topic Re: Cisco AMP and Windows Defender in Endpoint Security

Cisco AMP and Windows Defender

JDoobs — Sat, 09 Mar 2019 01:46:53 GMT

We recently attended a "test drive" class for Cisco AMP where they mentioned that AMP was approved by Microsoft as a 3rd party AV client that should disable windows defender. I've linked the KB below. We have several test machines with AMP deployed that also have windows defender enabled by default in Windows 10. Does anyone have any insight into this?

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility

Re: Cisco AMP and Windows Defender

Marvin Rhoads — Tue, 27 Feb 2018 09:23:58 GMT

In order to replace Windows defender, the AMP policy for the endpoints must include the optional Tetra engine so that the ClamAV signatures will be downloaded and in effect.

Once you do that, Windows Defender Security Center will indicate that Virus and threat Protection is being provided by Cisco AMP for Endpoints.

Re: Cisco AMP and Windows Defender

wade — Thu, 22 Apr 2021 20:05:35 GMT

Does this disable Windows Defender completely?

Re: Cisco AMP and Windows Defender

rcarmack1 — Wed, 06 Oct 2021 16:49:55 GMT

Should the machine still run Windows Defender firewall?

Re: Cisco AMP and Windows Defender

mljevakovic — Wed, 06 Oct 2021 19:48:47 GMT

Hi,

I use Secure Endpoint (AMP) and Windows Firewall at the same time. And I had not any issue.

Re: Cisco AMP and Windows Defender

noc — Tue, 16 Nov 2021 15:48:17 GMT

I am finding that on Windows 10 multi-session ( 7.4.5.20701) and on Windows Server 2019 (7.3.9.20091) AMP/Endpoint Security is failing to register with Windows Security Centre - well WSC does not show AMP/Endpoint Security as the active AV, and Defender is still running. This has caused problems where both product ran scheduled scans at the same time. I read in the "Secure Endpoint (formerly AMP for Endpoints) User Guide, Last Updated: July 30, 2021" page 108 "IMPORTANT! Windows Defender cannot be automatically disabled in Windows Server versions 2016 and later. If you want to run TETRA on those operating systems you must disable Windows Defender manually."

So which is true, does 7.4.1 and later register with WSC regardless of Tetra, 7.3.9 depending on Tetra (which is enabled); or on Server 2016 and later, is that really broken? Windows 10 multi-session does report as a server OS in some regards. I am trying to understand if this is not working as expected (so we open a TAC call) or just how it is, bad luck.

Thanks.

Re: Cisco AMP and Windows Defender

mark.smith3 — Mon, 29 Nov 2021 18:53:03 GMT

We're experiencing a similar situation with our Windows 10 workstations; AMP is not registering itself as the primary av provider thus Windows Defender is not getting disabled.

Did your issue resolved, if so could you share?

Re: Cisco AMP and Windows Defender

vbespiritu — Tue, 30 Nov 2021 10:14:18 GMT

It is very innovative. Thank you.

Re: Cisco AMP and Windows Defender

gernot.schmied — Sun, 19 Dec 2021 09:01:09 GMT

Same problem here.

Re: Cisco AMP and Windows Defender

noc — Wed, 22 Dec 2021 10:53:31 GMT

It seems that Windows 10 multi-session behaves like a Windows Server build, and also lacks the service that allows Endpoint Security to notify the Windows Security Centre that it is running. There is a Microsoft article about Windows Defender and 3rd party anti-virus product co-existence:

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility?view=o365-worldwide

That is helpful but you just have to experiment.

Re: Cisco AMP and Windows Defender

gernot.schmied — Wed, 22 Dec 2021 16:04:42 GMT

Hi folks,

with the help of TAC this got resoved quickly. @noc : No, this is only the case for the server version and it was not Tetra-related.
In my case, the following solution worked (quoted from my TAC resolution), removing the registry key was essential:

I already finished to review the logs, It seems there is an issue with CiscoSCMS service:

(529562, +0 ms) Dec 18 21:54:47 [21304]: ERROR: AmpMonitor::ScmInstall: CreateService failed : 1073 : Der angegebene Dienst ist bereits vorhanden.

