topic Re: Cortex XDR Pro - Server installations - still running Windows Defender (not Firewall) in Cortex XDR Discussions

Cortex XDR Pro - Server installations - still running Windows Defender (not Firewall)

RFeyertag — Fri, 20 Jan 2023 19:56:31 GMT

Hello dear community,

what is your expirience with running MsMpEng.exe on Windows Server OS, while using Cortex XDR?

In my case the Windows Clients don't run MsMpEng.exe while Cortex XDR is running, but the server do so.

What is the difference here and what should I do, to solve this "problem"? Is it a problem? Is this design?

Rob

Re: Cortex XDR Pro - Server installations - still running Windows Defender (not Firewall)

timurphy — Tue, 24 Jan 2023 16:32:55 GMT

Hi @RFeyertag,

This is by design on Windows Server operating systems: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-New-Agent-Settings-Profile

See the relevant excerpt from the Agent Settings documentation below:

(Windows only) Configure Windows Security Center Integration.

The Windows Security Center is a reporting tool that monitors the system health and security state of Windows endpoints on Windows 7 and later releases:

Enabled—The Cortex XDR agent registers with the Windows Security Center as an official Antivirus (AV) software product. As a result, Windows shuts down Microsoft Defender on the endpoint automatically, except for endpoints that are running Windows Server versions. To avoid performance issues, Palo Alto Networks recommends that you disable or remove Windows Defender from endpoints that are running Windows Server versions and where the Cortex XDR agent is installed.

Re: Cortex XDR Pro - Server installations - still running Windows Defender (not Firewall)

RFeyertag — Tue, 24 Jan 2023 19:43:13 GMT

Thank you Timurphy!

I have forwarded it to internally to get a gpo running to deactivate the defender.

Rob

Re: Cortex XDR Pro - Server installations - still running Windows Defender (not Firewall)

eumbach — Wed, 25 Jan 2023 16:01:26 GMT

Microsoft Defender Antivirus compatibility with other security products | Microsoft Learn

We have seen the same behavior; there are a lot of switches.

Re: Cortex XDR Pro - Server installations - still running Windows Defender (not Firewall)

PC-TomS — Fri, 17 Feb 2023 00:27:34 GMT

Has anyone here been able to get Cortex XDR to show up as the AV security provider on Windows servers?
Works fine on Windows workstations

Re: Cortex XDR Pro - Server installations - still running Windows Defender (not Firewall)

eumbach — Wed, 22 Feb 2023 20:36:35 GMT

Doesn't work that way on Servers. That's a microsoft thing.

Re: Cortex XDR Pro - Server installations - still running Windows Defender (not Firewall)

kindzma — Wed, 05 Jul 2023 20:54:13 GMT

Thanks for this!

Do they say or explain why (the integration is unavailable on Windows Servers)?

Is it a limitation of Windows Servers - or Cortex XDR - or of something in-between?

(Having this integration would save us a lot of time - else we'd have to figure out some sort of an automated process checking each and every Windows Server instance to see if XDR is running and if so, disable Defender.)