Microsoft System Center Management Pack for Windows Defender

The Management Pack for Windows Defender facilitates the monitoring of device health for those running Windows Defender. It employs publicly available Windows Defender PowerShell cmdlets to collect information regarding various events associated with Windows Defender. These events encompass malware detections and the health status of Windows Defender on the devices. Administrators can configure these events to trigger alerts, enabling prompt action upon receiving notifications from end-user devices. Windows Defender categorizes devices into three distinct monitoring groups based on their respective states:

1. Protected Endpoints - Inventory: Devices with Windows Defender active and providing protection are grouped here.
2. Unprotected Endpoints - Inventory: Devices without an active or operational Windows Defender are grouped here.
3. Protected Candidate - Inventory: Devices with Windows Defender active are grouped here, implying a potential for transitioning to the Protected Endpoints group upon meeting certain criteria.

Supported Operating Systems

Windows Server 2016, Windows 10, Windows 8, Windows 8.1, Windows Server 2019, Windows Server 2022

Supported SCOM Versions

• System Center Operations Manager 2022
• System Center Operations Manager 2019
• System Center Operations Manager 2016

See the MP Guide for detailed instructions