Microsoft Defender for Endpoint 'Troubleshooting Mode' Previewed -- Redmondmag.com

Microsoft Defender for Endpoint 'Troubleshooting Mode' Previewed

By Kurt Mackie
05/18/2022

Microsoft on Tuesday announced a public preview of "troubleshooting mode" for Microsoft Defender for Endpoint, which is used to protect devices.

Troubleshooting mode gives IT pros three hours to conduct tests while overriding "Microsoft' Defender Antivirus security configurations on a device. It even overrides a tamper protection capability for testing purposes, the announcement explained.

IT pros can make policy changes while in troubleshooting mode, but those changes only will take effect after the three-hour period ends, according to this Microsoft "Get Started" document.

IT pros might want to use troubleshooting mode to investigate things such as:

An inability to install an application
The application takes longer than usual to perform an action
A Microsoft Office plugin gets blocked by Attack Surface Reduction
A domain gets blocked by Network Protection
High CPU use happens when Windows Defender antivirus is active

Microsoft described those troubleshooting mode scenarios in this document. Some possible advanced hunting queries to use are listed in this document.

Troubleshooting mode produces diagnostic files for analysis that can be accessed via a "Collect Investigation Package feature."

IT pros with "Manage Security settings permissions" can initiate troubleshooting mode from the Microsoft 365 Defender portal for a device or devices. It's turned off by default, though. Local administrators have the permissions to configure Microsoft Defender Antivirus settings in troubleshooting mode, but they can't disable or uninstall Microsoft Defender Antivirus.

There are requirements to be running specific versions of Windows 10 or Windows 11 client operating systems, as well as requirements for Windows Server 2019 or Windows Server 2022, to use troubleshooting mode.

Troubleshooting mode is described as "exclusively an Enterprise-only feature, and requires Microsoft 365 Defender access."

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Choosing the Right SSID for Your Network

Attracting attention, whether through a default or funny Wi-Fi name, could lead to a security issue.
Microsoft Outlines Latest Security Efforts at Ignite

In the wake of last year's CrowdStrike incident, Microsoft has worked to publicly rehabilitate its security image through new initiatives and public commitments to improve. That push continued this week at Ignite, where Microsoft announced a handful of new security tools and updates.
Nadella on Copilot: 'Major Platform Shifts Are in the Air'

As should be no surprise, Copilot took center stage during Microsoft CEO Satya Nadella's keynote speech to open Microsoft Ignite 2024.
Azure AI Foundry Revealed at Microsoft Ignite

Microsoft is consolidating its Azure generative AI tools into a unified platform named Azure AI Foundry.
Microsoft Bolsters Fabric at Ignite

While Fabric has improved in the year since its release, there are still some glaring issues with the platform.