From b1fe035918fd46595d3a13662059191d1372af87 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 20 Aug 2020 13:49:36 -0700 Subject: [PATCH 01/46] Create mcafee-to-microsoft-defender-migration.md --- .../mcafee-to-microsoft-defender-migration.md | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md new file mode 100644 index 0000000000..d27a685af8 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md @@ -0,0 +1,56 @@ +--- +title: Migrate from McAfee to Microsoft Defender ATP +description: Make the switch from McAfee to Microsoft Defender ATP +keywords: migration, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: +- M365-security-compliance +- m365solution-symantecmigrate +- m365solution-overview +ms.topic: article +--- + +# Migrate from McAfee to Microsoft Defender Advanced Threat Protection + +If you are planning to switch from McAfee Endpoint Security (McAfee) to [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection) (Microsoft Defender ATP), you're in the right place. Use this article as a guide to plan your migration. + +## The migration process + +When you switch from McAfee to Microsoft Defender ATP, you follow a process that can be divided into three phases, as described in the following table: + +|Phase |Description | +|--|--| +|[![Phase 1: Prepare](images/prepare.png)](symantec-to-microsoft-defender-atp-prepare.md)
[Prepare for your migration](symantec-to-microsoft-defender-atp-prepare.md) |During the **Prepare** phase, you get Microsoft Defender ATP, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender ATP. | +|[![Phase 2: Set up](images/setup.png)](symantec-to-microsoft-defender-atp-setup.md)
[Set up Microsoft Defender ATP](symantec-to-microsoft-defender-atp-setup.md) |During the **Setup** phase, you configure settings and exclusions for Microsoft Defender Antivirus, Microsoft Defender ATP, and Symantec Endpoint Protection. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.| +|[![Phase 3: Onboard](images/onboard.png)](symantec-to-microsoft-defender-atp-onboard.md)
[Onboard to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-onboard.md) |During the **Onboard** phase, you onboard your devices to Microsoft Defender ATP and verify that those devices are communicating with Microsoft Defender ATP. Last, you uninstall Symantec and make sure protection through Microsoft Defender ATP is in active mode. | + +## What's included in Microsoft Defender ATP? + +In this migration guide, we focus on [next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) and [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) capabilities as a starting point for moving to Microsoft Defender ATP. However, Microsoft Defender ATP includes much more than antivirus and endpoint protection. Microsoft Defender ATP is a unified platform for preventative protection, post-breach detection, automated investigation, and response. The following table summarizes features and capabilities in Microsoft Defender ATP. + +| Feature/Capability | Description | +|---|---| +| [Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) | Threat & Vulnerability Management capabilities helps identify, assess, and remediate weaknesses across your endpoints (such as devices). | +| [Attack surface reduction](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction) | Attack surface reduction rules help protect your organization's devices and applications from cyberthreats and attacks. | +| [Next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) | Next-generation protection includes Microsoft Defender Antivirus to help block threats and malware. | +| [Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) | Endpoint detection and response capabilities detect, investigate, and respond to intrusion attempts and active breaches. | +| [Advanced hunting](advanced-hunting-overview.md) | Advanced hunting capabilities enable your security operations team to locate indicators and entities of known or potential threats. | +| [Behavioral blocking and containment](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/behavioral-blocking-containment) | Behavioral blocking and containment capabilities help identify and stop threats, based on their behaviors and process trees even when the threat has started execution. | +| [Automated investigation and remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) | Automated investigation and response capabilities examine alerts and take immediate remediation action to resolve breaches. | +| [Threat hunting service](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts) (Microsoft Threat Experts) | Threat hunting services provide security operations teams with expert level monitoring and analysis, and to help ensure that critical threats aren't missed. | + +**Want to learn more? See [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection).** + +## Next step + +- Proceed to [Prepare for your migration](symantec-to-microsoft-defender-atp-prepare.md). From 23c4458555244f64d2f34004d007c034856ea115 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 20 Aug 2020 13:51:04 -0700 Subject: [PATCH 02/46] Create mcafee-to-microsoft-defender-onboard.md --- .../mcafee-to-microsoft-defender-onboard.md | 100 ++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md new file mode 100644 index 0000000000..88b63ef663 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md @@ -0,0 +1,100 @@ +--- +title: Phase 3 - Onboard to Microsoft Defender ATP +description: Make the switch from McAfee to Microsoft Defender ATP +keywords: migration, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: +- M365-security-compliance +- m365solution-symantecmigrate +ms.topic: article +--- + +# Migrate from McAfee - Phase 3: Onboard to Microsoft Defender ATP + +|[![Phase 1: Prepare](images/prepare.png)](symantec-to-microsoft-defender-atp-prepare.md)
[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |[![Phase 2: Set up](images/setup.png)](symantec-to-microsoft-defender-atp-setup.md)
[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |![Phase 3: Onboard](images/onboard.png)
Phase 3: Onboard | +|--|--|--| +|| |*You are here!* | + + +**Welcome to Phase 3 of [migrating from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)**. This migration phase includes the following steps: + +1. [Onboard devices to Microsoft Defender ATP](#onboard-devices-to-microsoft-defender-atp). +2. [Run a detection test](#run-a-detection-test). +3. [Uninstall Symantec](#uninstall-symantec). +4. [Make sure Microsoft Defender ATP is in active mode](#make-sure-microsoft-defender-atp-is-in-active-mode). + +## Onboard devices to Microsoft Defender ATP + +1. Go to the Microsoft Defender Security Center ([https://aka.ms/MDATPportal](https://aka.ms/MDATPportal)) and sign in. + +2. Choose **Settings** > **Device management** > **Onboarding**. + +3. In the **Select operating system to start onboarding process** list, select an operating system. + +4. Under **Deployment method**, select an option. Follow the links and prompts to onboard your organization's devices. Need help? See [Onboarding methods](#onboarding-methods). + +### Onboarding methods + +Deployment methods vary, depending on which operating system is selected. Refer to the resources listed in the table below to get help with onboarding. + +|Operating system |Method | +|---------|---------| +|Windows 10 |- [Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp)
- [Configuration Manager](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm)
- [Mobile Device Management (Intune)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm)
- [Local script](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script)

**NOTE**: A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, Microsoft Endpoint Configuration Manager, or Intune. | +|- Windows 8.1 Enterprise
- Windows 8.1 Pro
- Windows 7 SP1 Enterprise
- Windows 7 SP1 Pro | [Microsoft Monitoring Agent](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel#install-and-configure-microsoft-monitoring-agent-mma-to-report-sensor-data-to-microsoft-defender-atp)

**NOTE**: Microsoft Monitoring Agent is now Azure Log Analytics agent. To learn more, see [Log Analytics agent overview](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent). | +|- Windows Server 2019 and later
- Windows Server 2019 core edition
- Windows Server version 1803 and later |- [Local script](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script)
- [Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp)
- [Configuration Manager](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm)
- [System Center Configuration Manager](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm#onboard-windows-10-devices-using-earlier-versions-of-system-center-configuration-manager)
- [VDI onboarding scripts for non-persistent devices](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi)

**NOTE**: A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, Microsoft Endpoint Configuration Manager, or Intune. | +|- Windows Server 2016
- Windows Server 2012 R2
- Windows Server 2008 R2 SP1 |- [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints#option-1-onboard-servers-through-microsoft-defender-security-center)
- [Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp) | +|macOS
- 10.15 (Catalina)
- 10.14 (Mojave)
- 10.13 (High Sierra)

iOS

Linux:
- RHEL 7.2+
- CentOS Linux 7.2+
- Ubuntu 16 LTS, or higher LTS
- SLES 12+
- Debian 9+
- Oracle Linux 7.2 |[Onboard non-Windows devices](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows) | + +## Run a detection test + +To verify that your onboarded devices are properly connected to Microsoft Defender ATP, you can run a detection test. + + +|Operating system |Guidance | +|---------|---------| +|- Windows 10
- Windows Server 2019
- Windows Server, version 1803
- Windows Server 2016
- Windows Server 2012 R2 |See [Run a detection test](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-detection-test).

Visit the Microsoft Defender ATP demo scenarios site ([https://demo.wd.microsoft.com](https://demo.wd.microsoft.com)) and try one or more of the scenarios. For example, try the **Cloud-delivered protection** demo scenario. | +|macOS
- 10.15 (Catalina)
- 10.14 (Mojave)
- 10.13 (High Sierra) |Download and use the DIY app at [https://aka.ms/mdatpmacosdiy](https://aka.ms/mdatpmacosdiy).

For more information, see [Microsoft Defender Advanced Threat Protection for Mac](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac). | +|Linux:
- RHEL 7.2+
- CentOS Linux 7.2+
- Ubuntu 16 LTS, or higher LTS
- SLES 12+
- Debian 9+
- Oracle Linux 7.2 |1. Run the following command, and look for a result of **1**:
`mdatp health --field real_time_protection_enabled`.

