboarding, and these servers only support passive mode on the unified solution. See passive mode and EDR in block mode.

Step-by-step#

1. Pick a deployment method#

• Defender for Cloud: Defender for Servers deploys the Defender for Endpoint extension to Azure VMs and Azure Arc-enabled machines automatically, including the upgrade from MMA.
• Configuration Manager: version 2207 or later fully automates deployment and onboarding; 2107 with the hotfix rollup works with extra steps.
• Group Policy or your own tooling: use Microsoft's install.ps1 helper script (step 3).
• Intune: servers don't enroll in Intune, so Intune can't install the MSI. After onboarding, you can manage their Defender settings from Intune through security settings management.

2. Install one server by hand#

From an elevated prompt in the folder that holds both packages (the Local Script onboarding package contains WindowsDefenderATPLocalOnboardingScript.cmd; the Group Policy package uses WindowsDefenderATPOnboardingScript.cmd):

msiexec /i md4ws.msi /quiet /l*v md4ws-install.log
WindowsDefenderATPLocalOnboardingScript.cmd

3. Automate with install.ps1#

Microsoft's server migration page links the helper script on GitHub. Put install.ps1, the MSI and the onboarding script in one folder. Microsoft recommends the AllSigned execution policy; when the script runs as SYSTEM, import its signing certificate into the Local Computer Trusted Publishers store.

# New installation
.\install.ps1 -OnboardingScript ".\WindowsDefenderATPOnboardingScript.cmd"

# Migration from MMA (removes the Defender for Endpoint workspace)
.\install.ps1 -RemoveMMA <workspace ID> -OnboardingScript ".\WindowsDefenderATPOnboardingScript.cmd"

# Same, on a server where another antivirus stays primary
.\install.ps1 -RemoveMMA <workspace ID> -OnboardingScript ".\WindowsDefenderATPOnboardingScript.cmd" -Passive

The script can remove the MMA workspace and System Center Endpoint Protection, check prerequisites, enable and update Defender Antivirus on Windows Server 2016, install the MSI and apply the Group Policy onboarding script. Get-Help .\install.ps1 lists every option. Set ForceDefenderPassiveMode as well on servers that should stay passive after onboarding.

4. Migrate the remaining MMA-based servers#

MMA-based onboarding is the previous implementation for these servers, and Microsoft's migration guidance covers moving each scenario to the unified solution, so plan to move them all. For a server running another antivirus, Microsoft's order is:

1. Fully update the server, including Defender Antivirus on Windows Server 2016.
2. Create your Defender for Endpoint policies and target them at the server.
3. Install the unified package in passive mode and apply the onboarding script, then install updates.
4. If you're replacing the other antivirus, stop its console from pushing agents, uninstall it, and set ForceDefenderPassiveMode to 0.

On Windows Server 2012 R2 with System Center Endpoint Protection but no Configuration Manager, uninstall SCEP before you install and onboard.

5. Fix install failures#

• Couldn't find c:\program files\windows defender\mpasdesc.dll, - 310 WinDefend: Microsoft documents this as a known issue where an operating system update can make service installation time out on servers with slower disks. Use the latest installation package and the latest install.ps1, which can help clear the failed installation, then retry.
• sc.exe query windefend returns FAILED 1060: The specified service does not exist as an installed service. on Windows Server 2016: Defender Antivirus isn't installed. Add the feature, update it, then rerun the MSI.
• Rerunning the MSI on an installed server asks you to offboard first, because uninstalling requires offboarding. You don't need it for updates; KB5005292 and the normal Defender updates handle those.
• For any other failure, open the verbose log and search for Return value 3; the lines just above it name the action that failed.
• If the MSI installs but the server never shows up, the problem is onboarding; see SENSE event IDs and onboarding errors.

Verify#

sc.exe query windefend
sc.exe query sense
powershell -Command "Get-MpComputerStatus | Select-Object AMRunningMode, AMProductVersion"

Both services should be RUNNING, and AMRunningMode should be Normal, or Passive if you configured it. Only judge passive mode once sense is running. In the Defender portal the server should appear in the device inventory as onboarded once it reports in; run Microsoft's detection test to see an alert end to end.

Tips and gotchas#

• In-place OS upgrades aren't supported with Defender for Endpoint installed on Windows Server 2016 and earlier: offboard, uninstall, upgrade, then install again.
• The local user interface on these servers only allows basic operations. Manage them with PowerShell, WMI or MpCmdRun.exe, and avoid settings that wait for user interaction.
• Not every attack surface reduction rule applies to these operating systems, so check the rule list before reusing a client ASR policy.
• Approve KB5005292 in WSUS or Configuration Manager, or the sensor stays on the build you installed.
• Always offboard before you uninstall the unified solution.

References#

• Onboard servers through Microsoft Defender for Endpoint's onboarding experience
• Server migration scenarios from the previous, MMA-based Microsoft Defender for Endpoint solution