TEAM: Huntress Managed Endpoint Detection and Response (EDR)
PRODUCT: Managed Defender
ENVIRONMENT: Windows
SUMMARY: This guide goes over an old issue with Windows Defender where it's activated on a device but not accurately reflecting as such on the portal.
We've noticed a discrepancy where Defender is activated on a device, but it's not accurately reflected in our portal. Please be assured that our product team is diligently addressing this issue. We appreciate your patience and will keep you updated with further information as soon as we have it.
This issue is considered to be fully resolved at this time. If you run into any issues or have any questions, please reach out to Support.
December 18th, 2023 1400 EST:
- Defender Disabled Escalation feature has been enabled.
December 13th, 0800 EST:
- Managed AV may temporarily show as "Incompatible". Has been resolved.
December 11th, 0900 EST:
- Agent version 0.13.100 is rolling out that should address the status issue with Defender
- Managed AV may temporarily show as "Incompatible". This will be resolved soon from our end.
- Escalation Feature is still disabled as we gather information from this new agent before its turned back on.
December 8th, 1700 EST:
- New ETA has been moved to early next week.
December 8th, 1600 EST:
- We are beta testing a fix and things are looking positive.
- We are aiming to go live as soon as possible. New ETA is possibly by end of business today or early next week.
December 6th, 1600 EST:
- There are no new developments that we can report on at this time.
December 1st, 1300 EST:
- There are no new developments that we can report on at this time.
November 27th, 1000 EST:
- We are still working hard to turn this feature back on as soon as possible.
- We are not able to provide an ETA on a resolution at this time.
November 15th, 1300 EST:
- Due to unforeseen issues we were not able to Enable Defender Disabled Escalations.
- Our engineering team is still hard at work to push out a resolution as soon as possible.
- We are not able to provide an ETA on a resolution at this time.
November 8th, 17:00 EST:
- Aiming to enable Defender Disabled Escalations on November 14th.
November 6th, 09:00 EST:
- Host are now reporting in correctly.
November 3rd, 14:00 EST:
- Defender Disabled Escalations feature has been disabled to reduce noise in the Dashboard while we work on a resolution.
- Defender Disabled Escalations have been marked as Resolved.
- Valid Defender Disabled Escalations will be opened and reported when the feature is turned back on.
November 2nd, 12:00 EST:
- Disabled new Defender Disabled Escalations
November 1st, 17:00 EST:
- The issue appears to be related to pulling in Defender status, preferences, settings, and signature information.
- It seems we are trying to set policy on these hosts but can not confirm if they are being written to the host correctly at this time.
- MAV detections are still functioning without issue.