2. Open a Terminal window, and run the following command:
`curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt`.

3. Run the following command to list any detected threats:
`mdatp threat list`.

For more information, see [Microsoft Defender ATP for Linux](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux). | + +## Uninstall Symantec + +Now that you have onboarded your organization's devices to Microsoft Defender ATP, your next step is to uninstall Symantec. + +1. [Disable Tamper Protection](https://knowledge.broadcom.com/external/article?legacyId=tech192023) in Symantec. + +2. Delete the uninstall password for Symantec: + 1. On your Windows devices, open Registry Editor as an administrator. + 2. Go to `HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC`. + 3. Look for an entry named **SmcInstData**. Right-click the item, and then choose **Delete**. + +3. Remove Symantec from your devices. If you need help with this, see the following Broadcom resources: + - [Uninstall Symantec Endpoint Protection](https://knowledge.broadcom.com/external/article/156148/uninstall-symantec-endpoint-protection.html) + - Windows devices: [Manually uninstall Endpoint Protection 14 clients on Windows](https://knowledge.broadcom.com/external/article?articleId=170040) + - macOS computers: [Remove Symantec software for Mac using RemoveSymantecMacFiles](https://knowledge.broadcom.com/external/article?articleId=151387) + - Linux devices: [Frequently Asked Questions for Endpoint Protection for Linux](https://knowledge.broadcom.com/external/article?articleId=162054) + +## Make sure Microsoft Defender ATP is in active mode + +Now that you have uninstalled Symantec, your next step is to make sure that Microsoft Defender Antivirus and endpoint detection and response are enabled and in active mode. + +To do this, visit the Microsoft Defender ATP demo scenarios site ([https://demo.wd.microsoft.com](https://demo.wd.microsoft.com)). Try one or more of the demo scenarios on that page, including at least the following: +- Cloud-delivered protection +- Potentially Unwanted Applications (PUA) +- Network Protection (NP) + +## Next steps + +**Congratulations**! You have completed your [migration from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)! + +- [Visit your security operations dashboard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard) in the Microsoft Defender Security Center ([https://aka.ms/MDATPportal](https://aka.ms/MDATPportal)). +- [Manage Microsoft Defender Advanced Threat Protection, post migration](manage-atp-post-migration.md). From 9d96795cde93220734b9b66aba86b4a51c7c413a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 20 Aug 2020 13:52:57 -0700 Subject: [PATCH 03/46] Create mcafee-to-microsoft-defender-prepare.md --- .../mcafee-to-microsoft-defender-prepare.md | 87 +++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md new file mode 100644 index 0000000000..3702b20f5a --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -0,0 +1,87 @@ +--- +title: Phase 1 - Prepare for your migration to Microsoft Defender ATP +description: Phase 1 of "Make the switch from McAfee to Microsoft Defender ATP". Prepare for your migration. +keywords: migration, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: +- M365-security-compliance +- m365solution-McAfeemigrate +ms.topic: article +--- + +# Migrate from McAfee - Phase 1: Prepare for your migration + +|![Phase 1: Prepare](images/prepare.png)
Phase 1: Prepare |[![Phase 2: Set up](images/setup.png)](McAfee-to-microsoft-defender-atp-setup.md)
[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |[![Phase 3: Onboard](images/onboard.png)](symantec-to-microsoft-defender-atp-onboard.md)
[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) | +|--|--|--| +|*You are here!*| | | + + +**Welcome to the Prepare phase of [migrating from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)**. + +This migration phase includes the following steps: +1. [Get Microsoft Defender ATP](#get-microsoft-defender-atp). +2. [Grant access to the Microsoft Defender Security Center](#grant-access-to-the-microsoft-defender-security-center). +3. [Configure device proxy and internet connectivity settings](#configure-device-proxy-and-internet-connectivity-settings). + +## Get Microsoft Defender ATP + +To get started, you must have Microsoft Defender ATP, with licenses assigned and provisioned. + +1. Buy or try Microsoft Defender ATP today. [Visit Microsoft Defender ATP to start a free trial or request a quote](https://aka.ms/mdatp). + +2. Verify that your licenses are properly provisioned. [Check your license state](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment#check-license-state). + +3. As a global administrator or security administrator, set up your dedicated cloud instance of Microsoft Defender ATP. See [Microsoft Defender ATP setup: Tenant configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment#tenant-configuration). + +4. If endpoints (such as devices) in your organization use a proxy to access the internet, see [Microsoft Defender ATP setup: Network configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment#network-configuration). + +At this point, you are ready to grant access to your security administrators and security operators who will use the Microsoft Defender Security Center ([https://aka.ms/MDATPportal](https://aka.ms/MDATPportal)). + +> [!NOTE] +> The Microsoft Defender Security Center is sometimes referred to as the Microsoft Defender ATP portal. + +## Grant access to the Microsoft Defender Security Center + +The Microsoft Defender Security Center ([https://aka.ms/MDATPportal](https://aka.ms/MDATPportal)) is where you access and configure features and capabilities of Microsoft Defender ATP. To learn more, see [Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use). + +Permissions to the Microsoft Defender Security Center can be granted by using either basic permissions or role-based access control (RBAC). We recommend using RBAC so that you have more granular control over permissions. + +1. Plan the roles and permissions for your security administrators and security operators. See [Role-based access control](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment#role-based-access-control). + +2. Set up and configure RBAC. We recommend using [Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to configure RBAC, especially if your organization is using a combination of Windows 10, macOS, iOS, and Android devices. See [setting up RBAC using Intune](https://docs.microsoft.com/mem/intune/fundamentals/role-based-access-control). + + If your organization requires a method other than Intune, choose one of the following options: + - [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/configure/configure-role-based-administration) + - [Advanced Group Policy Management](https://docs.microsoft.com/microsoft-desktop-optimization-pack/agpm) + - [Windows Admin Center](https://docs.microsoft.com/windows-server/manage/windows-admin-center/overview) + +3. Grant access to the Microsoft Defender Security Center. (Need help? See [Manage portal access using RBAC](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/rbac)). + +## Configure device proxy and internet connectivity settings + +To enable communication between your devices and Microsoft Defender ATP, configure proxy and internet settings. The following table includes links to resources you can use to configure your proxy and internet settings for various operating systems and capabilities: + +|Capabilities | Operating System | Resources | +|--|--|--| +|[Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) (EDR) |- [Windows 10](https://docs.microsoft.com/windows/release-information)
- [Windows Server 2019](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019)
- [Windows Server 1803 or later](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) |[Configure machine proxy and internet connectivity settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet) | +|EDR |- [Windows Server 2016](https://docs.microsoft.com/windows/release-information/status-windows-10-1607-and-windows-server-2016)
- [Windows Server 2012 R2](https://docs.microsoft.com/windows/release-information/status-windows-8.1-and-windows-server-2012-r2)
- [Windows Server 2008 R2 SP1](https://docs.microsoft.com/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1)
- [Windows 8.1](https://docs.microsoft.com/windows/release-information/status-windows-8.1-and-windows-server-2012-r2)
- [Windows 7 SP1](https://docs.microsoft.com/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1) |[Configure proxy and internet connectivity settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel#configure-proxy-and-internet-connectivity-settings) | +|EDR |macOS:
- 10.15 (Catalina)
- 10.14 (Mojave)
- 10.13 (High Sierra) |[Microsoft Defender ATP for Mac: Network connections](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac#network-connections) | +|[Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) |- [Windows 10](https://docs.microsoft.com/windows/release-information)
- [Windows Server 2019](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019)
- [Windows Server 1803 or later](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803)
- [Windows Server 2016](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-2016) |[Configure and validate Microsoft Defender Antivirus network connections](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus)
| +|Antivirus |macOS:
- 10.15 (Catalina)
- 10.14 (Mojave)
- 10.13 (High Sierra) |[Microsoft Defender ATP for Mac: Network connections](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac#network-connections) | +|Antivirus |Linux:
- RHEL 7.2+
- CentOS Linux 7.2+
- Ubuntu 16 LTS, or higher LTS
- SLES 12+
- Debian 9+
- Oracle Linux 7.2 |[Microsoft Defender ATP for Linux: Network connections](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux#network-connections) + +## Next step + +**Congratulations**! You have completed the **Prepare** phase of [migrating from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)! + +- [Proceed to set up Microsoft Defender ATP](symantec-to-microsoft-defender-atp-setup.md). From 82b01701457866624d1e2561405c8fae96f7fbd0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 20 Aug 2020 13:53:57 -0700 Subject: [PATCH 04/46] Create mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 209 ++++++++++++++++++ 1 file changed, 209 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md new file mode 100644 index 0000000000..309ae74145 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -0,0 +1,209 @@ +--- +title: Phase 2 - Set up Microsoft Defender ATP +description: Phase 2 - Set up Microsoft Defender ATP +keywords: migration, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: +- M365-security-compliance +- m365solution-symantecmigrate +ms.topic: article +--- + +# Migrate from McAfee - Phase 2: Set up Microsoft Defender ATP + +|[![Phase 1: Prepare](images/prepare.png)](symantec-to-microsoft-defender-atp-prepare.md)
[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |![Phase 2: Set up](images/setup.png)
Phase 2: Set up |[![Phase 3: Onboard](images/onboard.png)](symantec-to-microsoft-defender-atp-onboard.md)
[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) | +|--|--|--| +||*You are here!* | | + + +**Welcome to the Setup phase of [migrating from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)**. This phase includes the following steps: +1. [Enable or reinstall Microsoft Defender Antivirus (for certain versions of Windows)](#enable-or-reinstall-microsoft-defender-antivirus-for-certain-versions-of-windows). +2. [Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus). +3. [Add Microsoft Defender ATP to the exclusion list for Symantec](#add-microsoft-defender-atp-to-the-exclusion-list-for-symantec). +4. [Add Symantec to the exclusion list for Microsoft Defender Antivirus](#add-symantec-to-the-exclusion-list-for-microsoft-defender-antivirus). +5. [Add Symantec to the exclusion list for Microsoft Defender ATP](#add-symantec-to-the-exclusion-list-for-microsoft-defender-atp). +6. [Set up your device groups, device collections, and organizational units](#set-up-your-device-groups-device-collections-and-organizational-units). +7. [Configure antimalware policies and real-time protection](#configure-antimalware-policies-and-real-time-protection). + +## Enable or reinstall Microsoft Defender Antivirus (for certain versions of Windows) + +> [!TIP] +> If you're running Windows 10, you do not need to perform this task. Proceed to **[Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus)**. + +On certain versions of Windows, Microsoft Defender Antivirus might have been uninstalled or disabled. This is because Microsoft Defender Antivirus does not enter passive or disabled mode when you install a third-party antivirus product, such as Symantec. To learn more, see [Microsoft Defender Antivirus compatibility](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility). + +Now that you're moving from Symantec to Microsoft Defender ATP, you'll need to enable or reinstall Microsoft Defender Antivirus, and set it to passive mode. + +### Reinstall Microsoft Defender Antivirus on Windows Server + +> [!NOTE] +> The following procedure applies only to endpoints or devices that are running the following versions of Windows: +> - Windows Server 2019 +> - Windows Server, version 1803 (core-only mode) +> - Windows Server 2016 +> +> Microsoft Defender Antivirus is built into Windows 10, but it might be disabled. In this case, proceed to [Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus). + +1. As a local administrator on the endpoint or device, open Windows PowerShell. + +2. Run the following PowerShell cmdlets:
+ `Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features`
+ `Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`
+ +3. To verify Microsoft Defender Antivirus is running, use the following PowerShell cmdlet:
+ `Get-Service -Name windefend` + +> [!TIP] +> Need help? See [Microsoft Defender Antivirus on Windows Server 2016 and 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016). + +### Set Microsoft Defender Antivirus to passive mode on Windows Server + +Because your organization is still using Symantec, you must set Microsoft Defender Antivirus to passive mode. That way, Symantec and Microsoft Defender Antivirus can run side by side until you have finished onboarding to Microsoft Defender ATP. + +1. Open Registry Editor, and then navigate to
+ `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Windows Advanced Threat Protection`. + +2. Edit (or create) a DWORD entry called **ForceDefenderPassiveMode**, and specify the following settings: + - Set the DWORD's value to **1**. + - Under **Base**, select **Hexadecimal**. + +> [!NOTE] +> You can use other methods to set the registry key, such as the following: +>- [Group Policy Preference](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn581922(v=ws.11)) +>- [Local Group Policy Object tool](https://docs.microsoft.com/windows/security/threat-protection/security-compliance-toolkit-10#what-is-the-local-group-policy-object-lgpo-tool) +>- [A package in Configuration Manager](https://docs.microsoft.com/mem/configmgr/apps/deploy-use/packages-and-programs) + +## Enable Microsoft Defender Antivirus + +Because your organization has been using Symantec as your primary antivirus solution, Microsoft Defender Antivirus is most likely disabled on your organization's Windows devices. This step of the migration process involves enabling Microsoft Defender Antivirus. + +To enable Microsoft Defender Antivirus, we recommend using Intune. However, you can any of the methods that are listed in the following table: + +|Method |What to do | +|---------|---------| +|[Intune](https://docs.microsoft.com/mem/intune/fundamentals/tutorial-walkthrough-endpoint-manager)

**NOTE**: Intune is now Microsoft Endpoint Manager. |1. Go to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and sign in.

2. Select **Devices** > **Configuration profiles**, and then select the profile type you want to configure. If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure).

3. Select **Properties**, and then select **Configuration settings: Edit**.

4. Expand **Microsoft Defender Antivirus**.

5. Enable **Cloud-delivered protection**.

6. In the **Prompt users before sample submission** dropdown, select **Send all samples automatically**.

7. In the **Detect potentially unwanted applications** dropdown, select **Enable** or **Audit**.

8. Select **Review + save**, and then choose **Save**.

For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/intune/device-profiles).| +|Control Panel in Windows |Follow the guidance here: [Turn on Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/user-help/turn-on-defender-windows).

**NOTE**: You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows. | +|[Advanced Group Policy Management](https://docs.microsoft.com/microsoft-desktop-optimization-pack/agpm/)
or
[Group Policy Management Console](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus) |1. Go to `Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus`.

2. Look for a policy called **Turn off Microsoft Defender Antivirus**.

3. Choose **Edit policy setting**, and make sure that policy is disabled. This enables Microsoft Defender Antivirus.

**NOTE**: You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows. | + +### Verify that Microsoft Defender Antivirus is in passive mode + +Microsoft Defender Antivirus can run alongside Symantec if you set Microsoft Defender Antivirus to passive mode. You can use either Command Prompt or PowerShell to perform this task, as described in the following table: + +|Method |What to do | +|---------|---------| +|Command Prompt |1. On a Windows device, open Command Prompt as an administrator.

2. Type `sc query windefend`, and then press Enter.

3. Review the results to confirm that Microsoft Defender Antivirus is running in passive mode. | +|PowerShell |1. On a Windows device, open Windows PowerShell as an administrator.

2. Run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/Get-MpComputerStatus?view=win10-ps) cmdlet.

3. In the list of results, look for **AntivirusEnabled: True**. | + +> [!NOTE] +> You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows. + +## Add Microsoft Defender ATP to the exclusion list for Symantec + +This step of the setup process involves adding Microsoft Defender ATP to the exclusion list for Symantec and any other security products your organization is using. The specific exclusions to configure depend on which version of Windows your endpoints or devices are running, and are listed in the following table: + +|OS |Exclusions | +|--|--| +|- Windows 10, [version 1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803) or later (See [Windows 10 release information](https://docs.microsoft.com/windows/release-information))
- Windows 10, version 1703 or [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709) with [KB4493441](https://support.microsoft.com/help/4493441) installed
- [Windows Server 2019](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019)
- [Windows Server, version 1803](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) |`C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe`

`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe`

`C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe`

`C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe`
| +|- [Windows 8.1](https://docs.microsoft.com/windows/release-information/status-windows-8.1-and-windows-server-2012-r2)
- [Windows 7](https://docs.microsoft.com/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1)
- [Windows Server 2016](https://docs.microsoft.com/windows/release-information/status-windows-10-1607-and-windows-server-2016)
- [Windows Server 2012 R2](https://docs.microsoft.com/windows/release-information/status-windows-8.1-and-windows-server-2012-r2)
- [Windows Server 2008 R2 SP1](https://docs.microsoft.com/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1) |`C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 6\45\MsSenseS.exe`

**NOTE**: Where Monitoring Host Temporary Files 6\45 can be different numbered subfolders.

`C:\Program Files\Microsoft Monitoring Agent\Agent\AgentControlPanel.exe`

`C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe`

`C:\Program Files\Microsoft Monitoring Agent\Agent\HSLockdown.exe`

`C:\Program Files\Microsoft Monitoring Agent\Agent\MOMPerfSnapshotHelper.exe`

`C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe`

`C:\Program Files\Microsoft Monitoring Agent\Agent\TestCloudConnection.exe` | + +## Add Symantec to the exclusion list for Microsoft Defender Antivirus + +During this step of the setup process, you add Symantec and your other security solutions to the Microsoft Defender Antivirus exclusion list. + +When you add [exclusions to Microsoft Defender Antivirus scans](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus), you should add path and process exclusions. Keep the following points in mind: +- Path exclusions exclude specific files and whatever those files access. +- Process exclusions exclude whatever a process touches, but does not exclude the process itself. +- If you list each executable (.exe) as both a path exclusion and a process exclusion, the process and whatever it touches are excluded. +- List your process exclusions using their full path and not by their name only. (The name-only method is less secure.) + +You can choose from several methods to add your exclusions to Microsoft Defender Antivirus, as listed in the following table: + +|Method | What to do| +|--|--| +|[Intune](https://docs.microsoft.com/mem/intune/fundamentals/tutorial-walkthrough-endpoint-manager)

**NOTE**: Intune is now Microsoft Endpoint Manager. |1. Go to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and sign in.

2. Select **Devices** > **Configuration profiles**, and then select the profile that you want to configure.

3. Under **Manage**, select **Properties**.

4. Select **Configuration settings: Edit**.

5. Expand **Microsoft Defender Antivirus**, and then expand **Microsoft Defender Antivirus Exclusions**.

6. Specify the files and folders, extensions, and processes to exclude from Microsoft Defender Antivirus scans. For reference, see [Microsoft Defender Antivirus exclusions](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions).

7. Choose **Review + save**, and then choose **Save**. | +|[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/) |1. Using the [Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/manage/admin-console), go to **Assets and Compliance** > **Endpoint Protection** > **Antimalware Policies**, and then select the policy that you want to modify.

2. Specify exclusion settings for files and folders, extensions, and processes to exclude from Microsoft Defender Antivirus scans. | +|[Group Policy Object](https://docs.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-objects) | 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.

2. In the **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**.

3. Expand the tree to **Windows components > Microsoft Defender Antivirus > Exclusions**.
**NOTE**: You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows.

4. Double-click the **Path Exclusions** setting and add the exclusions.
- Set the option to **Enabled**.
- Under the **Options** section, click **Show...**.
- Specify each folder on its own line under the **Value name** column.
- If you specify a file, make sure to enter a fully qualified path to the file, including the drive letter, folder path, filename, and extension. Enter **0** in the **Value** column.

