You probably know that updating machines is not the only security
activity that's required here for our computers.
Also necessary is making sure that these machines have the appropriate
antivirus and antimalware signatures constantly being updated.
And, there again, are various ways in which you can accomplish that.
But for your personal desktops, you can use,
for example,
Intune and specifically Endpoint security there in Intune to deploy down then
the configuration here for Microsoft Defender Antivirus.
That involves a configuration manager server,
which I don't have here for the environment.
But at least here in Intune,
let's take a look back here in Endpoint security and here under
Antivirus where we can see then the configurations where we want
to set up Microsoft Defender Antivirus.
That process starts by creating a policy down here,
and I already have one here,
but I want to walk you very specifically through just some of the
settings that exist here for our Windows 10 policies.
Now down here,
let's define one here for Microsoft Defender Antivirus.
And for that we'll see then, if I punch in the bogus
information there and choose Next,
the different configuration settings that we can apply.
These are the classic configurations you've probably worked with before in
your antivirus solutions like turning on cloud‑delivered protection and
what kinds of exclusions do you want to configure and if you should turn
on real‑time protection here. There are some best practices in VDI
environments as to whether or not you should turn on real‑time protection
or, as the machine boots up, catching up that antivirus protection for
those machines, even remediation actions right down here.
But really what I want to take you down to here too is Updates.
Right here is where we have an option for defining a file share for
downloading definition updates right here.
And if we choose the down arrow,
this is where we can define then what that file share should be.
I show you this because there is a special configuration here specific
generally to VDI machines, but you can apply it anywhere, that you may want
to consider using that defines this local file share generally there in
Azure where you'll manually update your signatures. The virtual machines
here in the host groups will then look to this location instead of the
internet for their signatures.
Now the nice part here is that it reduces the resource load on
these machines for updating their signatures.
And if you're using golden images, golden templates there for updating,
it can also eliminate the need to provision new
templates for every definition update cycle.
Now if you're curious of the details of how to actually accomplish this,
there is a web page I forgot to include up here at the
top titled, as you can see here,
the Deployment guide for Defender Antivirus in a VDI environment. And
quickly scrolling down here, I'll show you that you do need to set up
that dedicated VDI file share, we know how to do that here, and then
use Group Policy or PowerShell to enable that shared security
intelligence feature.
This is functionally equivalent to what I just showed you there in
Intune. And then a bit further down here is the steps or are the steps
for downloading and unpackaging those latest updates. This provides a
nice script here to accomplish the task,
but you can also perform this manually if you want to.
So this is just one way for you to create a local location and
manually then update that location so these VDI images can then
update their antivirus signatures.
And while we're here,
I feel I can't really talk about Microsoft Defender Antivirus without at
least putting in a plug for Microsoft Defender for Endpoint, which I
recognize is a very closely named solution, and Microsoft security
solutions are perhaps too closely named.
But I do want to talk a bit about Microsoft Defender for
Endpoint because if you've got that M365 E5 developer
subscription that you set up for your lab,
it's possible also to set up a trial subscription here to
Microsoft Defender for Endpoint so you can see some of the
other really cool things that it does.
What I first need to tell you is that Microsoft Defender Antivirus, If I
scroll down here, is one of the six components that makes up Microsoft
Defender for Endpoint. It is specifically the next‑generation protection item
right down here. And once you get out of that,
if you have that developer subscription or if you already have E5 licenses,
is that back here in your M365 admin console, it gives you access down here
to the security admin center right down here.
This security admin center,
if I actually click over to it, presents me with a much
greater list of options here for managing the security
profile for my different machines.
I actually just talked about this for another learning path here for the
MS101 exam, and so I've had a lot of experience in setting this up here very
recently. And without getting into the details, if you want to learn more
about how this M365 security console works and all the really cool things it
does, take a look at that course over at the MS 101 path. But the only thing
I want to show you is that if we come down here to our Settings right down
here,
if you come down here to Settings and then here to Endpoints and then, lastly,
right down here in Endpoints all the way at the bottom here for Onboarding, the
process to onboard these different machines here into MDE, so Defender for
Endpoint and not just Defender for Antivirus,
we have some mechanisms to onboard these different devices. And the
only one I want to show you right down here is that there are
actually some really cool scripts here for onboarding VDI machines
that are non‑persistent VDI desktops.
So without going into much more detail here,
I just mostly wanted to show you that if you want to go much
beyond then Microsoft Defender Antivirus,
the entire Microsoft Defender for Endpoint solution is a great way
to centralize many of these different security configuration requirements into one single pane of glass.