Windows Defender has gone from useless to top tier. Learn how to configure multi-tenant command and reporting with RocketCyber
Microsoft has continually advanced its threat protection of devices with Windows Defender. Since Windows 8 and especially with Windows 10 and later the advanced capabilities to protect the Operating System and user from malicious threats has improved dramatically.
MSPs have not embraced Windows Defender because it lacks multi-tenant management capabilities.
The first thing needed is to deploy the RocketCyber agent to all devices you wish to control.
1. Log on to the RocketCyber console
2. From the left-hand navigation menu click All Customers.
3. Click Deploy for the appropriate customer.
From the deployment screen, choose the option that is best for your environment. There are integrations with most of the popular RMM tools which can deploy the agent.
Enable the Defender Manager RocketApp
After you've deployed the agents, the next step will be to Enable the Defender Manager app.
1. From the left-hand Nav click on App Store
2. On the Defender Manager App Tile, switch the App status to ON
On the left-hand navigation menu, you should now see a new item for Defender Manager.
Configuring the Defender Manager Settings
You are now ready to configure the settings that control Windows Defender.
1. From the left-hand navigation menu click on Dashboard.
2. From the Defender Manager App Card, click on Configure
The Defender Manager Configuration dialog presents a series of tabs that control the behavior of various characteristics of Windows Defender.
General - Includes options for controlling UI elements and signature updates.
Real-time Protection - Includes options for enabling various real-time protection options.
Cloud Protection - Includes options for protection delivered from the Microsoft cloud to your endpoints.
Scans - Includes options for when and how to scan devices.
Threat Actions - Includes options for tailoring automatic threat responses.
Advanced - Includes options for Attack Surface Reduction and Advanced Threat Protection.
Exclusions - Includes options for whitelisting processes and files.
The RocketCyber console provides a default configuration that should be useable by most customers without modification.
More details about the default configuration can be found here
Review all of the default configuration options and tailor them to suit your customer environment. When finished Click Update.
Make The Big Switch
Now that you've tailored the configuration options, it's time to switch on Microsoft Defender.
1. From the Defender Manager App Card, click on Configure
2. In the General Tab, Click Enable Windows Defender.
3. Click Update
Congratulations, your devices are now protected by Windows Defender and RocketCyber!
By performing this step you effectively have laid down the configuration and staged Windows Defender. If there is already another active AV client on the device, Windows Defender won't be active until that AV client is removed. To fully activate Windows Defender uninstall the current AV solution. For details on uninstalling the current AV/ATP solution refers to the vendor's instructions.