5. Click **OK**.

6. Double-click the **Extension Exclusions** setting and add the exclusions.
- Set the option to **Enabled**.
- Under the **Options** section, click **Show...**.
- Enter each file extension on its own line under the **Value name** column. Enter **0** in the **Value** column.

7. Click **OK**. | +|Local group policy object |1. On the endpoint or device, open the Local Group Policy Editor.

2. Go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Exclusions**.
**NOTE**: You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows.

3. Specify your path and process exclusions. | +|Registry key |1. Export the following registry key: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\exclusions`.

2. Import the registry key. Here are two examples:
- Local path: `regedit.exe /s c:\temp\ MDAV_Exclusion.reg`
- Network share: `regedit.exe /s \\FileServer\ShareName\MDAV_Exclusion.reg` | + +## Add Symantec to the exclusion list for Microsoft Defender ATP + +To add exclusions to Microsoft Defender ATP, you create [indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators#create-indicators-for-files). + +1. Go to the Microsoft Defender Security Center ([https://aka.ms/MDATPportal](https://aka.ms/MDATPportal)) and sign in. + +2. In the navigation pane, choose **Settings** > **Rules** > **Indicators**. + +3. On the **File hashes** tab, choose **Add indicator**. + +3. On the **Indicator** tab, specify the following settings: + - File hash (Need help? See [Find a file hash using CMPivot](#find-a-file-hash-using-cmpivot) in this article.) + - Under **Expires on (UTC)**, choose **Never**. + +4. On the **Action** tab, specify the following settings: + - **Response Action**: **Allow** + - Title and description + +5. On the **Scope** tab, under **Device groups**, select either **All devices in my scope** or **Select from list**. + +6. On the **Summary** tab, review the settings, and then click **Save**. + +### Find a file hash using CMPivot + +CMPivot is an in-console utility for Configuration Manager. CMPivot provides access to the real-time state of devices in your environment. It immediately runs a query on all currently connected devices in the target collection and returns the results. To learn more, see [CMPivot overview](https://docs.microsoft.com/mem/configmgr/core/servers/manage/cmpivot-overview). + +To use CMPivot to get your file hash, follow these steps: + +1. Review the [prerequisites](https://docs.microsoft.com/mem/configmgr/core/servers/manage/cmpivot#prerequisites). + +2. [Start CMPivot](https://docs.microsoft.com/mem/configmgr/core/servers/manage/cmpivot#start-cmpivot). + +3. Connect to Configuration Manager (`SCCM_ServerName.DomainName.com`). + +4. Select the **Query** tab. + +5. In the **Device Collection** list, and choose **All Systems (default)**. + +6. In the query box, type the following query:
+ +```kusto +File(c:\\windows\\notepad.exe) +| project Hash +``` +> [!NOTE] +> In the query above, replace *notepad.exe* with the your third-party security product process name. + +## Set up your device groups, device collections, and organizational units + +| Collection type | What to do | +|--|--| +|[Device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) (formerly called machine groups) enable your security operations team to configure security capabilities, such as automated investigation and remediation.

Device groups are also useful for assigning access to those devices so that your security operations team can take remediation actions if needed.

Device groups are created in the Microsoft Defender Security Center. |1. Go to the Microsoft Defender Security Center ([https://aka.ms/MDATPportal](https://aka.ms/MDATPportal)).

2. In the navigation pane on the left, choose **Settings** > **Permissions** > **Device groups**.

3. Choose **+ Add device group**.

4. Specify a name and description for the device group.

5. In the **Automation level** list, select an option. (We recommend **Full - remediate threats automatically**.) To learn more about the various automation levels, see [How threats are remediated](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations#how-threats-are-remediated).

6. Specify conditions for a matching rule to determine which devices belong to the device group. For example, you can choose a domain, OS versions, or even use [device tags](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-tags).

7. On the **User access** tab, specify roles that should have access to the devices that are included in the device group.

8. Choose **Done**. | +|[Device collections](https://docs.microsoft.com/mem/configmgr/core/clients/manage/collections/introduction-to-collections) enable your security operations team to manage applications, deploy compliance settings, or install software updates on the devices in your organization.

Device collections are created by using [Configuration Manager](https://docs.microsoft.com/mem/configmgr/). |Follow the steps in [Create a collection](https://docs.microsoft.com/mem/configmgr/core/clients/manage/collections/create-collections#bkmk_create). | +|[Organizational units](https://docs.microsoft.com/azure/active-directory-domain-services/create-ou) enable you to logically group objects such as user accounts, service accounts, or computer accounts. You can then assign administrators to specific organizational units, and apply group policy to enforce targeted configuration settings.

Organizational units are defined in [Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services). | Follow the steps in [Create an Organizational Unit in an Azure Active Directory Domain Services managed domain](https://docs.microsoft.com/azure/active-directory-domain-services/create-ou). | + +## Configure antimalware policies and real-time protection + +Using Configuration Manager and your device collection(s), configure your antimalware policies. + +- See [Create and deploy antimalware policies for Endpoint Protection in Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-antimalware-policies). + +- While you create and configure your antimalware policies, make sure to review the [real-time protection settings](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-antimalware-policies#real-time-protection-settings) and [enable block at first sight](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus). + +> [!TIP] +> You can deploy the policies before your organization's devices on onboarded. + +## Next step + +**Congratulations**! You have completed the Setup phase of [migrating from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)! + +- [Proceed to Phase 3: Onboard to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-onboard.md) From 398411d817bde12973d5f04726e8ef2e22de6591 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 20 Aug 2020 13:55:01 -0700 Subject: [PATCH 05/46] Update TOC.md --- windows/security/threat-protection/TOC.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 24e94ee4c1..bd1727d3c7 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -21,12 +21,12 @@ ### [Phase 3: Onboard](microsoft-defender-atp/onboarding.md) ## [Migration guides]() -### [Migrate from Symantec to Microsoft Defender ATP]() +### [Switch from Symantec to Microsoft Defender ATP]() #### [Get an overview of migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md) #### [Prepare for your migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md) #### [Set up Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md) #### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md) -### [Manage Microsoft Defender ATP post migration]() +### [Manage Microsoft Defender ATP after migration]() #### [Overview](microsoft-defender-atp/manage-atp-post-migration.md) #### [Intune (recommended)](microsoft-defender-atp/manage-atp-post-migration-intune.md) #### [Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md) From 5b52dfbe89d6e3c0a6efb8c5403f20e062bca67d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 20 Aug 2020 13:57:43 -0700 Subject: [PATCH 06/46] Update mcafee-to-microsoft-defender-migration.md --- .../mcafee-to-microsoft-defender-migration.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md index d27a685af8..afa5d9f08e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md @@ -30,9 +30,9 @@ When you switch from McAfee to Microsoft Defender ATP, you follow a process that |Phase |Description | |--|--| -|[![Phase 1: Prepare](images/prepare.png)](symantec-to-microsoft-defender-atp-prepare.md)
[Prepare for your migration](symantec-to-microsoft-defender-atp-prepare.md) |During the **Prepare** phase, you get Microsoft Defender ATP, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender ATP. | -|[![Phase 2: Set up](images/setup.png)](symantec-to-microsoft-defender-atp-setup.md)
[Set up Microsoft Defender ATP](symantec-to-microsoft-defender-atp-setup.md) |During the **Setup** phase, you configure settings and exclusions for Microsoft Defender Antivirus, Microsoft Defender ATP, and Symantec Endpoint Protection. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.| -|[![Phase 3: Onboard](images/onboard.png)](symantec-to-microsoft-defender-atp-onboard.md)
[Onboard to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-onboard.md) |During the **Onboard** phase, you onboard your devices to Microsoft Defender ATP and verify that those devices are communicating with Microsoft Defender ATP. Last, you uninstall Symantec and make sure protection through Microsoft Defender ATP is in active mode. | +|[![Phase 1: Prepare](images/prepare.png)](mcafee-to-microsoft-defender-prepare.md)
[Prepare for your migration](mcafee-to-microsoft-defender-prepare.md) |During the **Prepare** phase, you get Microsoft Defender ATP, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender ATP. | +|[![Phase 2: Set up](images/setup.png)](mcafee-to-microsoft-defender-setup.md)
[Set up Microsoft Defender ATP](mcafee-to-microsoft-defender-setup.md) |During the **Setup** phase, you configure settings and exclusions for Microsoft Defender Antivirus, Microsoft Defender ATP, and Symantec Endpoint Protection. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.| +|[![Phase 3: Onboard](images/onboard.png)](mcafee-to-microsoft-defender-onboard.md)
[Onboard to Microsoft Defender ATP](mcafee-to-microsoft-defender-onboard.md) |During the **Onboard** phase, you onboard your devices to Microsoft Defender ATP and verify that those devices are communicating with Microsoft Defender ATP. Last, you uninstall Symantec and make sure protection through Microsoft Defender ATP is in active mode. | ## What's included in Microsoft Defender ATP? @@ -53,4 +53,4 @@ In this migration guide, we focus on [next-generation protection](https://docs.m ## Next step -- Proceed to [Prepare for your migration](symantec-to-microsoft-defender-atp-prepare.md). +- Proceed to [Prepare for your migration](mcafee-to-microsoft-defender-prepare.md). From 128057b246cfa07520ad7952a5fd8ca38ea9af8a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 20 Aug 2020 14:55:15 -0700 Subject: [PATCH 07/46] Update mcafee-to-microsoft-defender-prepare.md --- .../mcafee-to-microsoft-defender-prepare.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index 3702b20f5a..466f3426f5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -21,7 +21,7 @@ ms.topic: article # Migrate from McAfee - Phase 1: Prepare for your migration -|![Phase 1: Prepare](images/prepare.png)
Phase 1: Prepare |[![Phase 2: Set up](images/setup.png)](McAfee-to-microsoft-defender-atp-setup.md)
[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |[![Phase 3: Onboard](images/onboard.png)](symantec-to-microsoft-defender-atp-onboard.md)
[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) | +|![Phase 1: Prepare](images/prepare.png)
Phase 1: Prepare |[![Phase 2: Set up](images/setup.png)](mcafee-to-microsoft-defender-setup.md)
[Phase 2: Set up](mcafee-to-microsoft-defender-setup.md) |[![Phase 3: Onboard](images/onboard.png)](mcafee-to-microsoft-defender-onboard.md)
[Phase 3: Onboard](mcafee-to-microsoft-defender-onboard.md) | |--|--|--| |*You are here!*| | | @@ -82,6 +82,6 @@ To enable communication between your devices and Microsoft Defender ATP, configu ## Next step -**Congratulations**! You have completed the **Prepare** phase of [migrating from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)! +**Congratulations**! You have completed the **Prepare** phase of [migrating from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)! -- [Proceed to set up Microsoft Defender ATP](symantec-to-microsoft-defender-atp-setup.md). +- [Proceed to set up Microsoft Defender ATP](mcafee-to-microsoft-defender-setup.md). From 5040929c80383dc78079d078c3eaf831390c3bc8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 20 Aug 2020 14:59:45 -0700 Subject: [PATCH 08/46] Update mcafee-to-microsoft-defender-prepare.md --- .../mcafee-to-microsoft-defender-prepare.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index 466f3426f5..aa726f53fb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -26,7 +26,7 @@ ms.topic: article |*You are here!*| | | -**Welcome to the Prepare phase of [migrating from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)**. +**Welcome to the Prepare phase of [migrating from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This migration phase includes the following steps: 1. [Get Microsoft Defender ATP](#get-microsoft-defender-atp). From 100936b136e5d21e688d4a9de09075b33a327dea Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 20 Aug 2020 15:03:26 -0700 Subject: [PATCH 09/46] Update mcafee-to-microsoft-defender-onboard.md --- .../mcafee-to-microsoft-defender-onboard.md | 28 ++++++++----------- 1 file changed, 12 insertions(+), 16 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md index 88b63ef663..98fc71785a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md @@ -15,22 +15,22 @@ manager: dansimp audience: ITPro ms.collection: - M365-security-compliance -- m365solution-symantecmigrate +- m365solution-McAfeemigrate ms.topic: article --- # Migrate from McAfee - Phase 3: Onboard to Microsoft Defender ATP -|[![Phase 1: Prepare](images/prepare.png)](symantec-to-microsoft-defender-atp-prepare.md)
[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |[![Phase 2: Set up](images/setup.png)](symantec-to-microsoft-defender-atp-setup.md)
[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |![Phase 3: Onboard](images/onboard.png)
Phase 3: Onboard | +|[![Phase 1: Prepare](images/prepare.png)](mcafee-to-microsoft-defender-prepare.md)
[Phase 1: Prepare](mcafee-to-microsoft-defender-prepare.md) |[![Phase 2: Set up](images/setup.png)](mcafee-to-microsoft-defender-setup.md)
[Phase 2: Set up](mcafee-to-microsoft-defender-setup.md) |![Phase 3: Onboard](images/onboard.png)
Phase 3: Onboard | |--|--|--| || |*You are here!* | -**Welcome to Phase 3 of [migrating from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)**. This migration phase includes the following steps: +**Welcome to Phase 3 of [migrating from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This migration phase includes the following steps: 1. [Onboard devices to Microsoft Defender ATP](#onboard-devices-to-microsoft-defender-atp). 2. [Run a detection test](#run-a-detection-test). -3. [Uninstall Symantec](#uninstall-symantec). +3. [Uninstall McAfee](#uninstall-McAfee). 4. [Make sure Microsoft Defender ATP is in active mode](#make-sure-microsoft-defender-atp-is-in-active-mode). ## Onboard devices to Microsoft Defender ATP @@ -66,26 +66,22 @@ To verify that your onboarded devices are properly connected to Microsoft Defend |macOS
- 10.15 (Catalina)
- 10.14 (Mojave)
- 10.13 (High Sierra) |Download and use the DIY app at [https://aka.ms/mdatpmacosdiy](https://aka.ms/mdatpmacosdiy).

