cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Re: Windows Defender problem reported by MICROSOFT

Jump to solution

@jmcg, Windows Defender (and Windows Security Center) correctly detect that McAfee ENS is installed and running (so we assume Windows Defender is not running), however, Windows Defender still catches EICAR?

Reliable Contributor jmcg
Reliable Contributor
Report Inappropriate Content
Message 182 of 298

Re: Windows Defender problem reported by MICROSOFT

Jump to solution
Yes

Re: Windows Defender problem reported by MICROSOFT

Jump to solution

@jmcg, please run task manager, then in the services tab, take a screenshot of the "Windows Defender Antivirus Service" indicating if it's running or not and post it, here's what mine looks like:

Annotation 2019-10-22 114507.jpg

Also, please run "Windows Security Center" by left clicking the Windows "shield" from your system tray.  When you see this screen:

Annotation 2019-10-22 114549.jpg

Please click the tile circled in red.  Don't click "dismiss" or "Turn on" / "Turn off" if you happen to see those buttons or links, just the white space of the tile.  Then post a screenshot similar to the following (here's mine):

Annotation 2019-10-22 114625.jpg

Finally, click the "Manage providers" link in the right margin and post a screenshot similar to the following:

Annotation 2019-10-22 114653.jpg

As you can see, in my examples, Windows Security Center (WSC) and Windows Defender Antivirus (WDA) do not properly detect McAfee ENS as running and therefore, WDA is also running.

However, you indicated that your WSC does properly detect McAfee ENS, so these screenshots could be helpful.

LBX
Level 9
Report Inappropriate Content
Message 184 of 298

Re: Windows Defender problem reported by MICROSOFT

Jump to solution

@billmoller your screenshots matches my environment however the EICAR test download was trapped by ENS and not Defender.

Reliable Contributor jmcg
Reliable Contributor
Report Inappropriate Content
Message 185 of 298

Re: Windows Defender problem reported by MICROSOFT

Jump to solution

@billmoller 

Ok, this is really strange, I have rebooted and now, this is fixed.
But here the screen of event to show you the weird behavior.

 

16h08 - Booting PC.

 

1.png

16h08 - McShield, running with AMCORE 3868...

 

2.png

16h10 - McAfee Endpoint Security is running.

 

3.png

16h11 - Windows Defender is running.

5.png

16h21 - testing AV with EICAR test file, detected by Windows Defender.

 

4.png

16h21 - Testing Memory exploit to test McAfee Exploit Prevention, to confirm McAfee is still running.

 

6.png

17h45 - Rebooted device, Windows Defender has been turned off.

 

7.png

 

Showing correctly managed by McAfee Endpoint Security.

Re: Windows Defender problem reported by MICROSOFT

Jump to solution

@jmcg, is your AMCORE version still the same and/or if you check your agent logs, did your ENS perform an update?

Reliable Contributor jmcg
Reliable Contributor
Report Inappropriate Content
Message 187 of 298

Re: Windows Defender problem reported by MICROSOFT

Jump to solution

AMCore version has changed to 3869.

He had perform an update, I will investigate more later to see if this issue has been related to the update

Re: Windows Defender problem reported by MICROSOFT

Jump to solution

I have a sneaking suspicion that the update to AMCORE 3869 "fixed" your issue (set the right productState)... 

A good test would be checking 5 minutes after a reboot (within ~3 minutes is when mine notoriously gets the incorrect productState).

Re: Windows Defender problem reported by MICROSOFT

Jump to solution

This whole this is so annoying.

I have 2 laptops on my desk right now, both have the October Update,  both have the current AMCore 3869, only the one with Debug Logging enabled reports properly and shows the correct state.

On the laptop that is NOT reporting properly all the McAfee service show as running except the Firewall Core Service and all of the Windows Defender services show as running except the Advanced Threat Protection Service.

On the laptop that IS report properly the McAfee services are as above, but all of the Defender services are stopped EXCEPT the firewall

Michael
LBX
Level 9
Report Inappropriate Content
Message 190 of 298

Re: Windows Defender problem reported by MICROSOFT

Jump to solution

Mine just updated to 3869 too and the Security Provider is showing McAfee running correctly. I don't know what it said before the update ran however. I'll be checking later today to see if it has switched back to "Off".

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community