Windows Defender problem reported by MICROSOFT

[billmoller]

@meanoldmanning, I re-opened my original support case, submitted new MERs, and added all sorts of notes (a collection of findings from this forum thread).

The status is still "development investigating" for me, I think.

I think we're stuck with the October release "non-fix" for now.

[JayMan]

The lastest update on my new case (4-20380411771) was that they were checking with the advanced team & TSDE-3071 had been raised (assume that's an internal escalation number or something).

[chealey]

Hi all

Indeed, if you are seeing this issue please raise a service request or work with the assigned owner of your case if you already have one raised. Engineering are already working on these escalations.

I appreciate this may not help you but it would seem that there are/ were two issues present causing this issue. Part of the issue was resolved in October and we are continuing to see positive results from various customers. I would encourage anyone seeing this issue with the lower versions, to test an upgrade.

We're also seeing mixed reports in regards to the scenarios when we see this issue and perhaps you can all help me here to clarify some of the various reports:

* Has anyone been able to confirm if the issue occurs if you upgrade from any other version of ENS? i.e. RTW or December Update?

* Has anyone been able to confirm if the issue persists when the October update is installed from scratch?

* Has anyone determined any connection in regards to reboots or AMCORE updates?

* Does enabling debug resolve the issue or does the issue re-occur after a few days?

Any additional information is welcomed at this time. Sadly we have still been unable to reproduce this scenario in-house, so we are very reliant on your feedback. Thank you all for your continued contributions and assistance.

[meanoldmanning]

* Issue still occurs if upgraded from any version that I have in my org, including the PoC and the previous official 'Updates'

*The issue still occurs if installed from scratch. By 'from scratch' I mean running the uninstall tool, rebooting, running the script to remove references from the WMI and then installing the October Update

*I read back through some of my posts and I have noted that in one instance I ran a clean install, did not have Debug Logging enabled and WSC on that laptop reported properly until I rebooted, then it started mis-reporting as before. Some of the test systems never had the issue resolved, specifically upgraded machines, so rebooting or AMCORE updates were not a factor

*Enabling Debug Logging (using a ePO assigned policy) resolves, or perhaps masks, the issue on every system and is persistant until I disable Debug Logging (again, by assigned a different policy with Debug Logging not enabled)

[billmoller]

---

Has anyone been able to confirm if the issue persists when the October update is installed from scratch?

---

Yes, I detail this exact scenario in message 140 of this thread. 

---

Has anyone determined any connection in regards to reboots or AMCORE updates?

---

Yes, I detail these scenarios in messages 140, 152, 155, 163, and 164 of this thread.

---

Does enabling debug resolve the issue or does the issue re-occur after a few days?

---

Prior to the October update, enabling debug DID resolve the issue for me temporarily, but the issue re-occurred within a few days.

I just tested with the October update, and turning debug on doesn't change anything for me anymore.  productState remains 393232.

[LBX]

I've been away for a couple of weeks and I find it very disappointing to return from leave to find this issue has not been fully resolved.

[chealey]

@LBX are you also re-seeing this issue in your environment?

Part of the issue has been resolved and many customers are no longer seeing any issues following the October Update. Sadly there are still reports of issue occurring for certain customers and we are investigating those scenarios.

[billmoller]

All, is there anyone in this thread that the October Update did fix the issue for? 

To my knowledge, no poster has indicated it's been fixed, except for me mistakenly.  After a clean install, it was broken again.

If this is the case,@chealey , there would seem to be a huge disparity between "many customers are no longer seeing any issues" and the 100% continued failure rate of participants of this thread...

[chealey]

@billmoller Just FYI - I am basing this comment off the back of Service Requests which have been closed confirming that it did fix the issue and those SRs not being reopened. 

[jmcg]

Hello,

With the lastest ENS version and Windows, McAfee is running and Windows Defender is running.

Windows Defender correctly detect McAfee, but EICAR test virus is blocked by Windows Defender for unknown reason...