For more information, see [Microsoft Defender Advanced Threat Protection for Mac](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac). | |Linux:
- RHEL 7.2+
- CentOS Linux 7.2+
- Ubuntu 16 LTS, or higher LTS
- SLES 12+
- Debian 9+
- Oracle Linux 7.2 |1. Run the following command, and look for a result of **1**:
`mdatp health --field real_time_protection_enabled`.

2. Open a Terminal window, and run the following command:
`curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt`.

3. Run the following command to list any detected threats:
`mdatp threat list`.

For more information, see [Microsoft Defender ATP for Linux](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux). | -## Uninstall Symantec +## Uninstall McAfee -Now that you have onboarded your organization's devices to Microsoft Defender ATP, your next step is to uninstall Symantec. +Now that you have onboarded your organization's devices to Microsoft Defender ATP, your next step is to uninstall McAfee. -1. [Disable Tamper Protection](https://knowledge.broadcom.com/external/article?legacyId=tech192023) in Symantec. +1. [Disable Tamper Protection](https://knowledge.broadcom.com/external/article?legacyId=tech192023) in McAfee. -2. Delete the uninstall password for Symantec: +2. Delete the uninstall password for McAfee: 1. On your Windows devices, open Registry Editor as an administrator. - 2. Go to `HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC`. + 2. Go to `HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\McAfee Endpoint Protection\SMC`. 3. Look for an entry named **SmcInstData**. Right-click the item, and then choose **Delete**. -3. Remove Symantec from your devices. If you need help with this, see the following Broadcom resources: - - [Uninstall Symantec Endpoint Protection](https://knowledge.broadcom.com/external/article/156148/uninstall-symantec-endpoint-protection.html) - - Windows devices: [Manually uninstall Endpoint Protection 14 clients on Windows](https://knowledge.broadcom.com/external/article?articleId=170040) - - macOS computers: [Remove Symantec software for Mac using RemoveSymantecMacFiles](https://knowledge.broadcom.com/external/article?articleId=151387) - - Linux devices: [Frequently Asked Questions for Endpoint Protection for Linux](https://knowledge.broadcom.com/external/article?articleId=162054) +3. Remove McAfee from your devices. If you need help with this, see the following resources: ## Make sure Microsoft Defender ATP is in active mode -Now that you have uninstalled Symantec, your next step is to make sure that Microsoft Defender Antivirus and endpoint detection and response are enabled and in active mode. +Now that you have uninstalled McAfee, your next step is to make sure that Microsoft Defender Antivirus and endpoint detection and response are enabled and in active mode. To do this, visit the Microsoft Defender ATP demo scenarios site ([https://demo.wd.microsoft.com](https://demo.wd.microsoft.com)). Try one or more of the demo scenarios on that page, including at least the following: - Cloud-delivered protection @@ -94,7 +90,7 @@ To do this, visit the Microsoft Defender ATP demo scenarios site ([https://demo. ## Next steps -**Congratulations**! You have completed your [migration from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)! +**Congratulations**! You have completed your [migration from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)! - [Visit your security operations dashboard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard) in the Microsoft Defender Security Center ([https://aka.ms/MDATPportal](https://aka.ms/MDATPportal)). - [Manage Microsoft Defender Advanced Threat Protection, post migration](manage-atp-post-migration.md). From 331339314ff64a359a96e03c78ebdc8ea52aa4a4 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 20 Aug 2020 15:24:02 -0700 Subject: [PATCH 10/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 309ae74145..f7168fdc32 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -15,23 +15,23 @@ manager: dansimp audience: ITPro ms.collection: - M365-security-compliance -- m365solution-symantecmigrate +- m365solution-McAfeemigrate ms.topic: article --- # Migrate from McAfee - Phase 2: Set up Microsoft Defender ATP -|[![Phase 1: Prepare](images/prepare.png)](symantec-to-microsoft-defender-atp-prepare.md)
[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |![Phase 2: Set up](images/setup.png)
Phase 2: Set up |[![Phase 3: Onboard](images/onboard.png)](symantec-to-microsoft-defender-atp-onboard.md)
[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) | +|[![Phase 1: Prepare](images/prepare.png)](mcafee-to-microsoft-defender-prepare.md)
[Phase 1: Prepare](mcafee-to-microsoft-defender-prepare.md) |![Phase 2: Set up](images/setup.png)
Phase 2: Set up |[![Phase 3: Onboard](images/onboard.png)](mcafee-to-microsoft-defender-onboard.md)
[Phase 3: Onboard](mcafee-to-microsoft-defender-onboard.md) | |--|--|--| ||*You are here!* | | -**Welcome to the Setup phase of [migrating from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)**. This phase includes the following steps: +**Welcome to the Setup phase of [migrating from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This phase includes the following steps: 1. [Enable or reinstall Microsoft Defender Antivirus (for certain versions of Windows)](#enable-or-reinstall-microsoft-defender-antivirus-for-certain-versions-of-windows). 2. [Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus). -3. [Add Microsoft Defender ATP to the exclusion list for Symantec](#add-microsoft-defender-atp-to-the-exclusion-list-for-symantec). -4. [Add Symantec to the exclusion list for Microsoft Defender Antivirus](#add-symantec-to-the-exclusion-list-for-microsoft-defender-antivirus). -5. [Add Symantec to the exclusion list for Microsoft Defender ATP](#add-symantec-to-the-exclusion-list-for-microsoft-defender-atp). +3. [Add Microsoft Defender ATP to the exclusion list for McAfee](#add-microsoft-defender-atp-to-the-exclusion-list-for-McAfee). +4. [Add McAfee to the exclusion list for Microsoft Defender Antivirus](#add-McAfee-to-the-exclusion-list-for-microsoft-defender-antivirus). +5. [Add McAfee to the exclusion list for Microsoft Defender ATP](#add-McAfee-to-the-exclusion-list-for-microsoft-defender-atp). 6. [Set up your device groups, device collections, and organizational units](#set-up-your-device-groups-device-collections-and-organizational-units). 7. [Configure antimalware policies and real-time protection](#configure-antimalware-policies-and-real-time-protection). @@ -40,9 +40,9 @@ ms.topic: article > [!TIP] > If you're running Windows 10, you do not need to perform this task. Proceed to **[Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus)**. -On certain versions of Windows, Microsoft Defender Antivirus might have been uninstalled or disabled. This is because Microsoft Defender Antivirus does not enter passive or disabled mode when you install a third-party antivirus product, such as Symantec. To learn more, see [Microsoft Defender Antivirus compatibility](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility). +On certain versions of Windows, Microsoft Defender Antivirus might have been uninstalled or disabled. This is because Microsoft Defender Antivirus does not enter passive or disabled mode when you install a third-party antivirus product, such as McAfee. To learn more, see [Microsoft Defender Antivirus compatibility](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility). -Now that you're moving from Symantec to Microsoft Defender ATP, you'll need to enable or reinstall Microsoft Defender Antivirus, and set it to passive mode. +Now that you're moving from McAfee to Microsoft Defender ATP, you'll need to enable or reinstall Microsoft Defender Antivirus, and set it to passive mode. ### Reinstall Microsoft Defender Antivirus on Windows Server @@ -68,7 +68,7 @@ Now that you're moving from Symantec to Microsoft Defender ATP, you'll need to e ### Set Microsoft Defender Antivirus to passive mode on Windows Server -Because your organization is still using Symantec, you must set Microsoft Defender Antivirus to passive mode. That way, Symantec and Microsoft Defender Antivirus can run side by side until you have finished onboarding to Microsoft Defender ATP. +Because your organization is still using McAfee, you must set Microsoft Defender Antivirus to passive mode. That way, McAfee and Microsoft Defender Antivirus can run side by side until you have finished onboarding to Microsoft Defender ATP. 1. Open Registry Editor, and then navigate to
`Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Windows Advanced Threat Protection`. @@ -85,7 +85,7 @@ Because your organization is still using Symantec, you must set Microsoft Defend ## Enable Microsoft Defender Antivirus -Because your organization has been using Symantec as your primary antivirus solution, Microsoft Defender Antivirus is most likely disabled on your organization's Windows devices. This step of the migration process involves enabling Microsoft Defender Antivirus. +Because your organization has been using McAfee as your primary antivirus solution, Microsoft Defender Antivirus is most likely disabled on your organization's Windows devices. This step of the migration process involves enabling Microsoft Defender Antivirus. To enable Microsoft Defender Antivirus, we recommend using Intune. However, you can any of the methods that are listed in the following table: @@ -97,7 +97,7 @@ To enable Microsoft Defender Antivirus, we recommend using Intune. However, you ### Verify that Microsoft Defender Antivirus is in passive mode -Microsoft Defender Antivirus can run alongside Symantec if you set Microsoft Defender Antivirus to passive mode. You can use either Command Prompt or PowerShell to perform this task, as described in the following table: +Microsoft Defender Antivirus can run alongside McAfee if you set Microsoft Defender Antivirus to passive mode. You can use either Command Prompt or PowerShell to perform this task, as described in the following table: |Method |What to do | |---------|---------| @@ -107,18 +107,18 @@ Microsoft Defender Antivirus can run alongside Symantec if you set Microsoft Def > [!NOTE] > You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows. -## Add Microsoft Defender ATP to the exclusion list for Symantec +## Add Microsoft Defender ATP to the exclusion list for McAfee -This step of the setup process involves adding Microsoft Defender ATP to the exclusion list for Symantec and any other security products your organization is using. The specific exclusions to configure depend on which version of Windows your endpoints or devices are running, and are listed in the following table: +This step of the setup process involves adding Microsoft Defender ATP to the exclusion list for McAfee and any other security products your organization is using. The specific exclusions to configure depend on which version of Windows your endpoints or devices are running, and are listed in the following table: |OS |Exclusions | |--|--| |- Windows 10, [version 1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803) or later (See [Windows 10 release information](https://docs.microsoft.com/windows/release-information))
- Windows 10, version 1703 or [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709) with [KB4493441](https://support.microsoft.com/help/4493441) installed
- [Windows Server 2019](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019)
- [Windows Server, version 1803](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) |`C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe`

`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe`

`C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe`

`C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe`
| |- [Windows 8.1](https://docs.microsoft.com/windows/release-information/status-windows-8.1-and-windows-server-2012-r2)
- [Windows 7](https://docs.microsoft.com/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1)
- [Windows Server 2016](https://docs.microsoft.com/windows/release-information/status-windows-10-1607-and-windows-server-2016)
- [Windows Server 2012 R2](https://docs.microsoft.com/windows/release-information/status-windows-8.1-and-windows-server-2012-r2)
- [Windows Server 2008 R2 SP1](https://docs.microsoft.com/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1) |`C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 6\45\MsSenseS.exe`

**NOTE**: Where Monitoring Host Temporary Files 6\45 can be different numbered subfolders.

`C:\Program Files\Microsoft Monitoring Agent\Agent\AgentControlPanel.exe`

`C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe`

`C:\Program Files\Microsoft Monitoring Agent\Agent\HSLockdown.exe`

`C:\Program Files\Microsoft Monitoring Agent\Agent\MOMPerfSnapshotHelper.exe`

`C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe`

`C:\Program Files\Microsoft Monitoring Agent\Agent\TestCloudConnection.exe` | -## Add Symantec to the exclusion list for Microsoft Defender Antivirus +## Add McAfee to the exclusion list for Microsoft Defender Antivirus -During this step of the setup process, you add Symantec and your other security solutions to the Microsoft Defender Antivirus exclusion list. +During this step of the setup process, you add McAfee and your other security solutions to the Microsoft Defender Antivirus exclusion list. When you add [exclusions to Microsoft Defender Antivirus scans](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus), you should add path and process exclusions. Keep the following points in mind: - Path exclusions exclude specific files and whatever those files access. @@ -136,7 +136,7 @@ You can choose from several methods to add your exclusions to Microsoft Defender |Local group policy object |1. On the endpoint or device, open the Local Group Policy Editor.

2. Go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Exclusions**.
**NOTE**: You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows.

3. Specify your path and process exclusions. | |Registry key |1. Export the following registry key: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\exclusions`.

