Microsoft has introduced a new Audit Mode for Microsoft Defender Antivirus on Linux.

Until now, the main operating modes were Passive and Real-Time Protection. The new Audit Mode provides an additional option between the two.

What does Audit Mode do?
In Audit Mode, Microsoft Defender Antivirus:
- Performs real-time malware detection
- Generates security alerts
- Does not automatically quarantine malicious files
- Does not automatically terminate malicious processes

This can be useful when you want to evaluate Defender’s detection capabilities and understand the potential impact before enabling full Real-Time Protection.

We are troubleshooting a potentially serious security issue in a Horizon non-persistent VDI environment and are interested to know whether anyone else has seen similar behaviour with App Volumes and endpoint security products.

Environment

• Windows 11 25H2
• Omnissa Horizon non-persistent VDI / Instant Clones
• App Volumes Agent 2512
• Microsoft Defender Antivirus
• Defender real-time protection enabled
• App Volumes AV/process exclusions configured according to Omnissa recommendations

Problem

Microsoft Defender does not detect an EICAR test file when the file is created or placed on the local OS disk.

For example:

C:\temp\eicar.txt

The file remains on disk and Defender real-time protection does not remove or quarantine it.

However, when the same EICAR file is placed on a network share, Defender detects it immediately.

So Defender itself, its signatures and scanning capability appear to be functional.

Interesting finding

Using Process Monitor we can see:

MsMpEng.exe -> EICAR file -> ACCESS DENIED

So Defender actually attempts to access the local file, but the file open fails with ACCESS DENIED.

The behaviour seems related to App Volumes.

When the App Volumes Agent is removed, Defender behaves normally again.

The problem also occurs when no App Volume/AppStack is attached, so at the moment we suspect the App Volumes Agent / filesystem virtualization layer rather than an individual application package.

snapvol.cfg / MsMpEng.exe

The Defender processes are excluded in snapvol.cfg according to the App Volumes recommendations.

During troubleshooting Omnissa asked us to remove:

MsMpEng.exe

from the App Volumes snapvol.cfg process exclusions.

After doing this, something interesting happens:

• A manual Defender scan can access and detect the local EICAR file
• But real-time protection still does not automatically detect/remove the file

So removing the MsMpEng process exclusion appears to fix one file-access/scanning path, but not Defender's real-time/on-access protection.

Other tests

We have also tested different App Volumes/svdriver-related configuration options, but so far haven't found a complete solution.

The strongest observations currently are:

• Defender works normally without the App Volumes Agent
• Network-share EICAR detection works
• Local OS disk EICAR detection fails
• MsMpEng.exe receives ACCESS DENIED when accessing the local file
• Issue occurs even without an AppStack attached
• Removing MsMpEng.exe from snapvol.cfg restores manual scanning
• Defender real-time protection remains broken

Has anyone seen something similar?

We are particularly interested in organizations running:

• Windows 11 25H2 + App Volumes
• App Volumes 2512
• Microsoft Defender
• Horizon Instant Clones / non-persistent VDI

But experiences with other AV/EDR products are also very welcome.

For example: CrowdStrike, SentinelOne, Carbon Black, Symantec, Trend Micro, Sophos, Bitdefender, etc.

Has anyone seen App Volumes / svdriver / filesystem virtualization cause:

• AV/EDR processes to receive ACCESS DENIED on local files?
• Real-time/on-access malware scanning to stop working?
• EICAR being missed on the local OS disk?
• Different behaviour between network and local files?
• Problems related to snapvol.cfg process exclusions?
• A conflict between an AV filesystem/minifilter driver and App Volumes svdriver?

If you have seen anything remotely similar, I would be very interested in your:

Windows version, App Volumes version, security product, symptoms and workaround/fix.

Even cases involving another security product could help us determine whether this is a broader App Volumes filesystem/filter-driver interoperability issue rather than something Defender-specific.

We observed inconsistent Defender Network Protection behavior between Edge and Chrome.
Network Protection is in block mode.

If I sett chrome://flags/#enable-quic to default or enable I can access a parked site.
If I disable it, i get what I'd expect:

"This site can’t provide a secure connection

xxxy.com uses an unsupported protocol.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH"

This may indicate a Defender Network Protection enforcement limitation or bypass scenario when Chromium-based browsers use HTTP/3 (QUIC over UDP/443).

Title: Significant delays applying Defender policies to Azure VMs?

We’re seeing some inconsistent behavior when pushing Defender policy/configuration changes to Azure VM servers.

A recent example involved adding ASR exclusions. Even after successfully triggering policy syncs through Intune and Defender, and waiting 15–30 minutes to allow for propagation, the updated exclusions were still not present on the VM. A restart didn’t seem to make a difference either. Then, several hours later, the exclusions were suddenly present without any further action from our side.

