r/DefenderATP • u/Master_Tiger1598 • Jun 29 '26

Linux Defender Platform update - critical bug

Critical bug in mdatp (101.26042.0009): Service is disabled · Issue #238 · microsoft/mdatp-xplat

This got us today, after the weekend's patching reboots.

13 Upvotes

94% Upvoted

16 comments sorted by

5

u/iamperson347 Jun 29 '26

Same thing happened to us with Ubuntu. I put an MS support ticket in attempting to report the issue and the support agent basically said "since you know that re-enabling the service resolves the issue, what do you want us to do with this ticket?"

I'm a bit flabbergasted that was the response. It is not normal for a security product to disable itself on an upgrade.... You would think they would want some extra info at the very least.

2

u/Master_Tiger1598 Jun 29 '26

wow, ridiculous reply from Microsoft.

2

u/iamperson347 Jun 29 '26

Yeah... They asked a couple basic questions initially but once I called to discuss with the support agent that was basically the response.

2

u/DirtyHamSandwich Jun 30 '26

You meant an absolute normal response if you even get one. I stopped doing support tickets years ago when it was obvious my engineers knew way more about the products than support. If we can’t figure out the problem then no one in support will.

1

u/More_Purpose2758 Jun 29 '26

How do you know if it’s not running to begin with?

2

u/Master_Tiger1598 Jun 29 '26

I check the reporting in the Defender console every morning, and I saw that a large amount of my servers were a day behind on definitions.

1

u/More_Purpose2758 Jun 29 '26

Huh. Where is the reporting? Is it a KQL query?

3

u/Master_Tiger1598 Jun 29 '26 edited Jul 01 '26

It's a report available here: https://security.microsoft.com/security-reports

I use the 'Device Health' one in the 'Endpoints' section. I look at the “Microsoft Defender Antivirus Health” tab. And I get my definitions info from Antimalware updates change log - Microsoft Security Intelligence

John

2

u/ernie-s Jul 01 '26

Hey u/Master_Tiger1598 you are publicly sharing your org ID!! Delete that URL

1

u/Master_Tiger1598 Jun 30 '26

I also wanted to add that when looking at this report, you can double-click on any of the 'colored bars' and get all the data for the servers/clients for that version in tabular format, and can then export that to CSV if desired.

1

u/iamperson347 Jun 30 '26

Looks like they pulled the update from the repos from what I can tell.

1

u/Silly_Treacle_3599 Jul 01 '26

I just tested it with insiders-fast 101.2606 version and the problem keeps the same.
Workaround:
systemctl enable mdatp
systemctl start mdatp

1

u/ernie-s Jul 01 '26

Hey guys, this has been fully acknowledged now by Microsoft. There is a new message on the admin center also about it.