2. Import the registry key. Here are two examples:
- Local path: `regedit.exe /s c:\temp\ MDAV_Exclusion.reg`
- Network share: `regedit.exe /s \\FileServer\ShareName\MDAV_Exclusion.reg` | -## Add Symantec to the exclusion list for Microsoft Defender ATP +## Add McAfee to the exclusion list for Microsoft Defender ATP To add exclusions to Microsoft Defender ATP, you create [indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators#create-indicators-for-files). @@ -204,6 +204,6 @@ Using Configuration Manager and your device collection(s), configure your antima ## Next step -**Congratulations**! You have completed the Setup phase of [migrating from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)! +**Congratulations**! You have completed the Setup phase of [migrating from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)! -- [Proceed to Phase 3: Onboard to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-onboard.md) +- [Proceed to Phase 3: Onboard to Microsoft Defender ATP](mcafee-to-microsoft-defender-onboard.md) From 1b7c4c170ce2130d6649a5d42cfd4aa555ef744f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 10:12:24 -0700 Subject: [PATCH 11/46] Update mcafee-to-microsoft-defender-migration.md --- .../mcafee-to-microsoft-defender-migration.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md index afa5d9f08e..c328561e80 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md @@ -15,7 +15,7 @@ manager: dansimp audience: ITPro ms.collection: - M365-security-compliance -- m365solution-symantecmigrate +- m365solution-mcafeemigrate - m365solution-overview ms.topic: article --- @@ -31,8 +31,8 @@ When you switch from McAfee to Microsoft Defender ATP, you follow a process that |Phase |Description | |--|--| |[![Phase 1: Prepare](images/prepare.png)](mcafee-to-microsoft-defender-prepare.md)
[Prepare for your migration](mcafee-to-microsoft-defender-prepare.md) |During the **Prepare** phase, you get Microsoft Defender ATP, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender ATP. | -|[![Phase 2: Set up](images/setup.png)](mcafee-to-microsoft-defender-setup.md)
[Set up Microsoft Defender ATP](mcafee-to-microsoft-defender-setup.md) |During the **Setup** phase, you configure settings and exclusions for Microsoft Defender Antivirus, Microsoft Defender ATP, and Symantec Endpoint Protection. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.| -|[![Phase 3: Onboard](images/onboard.png)](mcafee-to-microsoft-defender-onboard.md)
[Onboard to Microsoft Defender ATP](mcafee-to-microsoft-defender-onboard.md) |During the **Onboard** phase, you onboard your devices to Microsoft Defender ATP and verify that those devices are communicating with Microsoft Defender ATP. Last, you uninstall Symantec and make sure protection through Microsoft Defender ATP is in active mode. | +|[![Phase 2: Set up](images/setup.png)](mcafee-to-microsoft-defender-setup.md)
[Set up Microsoft Defender ATP](mcafee-to-microsoft-defender-setup.md) |During the **Setup** phase, you configure settings and exclusions for Microsoft Defender Antivirus, Microsoft Defender ATP, and McAfee. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.| +|[![Phase 3: Onboard](images/onboard.png)](mcafee-to-microsoft-defender-onboard.md)
[Onboard to Microsoft Defender ATP](mcafee-to-microsoft-defender-onboard.md) |During the **Onboard** phase, you onboard your devices to Microsoft Defender ATP and verify that those devices are communicating with Microsoft Defender ATP. Last, you uninstall McAfee and make sure protection through Microsoft Defender ATP is in active mode. | ## What's included in Microsoft Defender ATP? From 346a0b5a6939a072a649b784e4e359191833b09f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 10:19:21 -0700 Subject: [PATCH 12/46] Update mcafee-to-microsoft-defender-prepare.md --- .../mcafee-to-microsoft-defender-prepare.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index aa726f53fb..1581ca1e64 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -15,7 +15,7 @@ manager: dansimp audience: ITPro ms.collection: - M365-security-compliance -- m365solution-McAfeemigrate +- m365solution-mcafeemigrate ms.topic: article --- From 7a29d952693a884c57b78e27da4a6eb0ace7d2f5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 10:25:38 -0700 Subject: [PATCH 13/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index f7168fdc32..ec1c6041f4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -15,7 +15,7 @@ manager: dansimp audience: ITPro ms.collection: - M365-security-compliance -- m365solution-McAfeemigrate +- m365solution-mcafeemigrate ms.topic: article --- @@ -109,7 +109,12 @@ Microsoft Defender Antivirus can run alongside McAfee if you set Microsoft Defen ## Add Microsoft Defender ATP to the exclusion list for McAfee -This step of the setup process involves adding Microsoft Defender ATP to the exclusion list for McAfee and any other security products your organization is using. The specific exclusions to configure depend on which version of Windows your endpoints or devices are running, and are listed in the following table: +This step of the setup process involves adding Microsoft Defender ATP to the exclusion list for McAfee and any other security products your organization is using. + +> [!TIP] +> To get help configuring exclusions, refer to McAfee documentation, such as the following article: [McAfee Endpoint Security 10.5.0 - Threat Prevention Module Product Guide (McAfee ePolicy Orchestrator) - Windows: Configuring exclusions](https://docs.mcafee.com/bundle/endpoint-security-10.5.0-threat-prevention-product-guide-epolicy-orchestrator-windows/page/GUID-71C5FB4B-A143-43E6-8BF0-8B2C16ABE6DA.html). + +The specific exclusions to configure depend on which version of Windows your endpoints or devices are running, and are listed in the following table: |OS |Exclusions | |--|--| From 03084e70d5abfcb0a6dd169902f0a2aaae79e965 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 10:37:19 -0700 Subject: [PATCH 14/46] Update mcafee-to-microsoft-defender-onboard.md --- .../mcafee-to-microsoft-defender-onboard.md | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md index 98fc71785a..8379669ce4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md @@ -70,14 +70,7 @@ To verify that your onboarded devices are properly connected to Microsoft Defend Now that you have onboarded your organization's devices to Microsoft Defender ATP, your next step is to uninstall McAfee. -1. [Disable Tamper Protection](https://knowledge.broadcom.com/external/article?legacyId=tech192023) in McAfee. - -2. Delete the uninstall password for McAfee: - 1. On your Windows devices, open Registry Editor as an administrator. - 2. Go to `HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\McAfee Endpoint Protection\SMC`. - 3. Look for an entry named **SmcInstData**. Right-click the item, and then choose **Delete**. - -3. Remove McAfee from your devices. If you need help with this, see the following resources: +To get help with this step, go to your McAfee support ServicePortal ([http://mysupport.mcafee.com](http://mysupport.mcafee.com)). ## Make sure Microsoft Defender ATP is in active mode From 27a8abc6cc88fae7aa6ec227c79723609cc4c977 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 11:10:39 -0700 Subject: [PATCH 15/46] McAfee guide --- .../mcafee-to-microsoft-defender-migration.md | 2 +- .../mcafee-to-microsoft-defender-onboard.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md index c328561e80..3743317c43 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md @@ -1,6 +1,6 @@ --- title: Migrate from McAfee to Microsoft Defender ATP -description: Make the switch from McAfee to Microsoft Defender ATP +description: Make the switch from McAfee to Microsoft Defender ATP. Read this article for an overview. keywords: migration, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh search.appverid: met150 diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md index 8379669ce4..94c3e54fff 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md @@ -1,6 +1,6 @@ --- title: Phase 3 - Onboard to Microsoft Defender ATP -description: Make the switch from McAfee to Microsoft Defender ATP +description: Switch from McAfee to onboard with Microsoft Defender ATP keywords: migration, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh search.appverid: met150 From 3f144e5a4aa803ab79b0174febfe1036c87325e6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 11:17:40 -0700 Subject: [PATCH 16/46] Update mcafee-to-microsoft-defender-onboard.md --- .../mcafee-to-microsoft-defender-onboard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md index 94c3e54fff..ceb5e5626d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md @@ -30,7 +30,7 @@ ms.topic: article 1. [Onboard devices to Microsoft Defender ATP](#onboard-devices-to-microsoft-defender-atp). 2. [Run a detection test](#run-a-detection-test). -3. [Uninstall McAfee](#uninstall-McAfee). +3. [Uninstall McAfee](#uninstall-mcafee). 4. [Make sure Microsoft Defender ATP is in active mode](#make-sure-microsoft-defender-atp-is-in-active-mode). ## Onboard devices to Microsoft Defender ATP From 3d2859317bbe823a52efda3b310d0c5da8eee4aa Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 11:18:35 -0700 Subject: [PATCH 17/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index ec1c6041f4..785b0240fb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -29,7 +29,7 @@ ms.topic: article **Welcome to the Setup phase of [migrating from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This phase includes the following steps: 1. [Enable or reinstall Microsoft Defender Antivirus (for certain versions of Windows)](#enable-or-reinstall-microsoft-defender-antivirus-for-certain-versions-of-windows). 2. [Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus). -3. [Add Microsoft Defender ATP to the exclusion list for McAfee](#add-microsoft-defender-atp-to-the-exclusion-list-for-McAfee). +3. [Add Microsoft Defender ATP to the exclusion list for McAfee](#add-microsoft-defender-atp-to-the-exclusion-list-for-mcafee). 4. [Add McAfee to the exclusion list for Microsoft Defender Antivirus](#add-McAfee-to-the-exclusion-list-for-microsoft-defender-antivirus). 5. [Add McAfee to the exclusion list for Microsoft Defender ATP](#add-McAfee-to-the-exclusion-list-for-microsoft-defender-atp). 6. [Set up your device groups, device collections, and organizational units](#set-up-your-device-groups-device-collections-and-organizational-units). From 279f04be8e6b81c13357bcf084e9001fa8b3315a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 11:19:40 -0700 Subject: [PATCH 18/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 785b0240fb..1a140ef682 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -30,8 +30,8 @@ ms.topic: article 1. [Enable or reinstall Microsoft Defender Antivirus (for certain versions of Windows)](#enable-or-reinstall-microsoft-defender-antivirus-for-certain-versions-of-windows). 2. [Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus). 3. [Add Microsoft Defender ATP to the exclusion list for McAfee](#add-microsoft-defender-atp-to-the-exclusion-list-for-mcafee). -4. [Add McAfee to the exclusion list for Microsoft Defender Antivirus](#add-McAfee-to-the-exclusion-list-for-microsoft-defender-antivirus). -5. [Add McAfee to the exclusion list for Microsoft Defender ATP](#add-McAfee-to-the-exclusion-list-for-microsoft-defender-atp). +4. [Add McAfee to the exclusion list for Microsoft Defender Antivirus](#add-mcafee-to-the-exclusion-list-for-microsoft-defender-antivirus). +5. [Add McAfee to the exclusion list for Microsoft Defender ATP](#add-mcafee-to-the-exclusion-list-for-microsoft-defender-atp). 6. [Set up your device groups, device collections, and organizational units](#set-up-your-device-groups-device-collections-and-organizational-units). 7. [Configure antimalware policies and real-time protection](#configure-antimalware-policies-and-real-time-protection). From 840afed6d5070beeee51cc1c6784e6407c160aea Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 11:26:37 -0700 Subject: [PATCH 19/46] Update mcafee-to-microsoft-defender-prepare.md --- .../mcafee-to-microsoft-defender-prepare.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index 1581ca1e64..ddaa912016 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -1,6 +1,6 @@ --- title: Phase 1 - Prepare for your migration to Microsoft Defender ATP -description: Phase 1 of "Make the switch from McAfee to Microsoft Defender ATP". Prepare for your migration. +description: This is phase 1, Prepare, for migrating from McAfee to Microsoft Defender ATP. keywords: migration, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh search.appverid: met150 From dd43b9d98fe6bacafd183c960f0c7000393bd925 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 11:27:50 -0700 Subject: [PATCH 20/46] description updates --- .../mcafee-to-microsoft-defender-onboard.md | 2 +- .../mcafee-to-microsoft-defender-setup.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md index ceb5e5626d..32b73cba74 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md @@ -1,6 +1,6 @@ --- title: Phase 3 - Onboard to Microsoft Defender ATP -description: Switch from McAfee to onboard with Microsoft Defender ATP +description: This is phase 3, Onboard, for migrating from McAfee to Microsoft Defender ATP. keywords: migration, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh search.appverid: met150 diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 1a140ef682..bee34bab98 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -1,6 +1,6 @@ --- title: Phase 2 - Set up Microsoft Defender ATP -description: Phase 2 - Set up Microsoft Defender ATP +description: This is phase 2, Setup, for migrating from McAfee to Microsoft Defender ATP. keywords: migration, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh search.appverid: met150 From 8b7416aa8de180e2ed40d95c9ff68f262c7ecb3d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 11:37:22 -0700 Subject: [PATCH 21/46] fixes --- .../mcafee-to-microsoft-defender-prepare.md | 2 +- .../mcafee-to-microsoft-defender-setup.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index ddaa912016..f1adcc29e7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -1,5 +1,5 @@ --- -title: Phase 1 - Prepare for your migration to Microsoft Defender ATP +title: McAfee to Microsoft Defender ATP - Prepare description: This is phase 1, Prepare, for migrating from McAfee to Microsoft Defender ATP. keywords: migration, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index bee34bab98..8c931fd2ba 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -1,5 +1,5 @@ --- -title: Phase 2 - Set up Microsoft Defender ATP +title: McAfee to Microsoft Defender ATP - Setup description: This is phase 2, Setup, for migrating from McAfee to Microsoft Defender ATP. keywords: migration, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh From daa08ebbe41a804a8723a4182252e85938a9f264 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 11:39:03 -0700 Subject: [PATCH 22/46] Update mcafee-to-microsoft-defender-onboard.md --- .../mcafee-to-microsoft-defender-onboard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md index 32b73cba74..b75ea590b3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md @@ -1,5 +1,5 @@ --- -title: Phase 3 - Onboard to Microsoft Defender ATP +title: McAfee to Microsoft Defender ATP - Onboard description: This is phase 3, Onboard, for migrating from McAfee to Microsoft Defender ATP. keywords: migration, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh From 736089bfbc8b671b8ec20e989dc0f6dec4d21260 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 26 Aug 2020 11:48:42 -0700 Subject: [PATCH 23/46] Update TOC.md --- windows/security/threat-protection/TOC.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 899166a16a..ea322e5231 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -21,6 +21,11 @@ ### [Phase 3: Onboard](microsoft-defender-atp/onboarding.md) ## [Migration guides]() +### [Switch from McAfee to Microsoft Defender ATP]() +#### [Get an overview of migration](microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md) +#### [Prepare for your migration](microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md) +#### [Set up Microsoft Defender ATP](microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md) +#### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md) ### [Switch from Symantec to Microsoft Defender ATP]() #### [Get an overview of migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md) #### [Prepare for your migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md) From fb48807f7b5276a76c7e4b844447067fe20b1172 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 3 Sep 2020 12:40:36 -0700 Subject: [PATCH 24/46] metadata --- .../mcafee-to-microsoft-defender-migration.md | 2 ++ .../mcafee-to-microsoft-defender-onboard.md | 2 ++ .../mcafee-to-microsoft-defender-prepare.md | 2 ++ .../mcafee-to-microsoft-defender-setup.md | 2 ++ 4 files changed, 8 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md index 3743317c43..d7ab137a8a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md @@ -18,6 +18,8 @@ ms.collection: - m365solution-mcafeemigrate - m365solution-overview ms.topic: article +ms.date: 09/03/2020 +ms.reviewer: jesquive, chventou, jonix, chriggs, owtho --- # Migrate from McAfee to Microsoft Defender Advanced Threat Protection diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md index b75ea590b3..addfffa8be 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md @@ -17,6 +17,8 @@ ms.collection: - M365-security-compliance - m365solution-McAfeemigrate ms.topic: article +ms.date: 09/03/2020 +ms.reviewer: jesquive, chventou, jonix, chriggs, owtho --- # Migrate from McAfee - Phase 3: Onboard to Microsoft Defender ATP diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index f1adcc29e7..2a2b2776cb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -17,6 +17,8 @@ ms.collection: - M365-security-compliance - m365solution-mcafeemigrate ms.topic: article +ms.date: 09/03/2020 +ms.reviewer: jesquive, chventou, jonix, chriggs, owtho --- # Migrate from McAfee - Phase 1: Prepare for your migration diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 8c931fd2ba..71c4777eaf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -17,6 +17,8 @@ ms.collection: - M365-security-compliance - m365solution-mcafeemigrate ms.topic: article +ms.date: 09/03/2020 +ms.reviewer: jesquive, chventou, jonix, chriggs, owtho --- # Migrate from McAfee - Phase 2: Set up Microsoft Defender ATP From 7b09d980ac14f93d1cd39721792cef0f57fcae97 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 09:55:08 -0700 Subject: [PATCH 25/46] metadata for migration guides --- .../manage-atp-post-migration-configuration-manager.md | 2 ++ .../manage-atp-post-migration-group-policy-objects.md | 2 ++ .