Onboarding Windows clients

Different options are available, depending on the age of the Windows version. Windows 10 and 11 both have capabilities built-in that Windows 7 SP1 and Windows 8.1 do not. Even after onboarding, their support of MDE features varies.

Figure 4.1 – Deciding which management tool to use for onboarding Windows clients

Detection tests for Windows

You can confirm whether Windows clients and servers are onboarded and successfully transmitting EDR sensor data by executing the following command prompt, which is also found within the Microsoft 365 Defender portal’s onboarding settings:

powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference = 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'invoice.exe');Start-Process 'invoice.exe'

In the sections that follow, you will learn how to onboard all supported...