1

Hi All -

We transitioned from SEP to Defender AV for our windows 10 workstations and are looking at doing the same for our servers. Our servers consist of Server 2012, 2016, 2019, and 2022. Currently have SEP installed and we have a policy configured for 25 or so servers that dont have Auto-Protect enabled. The servers in this pool have mixed tasks such as db servers, phone client servers, check imaging/scanning servers, etc…

I’ve done some research/testing with Defender AV and turning off real-time protection - which obviously Microsoft intends on it running. Does anyone have Defender AV with real-time protection off for some servers? If so, do you leave it permanently off? If not, what is the best way to handle the servers (that don’t’ have sep auto-protect) w/ real-time enabled: test and add exclusions as necessary?

I am sure best practice is to have it enabled, but curious if others are running it off on any servers and how things are going.

Thanks!

8 Spice ups
2

I let it run Along with ESET Endpoint for servers. So far no isues

1 Spice up
3

When installing 3rd party AV solutions Defender will disable by default. Unless you explicitly switch it on, would need GPO for that as registry would get overridden. Running multiple AV solution can cause system performance degredation and access violations (random errors)

Defender is not available for 2012 unless you are using SCCM or Intune
Defender does not ship with ATP protection on 2016 unless you have Intune and do an additional install from the Intune portal

To maximize your protection and ensure the integrity of the Defender AV solution use GPO for management

PS we run Defender 365 on everything, active full protection everything turned on. No hassles.

4

As Spicehead stated WIndows Defender for Servers is not quite the same as the build in Defender.

Check this Microsoft article.

Defender for Servers

5

I do not use any AV software on servers unless those are RDS or File Servers and are directly accessible to many people. AV constantly causes various sorts of issues with other software, services, and applications running on those servers and may also impact the performance. If the servers are virtualized, there are some solid methods https://www.hyper-v.io/hyper-v-security-mistakes-dont-want-make/ to increase security without running AV software. And if the only persons having access to those servers are IT guys, servers are pretty secure in such a configuration.