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 ++ .../manage-atp-post-migration-other-tools.md | 2 ++ .../microsoft-defender-atp/manage-atp-post-migration.md | 2 ++ 5 files changed, 10 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 022658e40b..1200b24369 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -15,6 +15,8 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article +ms.date: 09/04/2020 +ms.reviewer: chventou --- # Manage Microsoft Defender Advanced Threat Protection with Configuration Manager diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 1e7317f3e8..299b6b807e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -15,6 +15,8 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article +ms.date: 09/04/2020 +ms.reviewer: chventou --- # Manage Microsoft Defender Advanced Threat Protection with Group Policy Objects diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 6801853a3f..43b5a8c70c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -15,6 +15,8 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article +ms.date: 09/04/2020 +ms.reviewer: chventou --- # Manage Microsoft Defender Advanced Threat Protection with Intune diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 245b969459..8629492da7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -15,6 +15,8 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article +ms.date: 09/04/2020 +ms.reviewer: chventou --- # Manage Microsoft Defender Advanced Threat Protection with PowerShell, WMI, and MPCmdRun.exe diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index f716c99579..9a214694df 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -15,6 +15,8 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article +ms.date: 09/04/2020 +ms.reviewer: chventou --- # Manage Microsoft Defender Advanced Threat Protection, post migration From af2b025ef22c46fe367992b5b2f9e4fc4dcd1128 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 10:00:14 -0700 Subject: [PATCH 26/46] metadata for migration guides --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- .../mcafee-to-microsoft-defender-migration.md | 2 +- .../symantec-to-microsoft-defender-atp-migration.md | 4 +++- .../symantec-to-microsoft-defender-atp-onboard.md | 2 ++ .../symantec-to-microsoft-defender-atp-prepare.md | 2 ++ .../symantec-to-microsoft-defender-atp-setup.md | 2 ++ 6 files changed, 11 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 9a214694df..f06086dbc1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -14,7 +14,7 @@ ms.localizationpriority: medium manager: dansimp audience: ITPro ms.collection: M365-security-compliance -ms.topic: article +ms.topic: conceptual ms.date: 09/04/2020 ms.reviewer: chventou --- diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md index d7ab137a8a..2021fb1a37 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md @@ -17,7 +17,7 @@ ms.collection: - M365-security-compliance - m365solution-mcafeemigrate - m365solution-overview -ms.topic: article +ms.topic: conceptual ms.date: 09/03/2020 ms.reviewer: jesquive, chventou, jonix, chriggs, owtho --- diff --git a/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md b/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md index 9e26a9fef5..121b141f1d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md @@ -17,7 +17,9 @@ ms.collection: - M365-security-compliance - m365solution-symantecmigrate - m365solution-overview -ms.topic: article +ms.topic: conceptual +ms.date: 09/04/2020 +ms.reviewer: depicker, yongrhee, chriggs --- # Migrate from Symantec to Microsoft Defender Advanced Threat Protection diff --git a/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md b/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md index 6c7c329a2e..87f80f841f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md @@ -17,6 +17,8 @@ ms.collection: - M365-security-compliance - m365solution-symantecmigrate ms.topic: article +ms.date: 09/04/2020 +ms.reviewer: depicker, yongrhee, chriggs --- # Migrate from Symantec - Phase 3: Onboard to Microsoft Defender ATP diff --git a/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md index 2a678e94e4..a983531f0c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md @@ -17,6 +17,8 @@ ms.collection: - M365-security-compliance - m365solution-symantecmigrate ms.topic: article +ms.date: 09/04/2020 +ms.reviewer: depicker, yongrhee, chriggs --- # Migrate from Symantec - Phase 1: Prepare for your migration diff --git a/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md b/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md index a3c0638d1e..e3dd61e48d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md @@ -17,6 +17,8 @@ ms.collection: - M365-security-compliance - m365solution-symantecmigrate ms.topic: article +ms.date: 09/04/2020 +ms.reviewer: depicker, yongrhee, chriggs --- # Migrate from Symantec - Phase 2: Set up Microsoft Defender ATP From e4803449c464bbe851660f10109ed4e590703ea2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 10:15:52 -0700 Subject: [PATCH 27/46] Update mcafee-to-microsoft-defender-prepare.md --- .../mcafee-to-microsoft-defender-prepare.md | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index 2a2b2776cb..018f28f54e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -31,9 +31,20 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho **Welcome to the Prepare phase of [migrating from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This migration phase includes the following steps: -1. [Get Microsoft Defender ATP](#get-microsoft-defender-atp). -2. [Grant access to the Microsoft Defender Security Center](#grant-access-to-the-microsoft-defender-security-center). -3. [Configure device proxy and internet connectivity settings](#configure-device-proxy-and-internet-connectivity-settings). +1. +2. [Get Microsoft Defender ATP](#get-microsoft-defender-atp). +3. [Grant access to the Microsoft Defender Security Center](#grant-access-to-the-microsoft-defender-security-center). +4. [Configure device proxy and internet connectivity settings](#configure-device-proxy-and-internet-connectivity-settings). + +## Make sure your McAfee solution is up to date + +Before you begin to prepare for Microsoft Defender ATP and Microsoft Defender Antivirus, make sure McAfee Endpoint Security (McAfee) is up to date. Make sure your organization's devices have the latest security updates. To learn more, see the following resources: + +- [McAfee Enterprise Product Documentation: How Endpoint Security Works](https://docs.mcafee.com/bundle/endpoint-security-10.7.x-common-product-guide-windows/page/GUID-1207FF39-D1D2-481F-BBD9-E4079112A8DD.html) + +- [McAfee Knowledge Center Technical Article: Windows Security Center intermittently incorrectly reports that Endpoint Security is disabled when running on Windows 10](https://kc.mcafee.com/corporate/index?page=content&id=KB91830) + +- [McAfee Knowledge Center Technical Article: Windows Security Center reports Endpoint Security is disabled when Endpoint Security is running](https://kc.mcafee.com/corporate/index?page=content&id=KB91428) ## Get Microsoft Defender ATP From 0dabaf8d0254a160f36a2a7cdd2b093b8be57d0e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 10:17:30 -0700 Subject: [PATCH 28/46] Update mcafee-to-microsoft-defender-prepare.md --- .../mcafee-to-microsoft-defender-prepare.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index 018f28f54e..8fe5f3729f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -31,14 +31,14 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho **Welcome to the Prepare phase of [migrating from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This migration phase includes the following steps: -1. +1. [Make sure your McAfee solution is up to date](#make-sure-your-mcafee-solution-is-up-to-date) 2. [Get Microsoft Defender ATP](#get-microsoft-defender-atp). 3. [Grant access to the Microsoft Defender Security Center](#grant-access-to-the-microsoft-defender-security-center). 4. [Configure device proxy and internet connectivity settings](#configure-device-proxy-and-internet-connectivity-settings). ## Make sure your McAfee solution is up to date -Before you begin to prepare for Microsoft Defender ATP and Microsoft Defender Antivirus, make sure McAfee Endpoint Security (McAfee) is up to date. Make sure your organization's devices have the latest security updates. To learn more, see the following resources: +Before you begin to prepare for Microsoft Defender ATP and Microsoft Defender Antivirus, make sure McAfee Endpoint Security (McAfee) is up to date. Make sure your organization's devices have the latest security updates. Need help? Here are a few McAfee resources: - [McAfee Enterprise Product Documentation: How Endpoint Security Works](https://docs.mcafee.com/bundle/endpoint-security-10.7.x-common-product-guide-windows/page/GUID-1207FF39-D1D2-481F-BBD9-E4079112A8DD.html) @@ -46,6 +46,9 @@ Before you begin to prepare for Microsoft Defender ATP and Microsoft Defender An - [McAfee Knowledge Center Technical Article: Windows Security Center reports Endpoint Security is disabled when Endpoint Security is running](https://kc.mcafee.com/corporate/index?page=content&id=KB91428) +> [!NOTE] +> McAfee documentation links are included in this guide; however, Microsoft makes no warranties or promises for accuracy. + ## Get Microsoft Defender ATP To get started, you must have Microsoft Defender ATP, with licenses assigned and provisioned. From 79fc16ba8f2ba26dcbb62cea713b7e172a73283e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 10:18:08 -0700 Subject: [PATCH 29/46] Update mcafee-to-microsoft-defender-prepare.md --- .../mcafee-to-microsoft-defender-prepare.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index 8fe5f3729f..bef5eb5c85 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -46,9 +46,6 @@ Before you begin to prepare for Microsoft Defender ATP and Microsoft Defender An - [McAfee Knowledge Center Technical Article: Windows Security Center reports Endpoint Security is disabled when Endpoint Security is running](https://kc.mcafee.com/corporate/index?page=content&id=KB91428) -> [!NOTE] -> McAfee documentation links are included in this guide; however, Microsoft makes no warranties or promises for accuracy. - ## Get Microsoft Defender ATP To get started, you must have Microsoft Defender ATP, with licenses assigned and provisioned. From 8b5f12b42784defa98b9ab198aa90b6ee848681f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 10:20:09 -0700 Subject: [PATCH 30/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 71c4777eaf..4de7a49217 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -28,7 +28,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho ||*You are here!* | | -**Welcome to the Setup phase of [migrating from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This phase includes the following steps: +**Welcome to the Setup phase of [migrating from McAfee Endpoint Security (McAfee) to Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This phase includes the following steps: 1. [Enable or reinstall Microsoft Defender Antivirus (for certain versions of Windows)](#enable-or-reinstall-microsoft-defender-antivirus-for-certain-versions-of-windows). 2. [Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus). 3. [Add Microsoft Defender ATP to the exclusion list for McAfee](#add-microsoft-defender-atp-to-the-exclusion-list-for-mcafee). From 7e840c97e2db3ad8ef8678d6048d8f643377c021 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 10:21:02 -0700 Subject: [PATCH 31/46] Update mcafee-to-microsoft-defender-onboard.md --- .../mcafee-to-microsoft-defender-onboard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md index addfffa8be..4b65da3b72 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md @@ -28,7 +28,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho || |*You are here!* | -**Welcome to Phase 3 of [migrating from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This migration phase includes the following steps: +**Welcome to Phase 3 of [migrating from McAfee Endpoint Security (McAfee) to Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This migration phase includes the following steps: 1. [Onboard devices to Microsoft Defender ATP](#onboard-devices-to-microsoft-defender-atp). 2. [Run a detection test](#run-a-detection-test). From ad6c9184c0f777e592edeb70d73052b87bb30779 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 10:21:40 -0700 Subject: [PATCH 32/46] Update mcafee-to-microsoft-defender-prepare.md --- .../mcafee-to-microsoft-defender-prepare.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index bef5eb5c85..f43d565825 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -28,7 +28,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho |*You are here!*| | | -**Welcome to the Prepare phase of [migrating from McAfee to Microsoft Defender ATP](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. +**Welcome to the Prepare phase of [migrating from McAfee Endpoint Security (McAfee) to Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This migration phase includes the following steps: 1. [Make sure your McAfee solution is up to date](#make-sure-your-mcafee-solution-is-up-to-date) From 108729e8469201c9512d1f23996190c0e9fb5ec3 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 10:48:17 -0700 Subject: [PATCH 33/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 4de7a49217..52ff20bf93 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -29,7 +29,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho **Welcome to the Setup phase of [migrating from McAfee Endpoint Security (McAfee) to Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This phase includes the following steps: -1. [Enable or reinstall Microsoft Defender Antivirus (for certain versions of Windows)](#enable-or-reinstall-microsoft-defender-antivirus-for-certain-versions-of-windows). +1. [Enable or reinstall Microsoft Defender Antivirus (for certain versions of Windows Server)](#enable-or-reinstall-microsoft-defender-antivirus-for-certain-versions-of-windows). 2. [Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus). 3. [Add Microsoft Defender ATP to the exclusion list for McAfee](#add-microsoft-defender-atp-to-the-exclusion-list-for-mcafee). 4. [Add McAfee to the exclusion list for Microsoft Defender Antivirus](#add-mcafee-to-the-exclusion-list-for-microsoft-defender-antivirus). @@ -37,14 +37,11 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho 6. [Set up your device groups, device collections, and organizational units](#set-up-your-device-groups-device-collections-and-organizational-units). 7. [Configure antimalware policies and real-time protection](#configure-antimalware-policies-and-real-time-protection). -## Enable or reinstall Microsoft Defender Antivirus (for certain versions of Windows) +## Enable Microsoft Defender Antivirus and set it to passive mode -> [!TIP] -> If you're running Windows 10, you do not need to perform this task. Proceed to **[Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus)**. +On certain versions of Windows, such as Windows Server, Microsoft Defender Antivirus might have been uninstalled or disabled when your McAfee solution was installed. This is because Microsoft Defender Antivirus does not enter passive or disabled mode when you install a third-party antivirus product, such as McAfee. (To learn more about this, see [Microsoft Defender Antivirus compatibility](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility).) -On certain versions of Windows, Microsoft Defender Antivirus might have been uninstalled or disabled. This is because Microsoft Defender Antivirus does not enter passive or disabled mode when you install a third-party antivirus product, such as McAfee. To learn more, see [Microsoft Defender Antivirus compatibility](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility). - -Now that you're moving from McAfee to Microsoft Defender ATP, you'll need to enable or reinstall Microsoft Defender Antivirus, and set it to passive mode. +This step of the migration process involves reinstalling Microsoft Defender Antivirus on Windows Server, enabling Microsoft Defender Antivirus on your Windows client devices, and setting Microsoft Defender Antivirus to passive mode. ### Reinstall Microsoft Defender Antivirus on Windows Server @@ -54,7 +51,7 @@ Now that you're moving from McAfee to Microsoft Defender ATP, you'll need to ena > - Windows Server, version 1803 (core-only mode) > - Windows Server 2016 > -> Microsoft Defender Antivirus is built into Windows 10, but it might be disabled. In this case, proceed to [Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus). +> Microsoft Defender Antivirus is built into Windows 10, but it might be disabled. In this case, see [Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus). 1. As a local administrator on the endpoint or device, open Windows PowerShell. @@ -85,7 +82,7 @@ Because your organization is still using McAfee, you must set Microsoft Defender >- [Local Group Policy Object tool](https://docs.microsoft.com/windows/security/threat-protection/security-compliance-toolkit-10#what-is-the-local-group-policy-object-lgpo-tool) >- [A package in Configuration Manager](https://docs.microsoft.com/mem/configmgr/apps/deploy-use/packages-and-programs) -## Enable Microsoft Defender Antivirus +## Enable Microsoft Defender Antivirus on your Windows client devices Because your organization has been using McAfee as your primary antivirus solution, Microsoft Defender Antivirus is most likely disabled on your organization's Windows devices. This step of the migration process involves enabling Microsoft Defender Antivirus. From 0fcc37d99d30014d91eec363b6b0cc8351cabf11 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 10:52:22 -0700 Subject: [PATCH 34/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 52ff20bf93..c0de5bd13e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -29,19 +29,21 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho **Welcome to the Setup phase of [migrating from McAfee Endpoint Security (McAfee) to Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This phase includes the following steps: -1. [Enable or reinstall Microsoft Defender Antivirus (for certain versions of Windows Server)](#enable-or-reinstall-microsoft-defender-antivirus-for-certain-versions-of-windows). -2. [Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus). -3. [Add Microsoft Defender ATP to the exclusion list for McAfee](#add-microsoft-defender-atp-to-the-exclusion-list-for-mcafee). -4. [Add McAfee to the exclusion list for Microsoft Defender Antivirus](#add-mcafee-to-the-exclusion-list-for-microsoft-defender-antivirus). -5. [Add McAfee to the exclusion list for Microsoft Defender ATP](#add-mcafee-to-the-exclusion-list-for-microsoft-defender-atp). -6. [Set up your device groups, device collections, and organizational units](#set-up-your-device-groups-device-collections-and-organizational-units). -7. [Configure antimalware policies and real-time protection](#configure-antimalware-policies-and-real-time-protection). +1. [Enable Microsoft Defender Antivirus and confirm it's in passive mode](#enable-microsoft-defender-antivirus-and-confirm-its-in-passive-mode). +2. [Add Microsoft Defender ATP to the exclusion list for McAfee](#add-microsoft-defender-atp-to-the-exclusion-list-for-mcafee). +3. [Add McAfee to the exclusion list for Microsoft Defender Antivirus](#add-mcafee-to-the-exclusion-list-for-microsoft-defender-antivirus). +4. [Add McAfee to the exclusion list for Microsoft Defender ATP](#add-mcafee-to-the-exclusion-list-for-microsoft-defender-atp). +5. [Set up your device groups, device collections, and organizational units](#set-up-your-device-groups-device-collections-and-organizational-units). +6. [Configure antimalware policies and real-time protection](#configure-antimalware-policies-and-real-time-protection). -## Enable Microsoft Defender Antivirus and set it to passive mode +## Enable Microsoft Defender Antivirus and confirm it's in passive mode On certain versions of Windows, such as Windows Server, Microsoft Defender Antivirus might have been uninstalled or disabled when your McAfee solution was installed. This is because Microsoft Defender Antivirus does not enter passive or disabled mode when you install a third-party antivirus product, such as McAfee. (To learn more about this, see [Microsoft Defender Antivirus compatibility](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility).) -This step of the migration process involves reinstalling Microsoft Defender Antivirus on Windows Server, enabling Microsoft Defender Antivirus on your Windows client devices, and setting Microsoft Defender Antivirus to passive mode. +This step of the migration process includes the following tasks: +- [Reinstalling Microsoft Defender Antivirus on Windows Server](#reinstall-microsoft-defender-antivirus-on-windows-server); +- Enabling Microsoft Defender Antivirus on your Windows client devices; and +- Confirming that Microsoft Defender Antivirus is set to passive mode. ### Reinstall Microsoft Defender Antivirus on Windows Server @@ -50,8 +52,6 @@ This step of the migration process involves reinstalling Microsoft Defender Anti > - Windows Server 2019 > - Windows Server, version 1803 (core-only mode) > - Windows Server 2016 -> -> Microsoft Defender Antivirus is built into Windows 10, but it might be disabled. In this case, see [Enable Microsoft Defender Antivirus](#enable-microsoft-defender-antivirus). 1. As a local administrator on the endpoint or device, open Windows PowerShell. @@ -82,7 +82,7 @@ Because your organization is still using McAfee, you must set Microsoft Defender >- [Local Group Policy Object tool](https://docs.microsoft.com/windows/security/threat-protection/security-compliance-toolkit-10#what-is-the-local-group-policy-object-lgpo-tool) >- [A package in Configuration Manager](https://docs.microsoft.com/mem/configmgr/apps/deploy-use/packages-and-programs) -## Enable Microsoft Defender Antivirus on your Windows client devices +### Enable Microsoft Defender Antivirus on your Windows client devices Because your organization has been using McAfee as your primary antivirus solution, Microsoft Defender Antivirus is most likely disabled on your organization's Windows devices. This step of the migration process involves enabling Microsoft Defender Antivirus. From 7b8fbdebd8fb0723b53da33803d77326bb756620 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 10:58:47 -0700 Subject: [PATCH 35/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index c0de5bd13e..9befe29754 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -41,9 +41,10 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho On certain versions of Windows, such as Windows Server, Microsoft Defender Antivirus might have been uninstalled or disabled when your McAfee solution was installed. This is because Microsoft Defender Antivirus does not enter passive or disabled mode when you install a third-party antivirus product, such as McAfee. (To learn more about this, see [Microsoft Defender Antivirus compatibility](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility).) This step of the migration process includes the following tasks: -- [Reinstalling Microsoft Defender Antivirus on Windows Server](#reinstall-microsoft-defender-antivirus-on-windows-server); -- Enabling Microsoft Defender Antivirus on your Windows client devices; and -- Confirming that Microsoft Defender Antivirus is set to passive mode. +- [Reinstalling Microsoft Defender Antivirus on Windows Server](#reinstall-microsoft-defender-antivirus-on-windows-server); +- [Setting Microsoft Defender Antivirus to passive mode on Windows Server](#set-microsoft-defender-antivirus-to-passive-mode-on-windows-server) +- [Enabling Microsoft Defender Antivirus on your Windows client devices](#enable-microsoft-defender-antivirus-on-your-windows-client-devices); and +- [Confirming that Microsoft Defender Antivirus is set to passive mode](#confirm-that-microsoft-defender-antivirus-is-in-passive-mode). ### Reinstall Microsoft Defender Antivirus on Windows Server @@ -94,7 +95,7 @@ To enable Microsoft Defender Antivirus, we recommend using Intune. However, you |Control Panel in Windows |Follow the guidance here: [Turn on Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/user-help/turn-on-defender-windows).

