Carbon Black Cloud: Windows Defender Still Running on with 'Use Windows Security Center' enabled in Policy for Windows 2016 and other Servers.

[#1]

Environment

• Carbon Black Cloud Console: All Versions
• Endpoint Standard Sensor: All Versions
• Microsoft Windows Defender

Symptoms

Windows Defender continuous to operate when Carbon Black sensor is active and running.

Cause

In Windows Server 2016 Operating system enabling "Windows Security Center" will not disable Windows Defender. 

Resolution

In Windows Server 2016 and on other server Operating system enabling "Windows Security Center" will not disable Windows Defender. Instead, it must be disabled manually.
 

1) Disable it through Powershell:

1. Open PowerShell as Administrator.
2. Type the following command:

Set-MpPreference -DisableRealtimeMonitoring $true

2) To Uninstall Windows Defender:

1. Open PowerShell as Administrator.
2. Type the following command and press Type the following command and press Enter:

Uninstall-WindowsFeature -Name Windows-Defender

 

Additional Notes

Carbon Black Sensor can operate along with Defender in parallel.

Add Permissions rules or Exclusions for both Defender and Endpoint Standard so they are not scanning one another to improve performance

Endpoint Standard: What Permission Rules are needed for Windows Defender?
 

Related Content

Endpoint Standard: What Permission Rules are needed for Windows Defender?
Endpoint Standard: Windows Defender still running with 'Use Windows Security Center' enabled in Poli...