Kaido Jarvemets - Logo

Defender for Endpoint Migration Toolkit

Introduction

Migrating from one endpoint protection solution to another can be a daunting task. It requires careful planning, execution, and testing to ensure a seamless transition without impacting business operations. However, with the Defender for Endpoint Migration Toolkit, the process can be simplified and streamlined.

We have compiled several PowerShell examples for migrating from third-party antivirus solutions to Defender for Endpoint.

Leveraging PowerShell for Migration

PowerShell is a powerful tool that can be used to create collections and queries for migrating to Defender for Endpoint. These collections and queries are crucial for managing and monitoring your endpoints, ensuring they are protected and functioning optimally.

Creating Collections and Queries

The process of creating collections and queries involves importing the Configuration Manager PowerShell module. Once imported, you can create queries for various programs such as the Azure Connected Machine Agent, Microsoft Defender for Endpoint, Microsoft Monitoring Agent, and System Center Endpoint Protection.

After creating the queries, you can then create device collections for each program. These collections allow you to manage and monitor the devices running these programs, providing you with valuable insights into their operation and security status.

				
					#You need to import the Configuration Manager PowerShell module before you can create the Queries and Collections

#Queries
$AzureConnectedMachineAgent = 'select SMS_R_System.Name, SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName, SMS_G_System_ADD_REMOVE_PROGRAMS_64.Version from  SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS_64 on SMS_G_System_ADD_REMOVE_PROGRAMS_64.ResourceId = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName = "Azure Connected Machine Agent"'
$MicrosoftDefenderforEndpoint = 'select SMS_R_System.Name, SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName, SMS_G_System_ADD_REMOVE_PROGRAMS_64.Version from  SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS_64 on SMS_G_System_ADD_REMOVE_PROGRAMS_64.ResourceID = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName = "Microsoft Defender for Endpoint"'
$MicrosoftMonitoringAgent = 'select SMS_R_System.Name, SMS_G_System_ADD_REMOVE_PROGRAMS_64.Version, SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName from  SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS_64 on SMS_G_System_ADD_REMOVE_PROGRAMS_64.ResourceID = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName = "Microsoft Monitoring Agent"'
$SystemCenterEndpointProtection = 'select SMS_R_System.Name, SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName, SMS_G_System_ADD_REMOVE_PROGRAMS_64.Version from  SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS_64 on SMS_G_System_ADD_REMOVE_PROGRAMS_64.ResourceId = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName = "System Center Endpoint Protection"'

New-CMQuery -Name "Azure Connected Machine Agent" -Expression $AzureConnectedMachineAgent -TargetClassName "SMS_R_System"
New-CMQuery -Name "Microsoft Defender for Endpoint" -Expression $MicrosoftDefenderforEndpoint -TargetClassName "SMS_R_System"
New-CMQuery -Name "Microsoft Monitoring Agent" -Expression $MicrosoftMonitoringAgent -TargetClassName "SMS_R_System"
New-CMQuery -Name "System Center Endpoint Protection" -Expression $SystemCenterEndpointProtection -TargetClassName "SMS_R_System"

#Device Collections
$LimitingCollectionName = "All Systems"
New-CMCollection -Name "Azure Connected Machine Agent" -LimitingCollectionName $LimitingCollectionName -CollectionType Device
Add-CMDeviceCollectionQueryMembershipRule -CollectionName "Azure Connected Machine Agent" -QueryExpression $AzureConnectedMachineAgent -RuleName "AzureConnectedMachineAgent"

New-CMCollection -Name "Microsoft Defender for Endpoint" -LimitingCollectionName $LimitingCollectionName -CollectionType Device
Add-CMDeviceCollectionQueryMembershipRule -CollectionName "Microsoft Defender for Endpoint" -QueryExpression $MicrosoftDefenderforEndpoint -RuleName "MicrosoftDefenderforEndpoint"

New-CMCollection -Name "Microsoft Monitoring Agent" -LimitingCollectionName $LimitingCollectionName -CollectionType Device
Add-CMDeviceCollectionQueryMembershipRule -CollectionName "Microsoft Monitoring Agent" -QueryExpression $MicrosoftMonitoringAgent -RuleName "MicrosoftMonitoringAgent"

New-CMCollection -Name "System Center Endpoint Protection" -LimitingCollectionName $LimitingCollectionName -CollectionType Device
Add-CMDeviceCollectionQueryMembershipRule -CollectionName "System Center Endpoint Protection" -QueryExpression $SystemCenterEndpointProtection -RuleName "SystemCenterEndpointProtection"
				
			

Make the Switch to Microsoft Defender for Endpoint

Say goodbye to your outdated and ineffective AV solution and make the switch to Microsoft Defender for Endpoint. Our comprehensive security solution offers real-time protection against advanced threats, while providing you with the visibility and control you need to protect your endpoints. Get in touch with us to learn more about our migration services.
Call to Action
				
					#Check if the Defender AV is in Passive, Not Running or EDR Block Mode.
Get-MpComputerStatus | Select-Object -ExpandProperty AMRunningMode

#Get the Windows Defender AV service path
Get-CimInstance -ClassName Win32_Service -Filter "Name='WinDefend'" | Select-Object -Property PathName

#Get Windows Defender information directly from WMI
Get-CimInstance -Namespace "ROOT/Microsoft/Windows/Defender"-ClassName MSFT_MpComputerStatus 

#Check if the third-party AV still installed
Get-CimInstance -Namespace "ROOT\SecurityCenter2" -ClassName AntiVirusProduct

#Windows Defender should run under the C:\ProgramData folder.If this folder is empty, then something is wrong.
$MDEVersions = Get-ChildItem -Directory -Path "C:\programdata\Microsoft\Windows Defender\Platform"
$MDECount = $MDEVersions | Measure-Object
If($MDECount.Count -eq 0){

    Write-Output -InputObject "BROKEN"
}
Else{
    Write-Output -InputObject "NOTBROKEN"
}

#Check Windows Server 2019 and 2022 Windows Defender Feature
$DefenderAVRole = Get-WindowsFeature -Name "Windows-Defender"
If($DefenderAVRole.InstallState -eq "Installed"){

    Write-Host -Object "OK"
}
Else{
    Write-Host -Object "NOTOK"
}

#Check Windows Server 2016 Windows Defender Feature
$DefenderAVRole = Get-WindowsFeature -Name "Windows-Defender-Features"
If($DefenderAVRole.InstallState -eq "Installed"){

    Write-Host -Object "OK"
}
Else{
    Write-Host -Object "NOTOK"
}

#On some servers enhanced Defender AV package does not install and you need to make sure that DisableAntiSpyware key is removed before the installation
#Affected servers mostly 2012R2 servers
$RegKey = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name DisableAntiSpyware -ErrorAction SilentlyContinue
If($RegKey -and $RegKey.DisableAntiSpyware -eq 1){
    Write-Host "BROKEN"
}
Else{
    Write-Host "NOTBROKEN"
}

#On some servers enhanced Defender AV package does not install and you need to make sure that WinDefend key is removed before the installation
#Affected servers mostly 2012R2 servers
Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend"

#Check Defender for Endpoint Onboarding state through registry
$RegKey = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" -Name OnboardingState -ErrorAction SilentlyContinue
If($RegKey -and $RegKey.OnboardingState -eq 1){
    Write-Host "OK"
}
Else{
    Write-Host "BROKEN"
}
				
			

Leave a Reply

Contact me

If you’re interested in learning about Defender for Endpoint Migration Toolkit. I can help you understand how this solution can benefit your organization and provide a customized solution tailored to your specific needs.

Table of Contents