On Windows 10, Windows 11 and Windows Server 2016 or later, Configuration Manager (SCCM) doesn't install an antivirus. Its Endpoint Protection feature manages Microsoft Defender Antivirus, which is already part of Windows. In this post I'll set it up from start to finish, show how to prove the settings landed, and explain what changes when the workload moves to Intune.
How it works#
- Endpoint Protection point: a site system role installed once, at the top of the hierarchy (the central administration site or a stand-alone primary site). You accept the licence terms and set the default Cloud Protection Service membership here, and it syncs threat information into the site database.
- Endpoint Protection client settings: tell the Configuration Manager client to manage Defender.
- Antimalware policies: the Defender settings. The Default Client Antimalware Policy applies to every client, and a custom policy deployed to a collection overrides it.
- Update sources: where Defender gets security intelligence (definition) updates, often your software update point.
Step-by-step#
1. Add the Endpoint Protection point#
In Administration › Overview › Site Configuration › Servers and Site System Roles, select the top-level site server and choose Add Site System Roles. Select Endpoint Protection point, accept the licence terms and pick a Cloud Protection Service membership. I choose Advanced, because Defender's cloud-delivered protection depends on it, and policies can still override it. EPSetup.log and EPMgr.log in the site server's Logs folder confirm that the role installed and is healthy.
2. Turn on Endpoint Protection in client settings#
Under Administration › Overview › Client Settings, create custom client device settings and add the Endpoint Protection group. Set Manage Endpoint Protection client on client computers to Yes, and deploy the settings to a pilot collection first. On Windows 10 and 11 there's nothing to install: this setting simply gives Configuration Manager control of Defender's configuration.
3. Get security intelligence updates flowing#
Microsoft releases Defender security intelligence updates (KB2267602) several times a day. To deliver them with Configuration Manager software updates:
- In the software update point component properties, select the Microsoft Defender Antivirus product and the Definition Updates classification. Synchronise at least daily.
- Create an automatic deployment rule (ADR) from the Definition Updates template. Run it after every synchronisation, add updates to an existing software update group rather than creating a new group each time, and deploy with an "as soon as possible" deadline.
Then, in the antimalware policy's Security intelligence updates section, select Set Source and choose and order your sources:
| Source | When it fits |
|---|---|
| Updates distributed from Configuration Manager | Your ADR delivers the updates. While this source is in the list, clients only use the other sources if the software update download fails. |
| Updates distributed from Windows Server Update Services (WSUS) | Your WSUS infrastructure delivers the updates. |
| Updates distributed from Microsoft Update | A fallback for devices that are often off the corporate network. |
| Updates distributed from Microsoft Malware Protection Center | Clients download definitions directly from Microsoft. |
| Updates from UNC file shares | Isolated networks, where you stage update files on a share. |
Two details catch people out. First, clients download from the internet sources as the local system account, so that account needs a working proxy configuration. Second, an ADR delivers definition updates whatever source order you set.
4. Build and deploy antimalware policies#
Go to Assets and Compliance › Overview › Endpoint Protection › Antimalware Policies. Keep the default policy sensible, because it's every client's safety net, but you can't deploy it. For targeted settings, choose Create Antimalware Policy, or Import one of the templates from AdminConsole\XMLStorage\EPTemplates in the Configuration Manager installation folder. Then configure the sections you need:
| Section | What to look at |
|---|---|
| Scheduled scans | Scan type (Quick scan by default) and schedule. Randomised start times help on VDI hosts. |
| Real-time protection | Keep real-time protection and behaviour monitoring on. From version 2107, you can audit potentially unwanted applications before you block them. |
| Cloud Protection Service | Membership, the blocking level for suspicious files (Normal, High, High with extra protection or Block unknown programs), and the extended cloud check, which is added to a default 10-second timeout. |
| Exclusion settings | Files, folders, file types and processes. From version 2609, file and folder exclusions can also be Defender contextual exclusions. |
| Security intelligence updates | The sources and their order, from step 3. |
Select the policy, choose Deploy and pick a device collection. When several custom policies reach the same device, priority settles conflicting settings, but exclusions from all the policies are merged. Review the combined exclusion list, not only each policy on its own.
Verify#
After a machine policy refresh, open EndpointProtectionAgent.log in %WinDir%\CCM\Logs. It records the antimalware policy being applied, so policy errors show up there. Then check what Defender is actually using:
Get-MpComputerStatus | Select-Object AMRunningMode, RealTimeProtectionEnabled,
AntivirusSignatureVersion, AntivirusSignatureLastUpdated
Get-MpPreference | Select-Object MAPSReporting, CloudBlockLevel, PUAProtection, ExclusionPathGood looks like AMRunningMode showing Normal, real-time protection True and signatures updated within the last day. The preferences should match your policy: MAPSReporting 2 means Advanced membership, CloudBlockLevel 2 means High, and PUAProtection is 1 for block or 2 for audit.
In the console, Monitoring › Security › Endpoint Protection Status summarises status for a collection. A collection only appears there once you select View this collection in the Endpoint Protection dashboard on the Alerts tab of its properties. To test the round trip on one device, right-click it and choose Endpoint Protection › Quick Scan or Download Definition.
Co-management: when Intune takes over#
The co-management Endpoint Protection workload covers Defender Antivirus, Windows Defender Firewall, BitLocker, Exploit Guard, Application Control, SmartScreen and Defender for Endpoint, and the Device configuration workload includes it. When you switch it, the Configuration Manager policies stay on the device until Intune policies overwrite them, so devices stay protected during the change.
Rebuild your settings as an Intune Endpoint security › Antivirus policy first. Defender settings in a device restrictions profile aren't covered by the workload switch. Then move a pilot collection and compare Get-MpPreference before and after. My guide to moving co-management workloads to Intune covers the order. BitLocker moves with this workload too (see BitLocker management in Configuration Manager).
Tips & gotchas#
- Use one tool to configure Defender. If Group Policy sets the same options, results get unpredictable. My Defender settings checklist shows how to find the source.
- Exclude Configuration Manager carefully. Microsoft publishes recommended antivirus exclusions for Configuration Manager site servers, site systems and clients. Put the server exclusions in a policy that only targets those servers.
- Platform updates are separate. Security intelligence updates don't update the Defender platform (KB4052623). See platform and engine updates.
