Defender for Endpoint

Remotely Intune wipe devices in Defender for Endpoint isolation mode!

Intro Microsoft recently announced that device isolation exclusions in Defender for Endpoint are now generally available. This made me think about possible use cases for this new feature. Together with Bjorn Claes, we …

October 22, 2025 · 4 min · Thomas Verheyden
Defender for Endpoint

MDE-Troubleshooter v1.6.1 available

What’s new: – Inspired by Yong Rhee “Resolving High CPU Utilization in MDE” session, added additional options to run the Performance analyzer, Overview is now by default. – Added ASR rules that went GA – Added a check if …

June 7, 2025 · 1 min · Thomas Verheyden
Defender for Cloud

Using Azure Arc only for Defender for Servers or Azure monitoring Agent? Lock it down!

Intro While reviewing Defender for Servers and AMA agent implementations across various customers, I noticed that not all of them are following best security practices for Azure Arc deployments. In this blog, I want to …

April 14, 2025 · 6 min · Thomas Verheyden
Defender for Cloud

After 2 years a new release of MDE-Troubleshooter!

Lately, I’ve been doing a lot of Defender for Endpoint deployment/configuration troubleshooting, which prompted me to dust off my MDE-Troubleshooter. I noticed it was missing some new and improved configurations, so I …

January 7, 2025 · 1 min · Thomas Verheyden
Defender for Endpoint

Fix: SENSE Service stuck in START_PENDING on WS2012R2 or WS2016? Check OOBE !

Intro This blog discusses a challenge I encountered with a client. They reached out for assistance in addressing issues during the deployment of Defender for Endpoint on Windows Server 2012 R2 and Windows Server 2016. …

November 27, 2024 · 4 min · Thomas Verheyden
Defender for Cloud

Tutorial: How to enable/disable Defender for Servers Plans at resources level 

Intro I noticed that more and more clients are starting to use mixed license model for Defender for Servers. Previous you could only enable Defender for Server at the subscription level. Microsoft also noticed this and …

March 6, 2024 · 3 min · Thomas Verheyden
Defender for Cloud

Unleash the power of defender plan 2: Just-in-time VM access – part 4

Intro Malicious actors actively search for machines with open management ports, such as RDP or SSH, to exploit. All of your virtual machines are potential targets for these attacks if you have those ports open. Once a VM …

July 20, 2023 · 6 min · Thomas Verheyden
Defender for Endpoint

Microsoft Defender for Endpoint settings management: Enhancements

*UPDATE 17/07/2023* Added extra information about system labels Intro Microsoft is doing a very good job at listening to their customers, partners and MVP’s lately. One of the highly requested feature was to simplify the …

June 15, 2023 · 6 min · Thomas Verheyden
Defender for Cloud

Unleash the power of Defender for Servers Plan 2: Agentless scanning – part 3

Intro Welcome to part three of the blog series on Unleach the power of Defender for Servers Plan 2! In our previous blog, we explored how to start implementing Adaptive Application control. In part 3, we’ll dive into the …

June 14, 2023 · 8 min · Thomas Verheyden
Defender for Cloud

Direct on board your non-Azure servers to defender for cloud WITHOUT Azure Arc

Intro Up until now, onboarding non-Azure servers to Defender for Servers required Azure Arc as a mandatory pre-requisite. With this new release, Microsoft is introducing an additional direct onboarding path for non-Azure …

June 5, 2023 · 5 min · Thomas Verheyden