mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-22 13:53:39 +00:00
Updated per task 4252109
This commit is contained in:
ManikaDhiman
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Onboard servers to the Microsoft Defender ATP service
|
||||
description: Onboard servers so that they can send sensor data to the Microsoft Defender ATP sensor.
|
||||
title: Onboard Windows servers to the Microsoft Defender ATP service
|
||||
description: Onboard Windows servers so that they can send sensor data to the Microsoft Defender ATP sensor.
|
||||
keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, device management, configure Windows ATP servers, onboard Microsoft Defender Advanced Threat Protection servers
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -17,7 +17,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Onboard servers to the Microsoft Defender ATP service
|
||||
# Onboard Windows servers to the Microsoft Defender ATP service
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -34,7 +34,7 @@ ms.topic: article
|
||||
|
||||
Microsoft Defender ATP extends support to also include the Windows Server operating system. This support provides advanced attack detection and investigation capabilities seamlessly through the Microsoft Defender Security Center console.
|
||||
|
||||
The service supports the onboarding of the following servers:
|
||||
The service supports the onboarding of the following Windows servers:
|
||||
- Windows Server 2008 R2 SP1
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
@ -44,6 +44,8 @@ The service supports the onboarding of the following servers:
|
||||
|
||||
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
|
||||
|
||||
For guidance on how to download and use Windows Security Baselines for Windows servers, see [Windows Security Baselines](https://docs.microsoft.com/windows/device-security/windows-security-baselines).
|
||||
|
||||
|
||||
## Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016
|
||||
|
||||
@ -53,11 +55,11 @@ There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012
|
||||
- **Option 2**: Onboard through Azure Security Center
|
||||
|
||||
> [!NOTE]
|
||||
> Microsoft defender ATP standalone server license is required, per node, in order to onboard the server through Microsoft Defender Security Center (Option 1), or an Azure Security Center Standard license is required, per node, in order to onboard a server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services).
|
||||
> Microsoft defender ATP standalone server license is required, per node, in order to onboard a Windows server through Microsoft Defender Security Center (Option 1), or an Azure Security Center Standard license is required, per node, in order to onboard a Windows server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services).
|
||||
|
||||
|
||||
### Option 1: Onboard servers through Microsoft Defender Security Center
|
||||
You'll need to take the following steps if you choose to onboard servers through Microsoft Defender Security Center.
|
||||
### Option 1: Onboard Windows servers through Microsoft Defender Security Center
|
||||
You'll need to take the following steps if you choose to onboard Windows servers through Microsoft Defender Security Center.
|
||||
|
||||
- For Windows Server 2008 R2 SP1 or Windows Server 2012 R2, ensure that you install the following hotfix:
|
||||
- [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/en-us/help/3080149/update-for-customer-experience-and-diagnostic-telemetry)
|
||||
@ -104,25 +106,24 @@ The following steps are required to enable this integration:
|
||||
|
||||
1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603).
|
||||
|
||||
2. Using the Workspace ID and Workspace key provided in the previous procedure, choose any of the following installation methods to install the agent on the server:
|
||||
2. Using the Workspace ID and Workspace key provided in the previous procedure, choose any of the following installation methods to install the agent on the Windows server:
|
||||
- [Manually install the agent using setup](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-setup) <br>
|
||||
On the **Agent Setup Options** page, choose **Connect the agent to Azure Log Analytics (OMS)**.
|
||||
- [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script).
|
||||
|
||||
3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](configure-proxy-internet.md).
|
||||
|
||||
Once completed, you should see onboarded servers in the portal within an hour.
|
||||
Once completed, you should see onboarded Windows servers in the portal within an hour.
|
||||
|
||||
<span id="server-proxy"/>
|
||||
|
||||
### Configure server proxy and Internet connectivity settings
|
||||
### Configure Windows server proxy and Internet connectivity settings
|
||||
|
||||
- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the <a href="https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway" data-raw-source="[OMS Gateway](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway)">OMS Gateway</a>.
|
||||
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that you [enable access to Microsoft Defender ATP service URLs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
||||
|
||||
|
||||
|
||||
### Option 2: Onboard servers through Azure Security Center
|
||||
### Option 2: Onboard Windows servers through Azure Security Center
|
||||
1. In the navigation pane, select **Settings** > **Device management** > **Onboarding**.
|
||||
|
||||
2. Select Windows Server 2008 R2 SP1, 2012 R2 and 2016 as the operating system.
|
||||
@ -131,7 +132,6 @@ Once completed, you should see onboarded servers in the portal within an hour.
|
||||
|
||||
4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
|
||||
|
||||
## Windows Server (SAC) version 1803, Windows Server 2019, and Windows Server 2019 Core edition
|
||||
To onboard Windows Server (SAC) version 1803, Windows Server 2019, or Windows Server 2019 Core edition, refer to the supported methods and versions below.
|
||||
|
||||
@ -147,9 +147,9 @@ Supported tools include:
|
||||
|
||||
For more information, see [Onboard Windows 10 devices](configure-endpoints.md).
