Microsoft says Defender for Endpoint now comes with a new ‘troubleshooting mode’ that will help Windows admins test Defender Antivirus performance and run compatibility scenarios without getting blocked by tamper protection.
The new mode is available in public preview and it enables admins to disable or change the tamper protection setting while diagnosing false-positive application blocks or performing performance troubleshooting
This Enterprise-only feature is disabled by default and, according to Microsoft, it requires Microsoft 365 Defender access.
Also Read: Compliance Course Singapore: Spotlight on the 3 Offerings
“Introducing troubleshooting mode, a unique, innovative, and secure way to investigate and adjust configurations on your devices,” Microsoft’s Juli Hooper explained.
“This mode will enable the local admin on the device to override Microsoft Defender Antivirus security policy configurations on the device, including tamper protection.”
To try this new feature in preview, you need:
You can enable troubleshooting mode by going through the following procedure:
Admins have 3 hours to adjust and test the system’s configuration to match their organization’s environment after enabling troubleshooting on a specific endpoint.
Troubleshooting mode scenarios available for Microsoft Defender for Endpoint include:
Once the testing window closes, all security settings configured before troubleshooting mode was enabled will be restored.
Also Read: Considering Enterprise Risk Management Certification Singapore? Here Are 7 Best Outcomes
Also, any new security policies created by the organization’s security or IT admins will be applied automatically (they would be blocked during the troubleshooting process).
“Additional diagnostic files will be available for collection after troubleshooting mode. Your security admin can collect the diagnostic files by using the Collect Investigation Package feature,” Hooper added.
“The files include a before and after snapshot of the MpPreferences and the MpLogs during the troubleshooting window.”
Microsoft also provides additional info on what you need to know before enabling this new mode here and on available scenarios here.