locked
Windows Defender ATP Scan failed RRS feed

  • Question

  • Hi Everyone,

    While i am trying to run a quick and full scan, The scan keeps failing on the remote system via the ATP portal. What could possibly be causing this ? Does ATP use the Portal login username to scan remote computer ?? Should we have local admin right on the system ??

    System = Windows 10 Enterprise

    Your help is much appreciated.

    Thanks,

    Syed


    • Edited by Syed Ali08 Wednesday, September 20, 2017 11:12 PM
    Wednesday, September 20, 2017 10:52 PM

Answers

  • Hi,

    When you run a scan operation from the portal, the local Defender AV starts scanning with a NT AUTHORITY\SYSTEMuser.
    To find the cause of the problem, check the log(Windows Defender from Application log on Event Viewer). Once you run the action you get few events on the Windows Defender log.

    Eli.


    Email:eshlomo9@hotmail.com;Twitter:https://twitter.com/EliShlomo1

    • Marked as answer by Syed Ali08 Thursday, February 1, 2018 6:42 AM
    Wednesday, October 4, 2017 10:32 PM

All replies

  • What error is being displayed?

    Is the device part of AD or AAD?

    Thursday, September 28, 2017 3:36 PM
  • Hi,

    When you run a scan operation from the portal, the local Defender AV starts scanning with a NT AUTHORITY\SYSTEMuser.
    To find the cause of the problem, check the log(Windows Defender from Application log on Event Viewer). Once you run the action you get few events on the Windows Defender log.

    Eli.


    Email:eshlomo9@hotmail.com;Twitter:https://twitter.com/EliShlomo1

    • Marked as answer by Syed Ali08 Thursday, February 1, 2018 6:42 AM
    Wednesday, October 4, 2017 10:32 PM
  • Its part Azure AD 
    Thursday, February 1, 2018 6:42 AM
  • Its part Azure AD 
    Thursday, February 1, 2018 6:42 AM