none
Remove Windows Defender ATP RRS feed

  • Question

  • Hi Folks,

     

    In a situation where a customer was trialling Windows Defender ATP, then their ATP license expired, but they didnt offboard their devices. So it appears the Windows Defender ATP services are still installed. As the license is no longer valid, and it's been over a year since it was,  the offboarding scripts/packages are no longer available.

     

    Any suggestions on how to remove the services and software from the devices?

     

    Cheers,

     

    Johno

    Sunday, May 12, 2019 11:40 PM

All replies

  • You can manually offboard the device by:

    1. Updating the registry value at the below path from 1 to 0:
      Path: “HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status” Name: “OnboardingState”
    2. Clearing the registry value at the below path:
      Path: “HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status” Name: “OrgId

      and,

    3. Rebooting the system.

    Hope this helps.

    • Proposed as answer by Ben.Paul Tuesday, August 13, 2019 7:45 AM
    Tuesday, August 13, 2019 7:45 AM
  • After trying manually ofboarding as suggested OrgId keeps reappearing and ATP service does not stop after reboot

    Please advice

    I want to offboard and onboard on a new subscription but everything fails

    Monday, November 18, 2019 9:06 PM
  • are the machines being onboarded by a group policy onboarding script or Intune?  If you manually offboard but the GPO/Intune policies are still applying, it will re-onboard the machines.
    Friday, December 13, 2019 2:26 PM