(529671, +0 ms) Dec 18 21:54:47 [21292]: ERROR: AmpMonitor::ScmProtect: ChangeServiceConfig2 failed : 5 : Zugriff verweigert

(529812, +16 ms) Dec 18 21:54:47 [27392]: ERROR: AmpMonitor::ScmStart: StartService failed : 2 : Das System kann die angegebene Datei nicht finden.

Action Plan

- Manually Uninstall completely the AMP connector

When this message appears, please select “NO”

- Verify if CiscoSCMS service remained in Windows services and remove the registry key manually using powershell commands with Administrator privlidges:

:\> set-Location HKLM:\system\currentControlSet\Services\

:\> Remove-Item .\CiscoSCMS_7.3.*

- Reboot the endpoint

Perform a full reboot, you can use the following command from CLI: shutdown -r or shutdown /r

- Download a fresh connector installer, install the connector again and verify if the issue persist.

Re: Cisco AMP and Windows Defender

Ken Stieers — Wed, 22 Dec 2021 16:13:08 GMT

Gernot,
To clarify... after installing using the new installer, AMP now disabled the Windows Defender on server OS?
Ken

Re: Cisco AMP and Windows Defender

mark.smith3 — Wed, 22 Dec 2021 16:19:43 GMT

We were able to resolve this issue by updating Windows Defender to version 4.18.2110.6. Once this was in effect all systems switched over to using AMP as the primary AV provider and disabled Windows Defender.

We did not have to make any registry changes. Hope you are able to find some success with this.

Cheers,

Mark

Re: Cisco AMP and Windows Defender

gernot.schmied — Wed, 22 Dec 2021 20:48:57 GMT

Hi Ken,

no, I am only talking about Windows 10 notebooks and workstations, not servers! However, you can happily run both, AMP now is the active (primary) one, as ist is supposed to be. Technically defender ist listed as inactive, but you can still let it run scheduled scans in addition. In the perception of defender it switches to inactive, because the main component "real-time protection" is disabled and taken over by AMP.

PS: Don't do that with Kaspersky, Avira or others, leads to all kind of unpredictable effects.

Hope that clarifies matters.

Regards, gernot

Re: Cisco AMP and Windows Defender

carlos.cordeiro — Mon, 10 Jan 2022 15:45:09 GMT

I am also having the same issue.

Re: Cisco AMP and Windows Defender

Troja007 — Tue, 11 Jan 2022 07:45:48 GMT

Hello,
latest releases should disable Windows Defender and register itself to the Windows Security Center as the AV vendor. Since connector version 7.4.1 Secure Endpoint registers directly after the installation of the product.

If Defender does not get disabled, please open a TAC case, so we can take a look if there is any issue.

Thanks and Greetings, Thorsten

Re: Cisco AMP and Windows Defender

serveurs — Wed, 19 Jan 2022 21:25:41 GMT

Hello,

We're having the same issue, it's working with 7.4.3, but 7.4.5 and 7.5.1.20833, both are never detected by the windows security center. I checked that all needed services are up. It's on a Windows 10 21H2 citrix virtual desktop built with Citrix app layering. The Cisco Secure Endpoint layer is installed with "/R /S /skiptetra 1 /skipdfc 1 /goldenimage 1".

Re: Cisco AMP and Windows Defender

johnosn — Fri, 21 Jan 2022 14:29:24 GMT

There was a bug in the 7.4.3 release of the Cisco Secure Endpoint Windows connector CSCvz12295. The connector would disable Windows Defender and Cisco Secure Endpoint would be listed even when the TETRA antivirus was disabled. This bug was resolved in version 7.4.5. Since you are not installing the TETRA antivirus engine, Windows Defender will continue to run to provide traditional antivirus detection.

Re: Cisco AMP and Windows Defender

sysnet_striver — Thu, 08 Sep 2022 15:15:15 GMT

Similar problem. I checked our Windows protect policy and the Tetra engine is enabled the convict modes for the connector all check out yet our Windows 10 workstations are showing Windows built-in Virus and threat protection and not Cisco secure endpoint even though the Connector is installed and has a status of Connected and policy has been synced. Connector version is 7.5.1.2. Maybe I have to enable Malicious Activity Protection for it to take over in our Windows workstations ?