**NOTE**: You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows. | |[Advanced Group Policy Management](https://docs.microsoft.com/microsoft-desktop-optimization-pack/agpm/)
or
[Group Policy Management Console](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus) |1. Go to `Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus`.

2. Look for a policy called **Turn off Microsoft Defender Antivirus**.

3. Choose **Edit policy setting**, and make sure that policy is disabled. This enables Microsoft Defender Antivirus.

**NOTE**: You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows. | -### Verify that Microsoft Defender Antivirus is in passive mode +### Confirm that Microsoft Defender Antivirus is in passive mode Microsoft Defender Antivirus can run alongside McAfee if you set Microsoft Defender Antivirus to passive mode. You can use either Command Prompt or PowerShell to perform this task, as described in the following table: From 46df5f75a793fc14a16ad0b6b2bc011ca861ec0e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 12:29:46 -0700 Subject: [PATCH 36/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 24 ++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 9befe29754..f3398db1b3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -41,11 +41,33 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho On certain versions of Windows, such as Windows Server, Microsoft Defender Antivirus might have been uninstalled or disabled when your McAfee solution was installed. This is because Microsoft Defender Antivirus does not enter passive or disabled mode when you install a third-party antivirus product, such as McAfee. (To learn more about this, see [Microsoft Defender Antivirus compatibility](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility).) This step of the migration process includes the following tasks: +- [Setting DisableAntiSpyware to false on Windows Server](#set-disableantispyware-to-false-on-windows-server) - [Reinstalling Microsoft Defender Antivirus on Windows Server](#reinstall-microsoft-defender-antivirus-on-windows-server); -- [Setting Microsoft Defender Antivirus to passive mode on Windows Server](#set-microsoft-defender-antivirus-to-passive-mode-on-windows-server) +- [Setting Microsoft Defender Antivirus to passive mode on Windows Server](#set-microsoft-defender-antivirus-to-passive-mode-on-windows-server) - [Enabling Microsoft Defender Antivirus on your Windows client devices](#enable-microsoft-defender-antivirus-on-your-windows-client-devices); and - [Confirming that Microsoft Defender Antivirus is set to passive mode](#confirm-that-microsoft-defender-antivirus-is-in-passive-mode). +### Set DisableAntiSpyware to false on Windows Server + +The [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware) registry key was used in the past to disable Microsoft Defender Antivirus, and deploy another antivirus product, such as McAfee. In general, you should not have this registry key on your Windows devices and endpoints; however, here's how to make sure `DisableAntiSpyware` is set to false. + +1. On your Windows Server device, open Registry Editor. + +2. Navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender`. + +3. In that folder, look for a DWORD entry called **DisableAntiSpyware**. + + - If you do not see that entry, you're all set. + + - If you do see **DisableAntiSpyware**, proceed to step 4. + +4. Right-click the DisableAntiSpyware DWORD, and then choose **Modify**. + +5. Set the value to `0`. (This sets the registry key's value to *false*.) + +> [!TIP] +> To learn more, see [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware). + ### Reinstall Microsoft Defender Antivirus on Windows Server > [!NOTE] From 2ddd7283c002980a16ca612c581cb47a2e0e9766 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 12:30:17 -0700 Subject: [PATCH 37/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index f3398db1b3..6401b8ce70 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -68,6 +68,8 @@ The [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/d > [!TIP] > To learn more, see [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware). +Proceed to the next task (reinstalling Microsoft Defender Antivirus). + ### Reinstall Microsoft Defender Antivirus on Windows Server > [!NOTE] From d312aea16c74ae620cb9cfd5f04f31120277838f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 12:41:22 -0700 Subject: [PATCH 38/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 6401b8ce70..5ade8249ed 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -49,7 +49,7 @@ This step of the migration process includes the following tasks: ### Set DisableAntiSpyware to false on Windows Server -The [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware) registry key was used in the past to disable Microsoft Defender Antivirus, and deploy another antivirus product, such as McAfee. In general, you should not have this registry key on your Windows devices and endpoints; however, here's how to make sure `DisableAntiSpyware` is set to false. +The [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware) registry key was used in the past to disable Microsoft Defender Antivirus, and deploy another antivirus product, such as McAfee. In general, you should not have this registry key on your Windows devices and endpoints; however, if you do have `DisableAntiSpyware` configured, here's how to set its value to false: 1. On your Windows Server device, open Registry Editor. @@ -66,7 +66,7 @@ The [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/d 5. Set the value to `0`. (This sets the registry key's value to *false*.) > [!TIP] -> To learn more, see [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware). +> To learn more about this registry key, see [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware). Proceed to the next task (reinstalling Microsoft Defender Antivirus). From f679b49b3eeb46344762658897c6e7947b46f2cc Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 12:54:54 -0700 Subject: [PATCH 39/46] edits per feedback --- .../mcafee-to-microsoft-defender-prepare.md | 14 +++++++++++--- .../mcafee-to-microsoft-defender-setup.md | 5 +++++ 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index f43d565825..716095abe1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -31,14 +31,18 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho **Welcome to the Prepare phase of [migrating from McAfee Endpoint Security (McAfee) to Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This migration phase includes the following steps: -1. [Make sure your McAfee solution is up to date](#make-sure-your-mcafee-solution-is-up-to-date) +1. [Get and deploy updates across your organization's devices](#get-and-deploy-updates-across-your-organizations-devices) 2. [Get Microsoft Defender ATP](#get-microsoft-defender-atp). 3. [Grant access to the Microsoft Defender Security Center](#grant-access-to-the-microsoft-defender-security-center). 4. [Configure device proxy and internet connectivity settings](#configure-device-proxy-and-internet-connectivity-settings). -## Make sure your McAfee solution is up to date +## Get and deploy updates across your organization's devices -Before you begin to prepare for Microsoft Defender ATP and Microsoft Defender Antivirus, make sure McAfee Endpoint Security (McAfee) is up to date. Make sure your organization's devices have the latest security updates. Need help? Here are a few McAfee resources: +As a best practice, keep your organization's devices and endpoints up to date. Make sure your McAfee Endpoint Security (McAfee) solution is up to date, and that the operating systems and apps your organization is also have the latest updates. Doing this now can help prevent problems later as you migrate to Microsoft Defender ATP and Microsoft Defender Antivirus. + +### Make sure your McAfee solution is up to date + +Keep McAfee up to date, and make sure that your organization's devices have the latest security updates. Need help? Here are some McAfee resources: - [McAfee Enterprise Product Documentation: How Endpoint Security Works](https://docs.mcafee.com/bundle/endpoint-security-10.7.x-common-product-guide-windows/page/GUID-1207FF39-D1D2-481F-BBD9-E4079112A8DD.html) @@ -46,6 +50,10 @@ Before you begin to prepare for Microsoft Defender ATP and Microsoft Defender An - [McAfee Knowledge Center Technical Article: Windows Security Center reports Endpoint Security is disabled when Endpoint Security is running](https://kc.mcafee.com/corporate/index?page=content&id=KB91428) +- Your McAfee support ServicePortal ([http://mysupport.mcafee.com](http://mysupport.mcafee.com)) + +### Make sure your organization's devices are up to date + ## Get Microsoft Defender ATP To get started, you must have Microsoft Defender ATP, with licenses assigned and provisioned. diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 5ade8249ed..41b1659ef0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -81,10 +81,13 @@ Proceed to the next task (reinstalling Microsoft Defender Antivirus). 1. As a local administrator on the endpoint or device, open Windows PowerShell. 2. Run the following PowerShell cmdlets:
+ `Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features`
+ `Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`
3. To verify Microsoft Defender Antivirus is running, use the following PowerShell cmdlet:
+ `Get-Service -Name windefend` > [!TIP] @@ -98,7 +101,9 @@ Because your organization is still using McAfee, you must set Microsoft Defender `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Windows Advanced Threat Protection`. 2. Edit (or create) a DWORD entry called **ForceDefenderPassiveMode**, and specify the following settings: + - Set the DWORD's value to **1**. + - Under **Base**, select **Hexadecimal**. > [!NOTE] From 0ae12656506b94c43c8d88309b5d4054560fe5e7 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 13:05:36 -0700 Subject: [PATCH 40/46] Update mcafee-to-microsoft-defender-prepare.md --- .../mcafee-to-microsoft-defender-prepare.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index 716095abe1..86b4f89c0a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -54,9 +54,21 @@ Keep McAfee up to date, and make sure that your organization's devices have the ### Make sure your organization's devices are up to date +Need help updating your organization's devices? See the following resources: + +- For Windows devices, see [Microsoft Update](https://www.update.microsoft.com) + +- For macOS devices, see [How to update the software on your Mac](https://support.apple.com/HT201541) + +- For iOS devices, see [Update your iPhone, iPad, or iPod touch](https://support.apple.com/HT204204) + +- For Android devices, see [Check & update your Android version](https://support.google.com/android/answer/7680439) + +- For Linux devices, see [Linux 101: Updating Your System](https://www.linux.com/training-tutorials/linux-101-updating-your-system) + ## Get Microsoft Defender ATP -To get started, you must have Microsoft Defender ATP, with licenses assigned and provisioned. +Now that you've updated your organization's devices, the next step is to get Microsoft Defender ATP, assign licenses, and make sure the service is provisioned. 1. Buy or try Microsoft Defender ATP today. [Visit Microsoft Defender ATP to start a free trial or request a quote](https://aka.ms/mdatp). From 23385b3042b66cca0d1db33ff038b196952c25f3 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 13:08:10 -0700 Subject: [PATCH 41/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 41b1659ef0..22e033ff1e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -68,8 +68,6 @@ The [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/d > [!TIP] > To learn more about this registry key, see [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware). -Proceed to the next task (reinstalling Microsoft Defender Antivirus). - ### Reinstall Microsoft Defender Antivirus on Windows Server > [!NOTE] From 69dd5a33cb8b9d87cf6337525f48865a375433d4 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 13:10:31 -0700 Subject: [PATCH 42/46] Update mcafee-to-microsoft-defender-prepare.md --- .../mcafee-to-microsoft-defender-prepare.md | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md index 86b4f89c0a..f0d4ddd065 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md @@ -56,15 +56,13 @@ Keep McAfee up to date, and make sure that your organization's devices have the Need help updating your organization's devices? See the following resources: -- For Windows devices, see [Microsoft Update](https://www.update.microsoft.com) - -- For macOS devices, see [How to update the software on your Mac](https://support.apple.com/HT201541) - -- For iOS devices, see [Update your iPhone, iPad, or iPod touch](https://support.apple.com/HT204204) - -- For Android devices, see [Check & update your Android version](https://support.google.com/android/answer/7680439) - -- For Linux devices, see [Linux 101: Updating Your System](https://www.linux.com/training-tutorials/linux-101-updating-your-system) +|OS | Resource | +|:--|:--| +|Windows |[Microsoft Update](https://www.update.microsoft.com) | +|macOS | [How to update the software on your Mac](https://support.apple.com/HT201541)| +|iOS |[Update your iPhone, iPad, or iPod touch](https://support.apple.com/HT204204)| +|Android |[Check & update your Android version](https://support.google.com/android/answer/7680439) | +|Linux | [Linux 101: Updating Your System](https://www.linux.com/training-tutorials/linux-101-updating-your-system) | ## Get Microsoft Defender ATP From 932ed435a4812e886078c3bc90a724345a12e7e8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 13:11:37 -0700 Subject: [PATCH 43/46] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 22e033ff1e..e2a9c56a95 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -118,7 +118,7 @@ To enable Microsoft Defender Antivirus, we recommend using Intune. However, you |Method |What to do | |---------|---------| -|[Intune](https://docs.microsoft.com/mem/intune/fundamentals/tutorial-walkthrough-endpoint-manager)

