Onboarding Hosts to Defender

Obtain the list of assets that do not require onboarding to Defender for Endpoint.

Overview

It's important to have an inventory of assets that require and do not require onboarding to Defender for Endpoint. In this guide, you’ll complete the following steps to obtain the required lists:

• List of devices already onboarded to Defender for Endpoint
• List of devices registered on the organization
• Devices managed by Intune
• Local script
• Group Policy

List of devices already onboarded to Defender for Endpoint

1. Access the www.security.microsoft.com portal.

2. On the left menu, click Devices.

3. On the Computers & Mobiles tab, you will see a list of the devices already registered on Defender for Endpoints.

4. Click the Export button to export the current view in order to compare with the list of managed devices in the organization.

List devices registered on the organization

If the devices are registered on Azure Entra ID (Azure AD), then complete the following steps:

Devices managed by Intune

If the devices are managed by Intune, then complete the following steps:

1. Access the www.security.microsoft.com portal.
2. On the left menu, click Devices, then click All devices.
3. This page provides the list of devices managed by Intune.
4. Click the Export button to export the current view in order to compare with the list of devices onboarded into Defender for Endpoint.

In case your organization has an on-premises Active Directory, get the list of registered computers by running the following command via Powershell on the AD:

Get-ADComputer -Filter * -Properties  * | Select Name, DistinguishedName

Requirements for onboarding devices to Defender for Endpoint

There are some requirements for onboarding devices to the Defender for Endpoint service.

• For information on software requirements, check out Microsoft documentation.
• Access to a global admin or security administrator account
• List of devices to onboard from previous step

For Windows devices we have the following onboarding methods available:

• Local script (up to 10 devices)
• Group Policy
• Microsoft Intune
• Mobile Device Manager
• Microsoft Configuration Manager
• VDI Scripts

Since some methods are heavily dependent on an organization's architecture and configuration, we'll only cover the first two onboarding methods: local script and group policy. For more detailed information on the other methods, please refer to the Microsoft documentation.

Local script

This is usually used to test the onboarding process and to onboard test devices.

1.  Access the www.security.microsoft.com portal.
2.  On the left menu, select Settings > Endpoints > Device management > Onboarding.
3.  In the Select the operating system drop-down, select the operating system. 4.  In the Deployment Method drop-down, select Local Script and then click Download onboarding package.

5.  Save the file and extract its content on the device you want to onboard. You should have a file named WindowsDefenderATPLocalOnboardingScript.cmd.

6.  Hit the Windows Key and type CMD, then click on Run as administrator.

7.  Type the path to the extract file with WindowsDefenderATPLocalOnboardingScript.cmd at the end to run the script.

8.  Wait until the script finishes the onboarding process and then access the security portal and check if the device is listed under Assets > Devices.

Group policy

This method uses a group policy to deploy and run the onboarding script on the selected devices.

1.   Access the www.security.microsoft.com portal.
2.   On the left menu, select Settings > Endpoints > Device management > Onboarding.
3.    In the Select the operating system drop-down, select the operating system. 4.   In the Deployment Method drop-down, select Group Policy and then click Download onboarding package.
5.   Click Download onboarding package and save the .zip file.
6.   Extract the contents of the .zip file to a shared, read-only location that can be accessed by the devices being onboarded. You should have a folder named OptionalParamsPolicy and the file WindowsDefenderATPOnboardingScript.cmd.
7.   To create a new GPO, access your Active Directory and open the Group Policy Management Console (GPMC), right-click Group Policy Objects you want to configure and click New. Enter the name of the new GPO in the dialogue box and click OK.
8.   Open the Group Policy Management Console (GPMC), right-click the Group Policy Object (GPO) you want to configure and click Edit.
9.   In the Group Policy Management Editor, go to Computer configuration, then Preferences, and then Control panel settings.
10.   Right-click Scheduled tasks, point to New, and then click Immediate Task.
11.   In the Task window, go to the General tab. Under Security options click Change User or Group and type SYSTEM. Click Check Names then click OK. NT AUTHORITY\SYSTEM appears as the user account that the task will run as.
12.   Select Run whether user is logged on or not and select the Run with highest privileges checkbox.
13.   In the Name field, enter an appropriate name for the scheduled task (for example, Defender for Endpoint Deployment).
14.   Go to the Actions tab and select New. Ensure that Start a program is selected in the Action field. Enter the UNC path using the file server's fully qualified domain name (FQDN), along with the full path to the WindowsDefenderATPOnboardingScript.cmd file. Example:  \\\\Server2.mydomain\\Share\\Test\\WindowsDefenderATPOnboardingScript.cmd
15.   Select OK and close any open GPMC windows.
16.   To link the GPO to an Organization Unit (OU), right-click and select Link an existing GPO. In the dialogue box that is displayed, select the Group Policy Object that you wish to link. Click OK.

We value your opinion. Did you find this article helpful? Share your thoughts by clicking here or reach to our Product and Customer Success teams at support@radiantsecurity.ai 

Last updated: 2024-09-24