This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Windows Defender not detecting that Sophos for Virtual Environments is installed

We recently installed Sophos for Virtual Environments on ESXi 6.5 and installed the Guest service on a Windows Server 2016 box. Windows Defender is still not detecting that an Anti-Virus is installed. I confirmed that it was working by testing against the IECAR test. Has anyone run into this issue where Security Center does not detect an Anti-Virus as being present?

This thread was automatically locked due to age.

Parents

0 StephenMcKay over 6 years ago

Hello,

This is true for Server 2016; https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016

Basically, changes were made that make removing Defender more difficult for 3rd party AV.

This KBA https://community.sophos.com/kb/en-us/125679 should provide details of checking your Guest VMs

Stephen
Cancel
Vote Up 0 Vote Down

Cancel
0 KyleGilpin over 6 years ago in reply to StephenMcKay

Stephen,

When I install the full Sophos client on Windows Server 2016, Defender automatically recognizes that I have another anti-virus installed and disables itself. I am not meaning removing Defender but rather disabling it. So are you saying that Sophos for Virtual Environments is a different from the full Sophos client in that defender does not recognize it as a anti-virus solution because this link (https://www.sophos.com/en-us/medialibrary/PDFs/factsheets/sophos-virtualization-security-dsna.pdf?la=en) specifically mentions that it has integration with Windows Security Center?

-Kyle
Cancel
Vote Up 0 Vote Down

Cancel
0 StephenMcKay over 6 years ago in reply to KyleGilpin

Kyle,

I'll need to check with the development team, it certainly was the case that the behaviour of Defender and System Center changed in Server 2016

On Windows Server 2016, Windows Defender AV will not enter passive or disabled mode if you have also installed a third-party antivirus product. If you install a third-party antivirus product, you should uninstall Windows Defender AV on Windows Server 2016 to prevent problems caused by having multiple antivirus products installed on a machine.

https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility

Stephen
Cancel
Vote Up 0 Vote Down

Cancel
0 MarkToshack over 6 years ago in reply to StephenMcKay

Hi KyleGilpin

After investigation it seems you have found a small bug. We have logged this and will put it in the next available release.

Unfortunately it will not be in SVE 1.2, as we have passed development stage, but we will aim for the next maintenance update.

Thanks

Mark
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 MarkToshack over 6 years ago in reply to StephenMcKay

Hi KyleGilpin

After investigation it seems you have found a small bug. We have logged this and will put it in the next available release.

Unfortunately it will not be in SVE 1.2, as we have passed development stage, but we will aim for the next maintenance update.

Thanks

Mark
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data