**NOTE**: Intune is now Microsoft Endpoint Manager. |1. Go to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and sign in.

2. Select **Devices** > **Configuration profiles**, and then select the profile type you want to configure. If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure).

3. Select **Properties**, and then select **Configuration settings: Edit**.

4. Expand **Microsoft Defender Antivirus**.

5. Enable **Cloud-delivered protection**.

6. In the **Prompt users before sample submission** dropdown, select **Send all samples automatically**.

7. In the **Detect potentially unwanted applications** dropdown, select **Enable** or **Audit**.

8. Select **Review + save**, and then choose **Save**.

For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/intune/device-profiles).| +|[Intune](https://docs.microsoft.com/mem/intune/fundamentals/tutorial-walkthrough-endpoint-manager)

**NOTE**: Intune is now Microsoft Endpoint Manager. |1. Go to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and sign in.

2. Select **Devices** > **Configuration profiles**, and then select the profile type you want to configure.
If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure).

3. Select **Properties**, and then select **Configuration settings: Edit**.

4. Expand **Microsoft Defender Antivirus**.

5. Enable **Cloud-delivered protection**.

6. In the **Prompt users before sample submission** dropdown, select **Send all samples automatically**.

7. In the **Detect potentially unwanted applications** dropdown, select **Enable** or **Audit**.

8. Select **Review + save**, and then choose **Save**.

For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/intune/device-profiles).| |Control Panel in Windows |Follow the guidance here: [Turn on Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/user-help/turn-on-defender-windows).

**NOTE**: You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows. | |[Advanced Group Policy Management](https://docs.microsoft.com/microsoft-desktop-optimization-pack/agpm/)
or
[Group Policy Management Console](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus) |1. Go to `Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus`.

2. Look for a policy called **Turn off Microsoft Defender Antivirus**.

3. Choose **Edit policy setting**, and make sure that policy is disabled. This enables Microsoft Defender Antivirus.

**NOTE**: You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows. | From df8596c737eecab000c061dbfec730e43bac7880 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 13:17:49 -0700 Subject: [PATCH 44/46] Update mcafee-to-microsoft-defender-migration.md --- .../mcafee-to-microsoft-defender-migration.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md index 2021fb1a37..8373f178e1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md @@ -32,9 +32,9 @@ When you switch from McAfee to Microsoft Defender ATP, you follow a process that |Phase |Description | |--|--| -|[![Phase 1: Prepare](images/prepare.png)](mcafee-to-microsoft-defender-prepare.md)
[Prepare for your migration](mcafee-to-microsoft-defender-prepare.md) |During the **Prepare** phase, you get Microsoft Defender ATP, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender ATP. | -|[![Phase 2: Set up](images/setup.png)](mcafee-to-microsoft-defender-setup.md)
[Set up Microsoft Defender ATP](mcafee-to-microsoft-defender-setup.md) |During the **Setup** phase, you configure settings and exclusions for Microsoft Defender Antivirus, Microsoft Defender ATP, and McAfee. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.| -|[![Phase 3: Onboard](images/onboard.png)](mcafee-to-microsoft-defender-onboard.md)
[Onboard to Microsoft Defender ATP](mcafee-to-microsoft-defender-onboard.md) |During the **Onboard** phase, you onboard your devices to Microsoft Defender ATP and verify that those devices are communicating with Microsoft Defender ATP. Last, you uninstall McAfee and make sure protection through Microsoft Defender ATP is in active mode. | +|[![Phase 1: Prepare](images/prepare.png)](mcafee-to-microsoft-defender-prepare.md)
[Prepare for your migration](mcafee-to-microsoft-defender-prepare.md) |During the **Prepare** phase, you update your organization's devices, get Microsoft Defender ATP, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender ATP. | +|[![Phase 2: Set up](images/setup.png)](mcafee-to-microsoft-defender-setup.md)
[Set up Microsoft Defender ATP](mcafee-to-microsoft-defender-setup.md) |During the **Setup** phase, you enable Microsoft Defender Antivirus and make sure it's in passive mode, and you configure settings & exclusions for Microsoft Defender Antivirus, Microsoft Defender ATP, and McAfee. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.| +|[![Phase 3: Onboard](images/onboard.png)](mcafee-to-microsoft-defender-onboard.md)
[Onboard to Microsoft Defender ATP](mcafee-to-microsoft-defender-onboard.md) |During the **Onboard** phase, you onboard your devices to Microsoft Defender ATP and verify that those devices are communicating with Microsoft Defender ATP. Last, you uninstall McAfee and make sure that protection through Microsoft Defender Antivirus & Microsoft Defender ATP is in active mode. | ## What's included in Microsoft Defender ATP? From 70b60c61414164c3aaee0c1d892ed9e16b0462f0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 13:20:23 -0700 Subject: [PATCH 45/46] Update mcafee-to-microsoft-defender-migration.md --- .../mcafee-to-microsoft-defender-migration.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md index 8373f178e1..0ac22e7713 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md @@ -32,9 +32,9 @@ When you switch from McAfee to Microsoft Defender ATP, you follow a process that |Phase |Description | |--|--| -|[![Phase 1: Prepare](images/prepare.png)](mcafee-to-microsoft-defender-prepare.md)
[Prepare for your migration](mcafee-to-microsoft-defender-prepare.md) |During the **Prepare** phase, you update your organization's devices, get Microsoft Defender ATP, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender ATP. | -|[![Phase 2: Set up](images/setup.png)](mcafee-to-microsoft-defender-setup.md)
[Set up Microsoft Defender ATP](mcafee-to-microsoft-defender-setup.md) |During the **Setup** phase, you enable Microsoft Defender Antivirus and make sure it's in passive mode, and you configure settings & exclusions for Microsoft Defender Antivirus, Microsoft Defender ATP, and McAfee. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.| -|[![Phase 3: Onboard](images/onboard.png)](mcafee-to-microsoft-defender-onboard.md)
[Onboard to Microsoft Defender ATP](mcafee-to-microsoft-defender-onboard.md) |During the **Onboard** phase, you onboard your devices to Microsoft Defender ATP and verify that those devices are communicating with Microsoft Defender ATP. Last, you uninstall McAfee and make sure that protection through Microsoft Defender Antivirus & Microsoft Defender ATP is in active mode. | +|[![Phase 1: Prepare](images/prepare.png)](mcafee-to-microsoft-defender-prepare.md)
[Prepare for your migration](mcafee-to-microsoft-defender-prepare.md) |During [the **Prepare** phase](mcafee-to-microsoft-defender-prepare.md), you update your organization's devices, get Microsoft Defender ATP, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender ATP. | +|[![Phase 2: Set up](images/setup.png)](mcafee-to-microsoft-defender-setup.md)
[Set up Microsoft Defender ATP](mcafee-to-microsoft-defender-setup.md) |During [the **Setup** phase](mcafee-to-microsoft-defender-setup.md), you enable Microsoft Defender Antivirus and make sure it's in passive mode, and you configure settings & exclusions for Microsoft Defender Antivirus, Microsoft Defender ATP, and McAfee. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.| +|[![Phase 3: Onboard](images/onboard.png)](mcafee-to-microsoft-defender-onboard.md)
[Onboard to Microsoft Defender ATP](mcafee-to-microsoft-defender-onboard.md) |During [the **Onboard** phase](mcafee-to-microsoft-defender-onboard.md), you onboard your devices to Microsoft Defender ATP and verify that those devices are communicating with Microsoft Defender ATP. Last, you uninstall McAfee and make sure that protection through Microsoft Defender Antivirus & Microsoft Defender ATP is in active mode. | ## What's included in Microsoft Defender ATP? From e657f680f6b35b2fb40bb0248cf6bf4150d87565 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 4 Sep 2020 14:18:48 -0700 Subject: [PATCH 46/46] Update mcafee-to-microsoft-defender-migration.md --- .../mcafee-to-microsoft-defender-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md index 0ac22e7713..d5419822d8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md @@ -42,7 +42,7 @@ In this migration guide, we focus on [next-generation protection](https://docs.m | Feature/Capability | Description | |---|---| -| [Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) | Threat & Vulnerability Management capabilities helps identify, assess, and remediate weaknesses across your endpoints (such as devices). | +| [Threat & vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) | Threat & vulnerability management capabilities help identify, assess, and remediate weaknesses across your endpoints (such as devices). | | [Attack surface reduction](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction) | Attack surface reduction rules help protect your organization's devices and applications from cyberthreats and attacks. | | [Next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) | Next-generation protection includes Microsoft Defender Antivirus to help block threats and malware. | | [Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) | Endpoint detection and response capabilities detect, investigate, and respond to intrusion attempts and active breaches. |