|
||||
|
||||
Support for Windows Server, provide deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
Support for Windows Server, provide deeper insight into activities happening on the Windows server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
|
||||
1. Configure Microsoft Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 devices](configure-endpoints.md).
|
||||
1. Configure Microsoft Defender ATP onboarding settings on the Windows server. For more information, see [Onboard Windows 10 devices](configure-endpoints.md).
|
||||
|
||||
2. If you're running a third-party antimalware solution, you'll need to apply the following Microsoft Defender AV passive mode settings. Verify that it was configured correctly:
|
||||
|
||||
@ -175,9 +175,11 @@ Support for Windows Server, provide deeper insight into activities happening on
|
||||
|
||||
If the result is 'The specified service does not exist as an installed service', then you'll need to install Microsoft Defender AV. For more information, see [Microsoft Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10).
|
||||
|
||||
## Onboard Windows servers using Microsoft Endpoint Configuration Manager version 2002 and later
|
||||
You can onboard Windows Server 2012 R2, Windows Server 2016, Windows Server 2016, version 1803, and Windows Server 2019 using Microsoft Endpoint Configuration Manager version 2002 and later. For more information, see [Microsoft Defender Advanced Threat Protection in Microsoft Endpoint Configuration Manager current branch](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection).
|
||||
|
||||
## Integration with Azure Security Center
|
||||
Microsoft Defender ATP can integrate with Azure Security Center to provide a comprehensive server protection solution. With this integration, Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers.
|
||||
Microsoft Defender ATP can integrate with Azure Security Center to provide a comprehensive Windows server protection solution. With this integration, Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers.
|
||||
|
||||
The following capabilities are included in this integration:
|
||||
- Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
|
||||
@ -185,31 +187,31 @@ The following capabilities are included in this integration:
|
||||
> [!NOTE]
|
||||
> Automated onboarding is only applicable for Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016.
|
||||
|
||||
- Servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console.
|
||||
- Windows servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console.
|
||||
- Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default.
|
||||
> - When you use Azure Security Center to monitor Windows servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default.
|
||||
> - If you use Microsoft Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
|
||||
> - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created and the Microsoft Defender ATP data is stored in Europe by default. If you need to move your data to another location, you need to contact Microsoft Support to reset the tenant. Server endpoint monitoring utilizing this integration has been disabled for Office 365 GCC customers.
|
||||
> - When you use Azure Security Center to monitor Windows servers, a Microsoft Defender ATP tenant is automatically created and the Microsoft Defender ATP data is stored in Europe by default. If you need to move your data to another location, you need to contact Microsoft Support to reset the tenant. Server endpoint monitoring utilizing this integration has been disabled for Office 365 GCC customers.
|
||||
|
||||
|
||||
## Offboard servers
|
||||
## Offboard Windows servers
|
||||
You can offboard Windows Server (SAC), Windows Server 2019, and Windows Server 2019 Core edition in the same method available for Windows 10 client devices.
|
||||
|
||||
For other server versions, you have two options to offboard servers from the service:
|
||||
For other Windows server versions, you have two options to offboard Windows servers from the service:
|
||||
- Uninstall the MMA agent
|
||||
- Remove the Microsoft Defender ATP workspace configuration
|
||||
|
||||
> [!NOTE]
|
||||
> Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
> Offboarding causes the Windows server to stop sending sensor data to the portal but data from the Windows server, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
|
||||
### Uninstall servers by uninstalling the MMA agent
|
||||
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Microsoft Defender ATP.
|
||||
### Uninstall Windows servers by uninstalling the MMA agent
|
||||
To offboard the Windows server, you can uninstall the MMA agent from the Windows server or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the Windows server will no longer send sensor data to Microsoft Defender ATP.
|
||||
For more information, see [To disable an agent](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).
|
||||
|
||||
### Remove the Microsoft Defender ATP workspace configuration
|
||||
To offboard the server, you can use either of the following methods:
|
||||
To offboard the Windows server, you can use either of the following methods:
|
||||
|
||||
- Remove the Microsoft Defender ATP workspace configuration from the MMA agent
|
||||
- Run a PowerShell command to remove the configuration
|
||||
@ -230,7 +232,7 @@ To offboard the server, you can use either of the following methods:
|
||||
|
||||
1. Select **Windows Server 2008 R2 SP1, 2012 R2 and 2016** as the operating system and get your Workspace ID:
|
||||
|
||||
|
||||
|
||||
|
||||
2. Open an elevated PowerShell and run the following command. Use the Workspace ID you obtained and replacing `WorkspaceID`:
|
||||
|
||||
@ -242,7 +244,6 @@ To offboard the server, you can use either of the following methods:
|
||||
# Reload the configuration and apply changes
|
||||
$AgentCfg.ReloadConfiguration()
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 devices](configure-endpoints.md)
|
||||
- [Onboard non-Windows devices](configure-endpoints-non-windows.md)
|
||||
|
||||
Reference in New Issue
Block a user