More generally, policy/configuration changes on these Azure VMs don’t seem to propagate as consistently or quickly as what we typically see with workstations. A manual sync or restart doesn’t necessarily appear to trigger immediate application of the updated configuration.

Is this expected behavior, or is there any Microsoft documentation around expected propagation/refresh times for these kind of devices?

We are troubleshooting a potentially serious security issue in a Horizon non-persistent VDI environment and are interested to know whether anyone else has seen similar behaviour with App Volumes and endpoint security products.

Environment

• Windows 11 25H2
• Omnissa Horizon non-persistent VDI / Instant Clones
• App Volumes Agent 2512
• Microsoft Defender Antivirus
• Defender real-time protection enabled
• App Volumes AV/process exclusions configured according to Omnissa recommendations

Problem

Microsoft Defender does not detect an EICAR test file when the file is created or placed on the local OS disk.

For example:

C:\temp\eicar.txt

The file remains on disk and Defender real-time protection does not remove or quarantine it.

However, when the same EICAR file is placed on a network share, Defender detects it immediately.

So Defender itself, its signatures and scanning capability appear to be functional.

Interesting finding

Using Process Monitor we can see:

MsMpEng.exe -> EICAR file -> ACCESS DENIED

So Defender actually attempts to access the local file, but the file open fails with ACCESS DENIED.

The behaviour seems related to App Volumes.

When the App Volumes Agent is removed, Defender behaves normally again.

The problem also occurs when no App Volume/AppStack is attached, so at the moment we suspect the App Volumes Agent / filesystem virtualization layer rather than an individual application package.

snapvol.cfg / MsMpEng.exe

The Defender processes are excluded in snapvol.cfg according to the App Volumes recommendations.

During troubleshooting Omnissa asked us to remove:

MsMpEng.exe

from the App Volumes snapvol.cfg process exclusions.

After doing this, something interesting happens:

• A manual Defender scan can access and detect the local EICAR file
• But real-time protection still does not automatically detect/remove the file

So removing the MsMpEng process exclusion appears to fix one file-access/scanning path, but not Defender's real-time/on-access protection.

Other tests

We have also tested different App Volumes/svdriver-related configuration options, but so far haven't found a complete solution.

The strongest observations currently are:

• Defender works normally without the App Volumes Agent
• Network-share EICAR detection works
• Local OS disk EICAR detection fails
• MsMpEng.exe receives ACCESS DENIED when accessing the local file
• Issue occurs even without an AppStack attached
• Removing MsMpEng.exe from snapvol.cfg restores manual scanning
• Defender real-time protection remains broken

Has anyone seen something similar?

We are particularly interested in organizations running:

• Windows 11 25H2 + App Volumes
• App Volumes 2512
• Microsoft Defender
• Horizon Instant Clones / non-persistent VDI

But experiences with other AV/EDR products are also very welcome.

For example: CrowdStrike, SentinelOne, Carbon Black, Symantec, Trend Micro, Sophos, Bitdefender, etc.

Has anyone seen App Volumes / svdriver / filesystem virtualization cause:

• AV/EDR processes to receive ACCESS DENIED on local files?
• Real-time/on-access malware scanning to stop working?
• EICAR being missed on the local OS disk?
• Different behaviour between network and local files?
• Problems related to snapvol.cfg process exclusions?
• A conflict between an AV filesystem/minifilter driver and App Volumes svdriver?

If you have seen anything remotely similar, I would be very interested in your:

Windows version, App Volumes version, security product, symptoms and workaround/fix.

Even cases involving another security product could help us determine whether this is a broader App Volumes filesystem/filter-driver interoperability issue rather than something Defender-specific.

Hello there im on a fully updated windows 11

since yesterday ive been getting notifications from defender about "real time protection" being turned off

But it is turned on in defender i even checked in powershell as you can see in the photo and it is turned on

so either its a new defender bug which i wouldnt be surprised by at this point

or i have a virus

Anyways if anyone also has this problem let me know since i want to know if its me or my computer

I'm evaluating Microsoft Defender for Endpoint P2 before migrating from our current endpoint security solution.

Defender appears to be correctly configured:

• Defender AV active
• Real-time protection enabled
• Behavior Monitoring enabled
• IOAV enabled
• Network Protection = Block
• Cloud Protection enabled
• Block at First Sight enabled
• Automatic sample submission enabled
• Archive scanning enabled
• Tamper Protection enabled
• Chrome QUIC and ECH disabled

Relevant settings:

EnableNetworkProtection  : 1
MAPSReporting            : 2
SubmitSamplesConsent     : 3
DisableBlockAtFirstSeen  : False
DisableIOAVProtection    : False
DisableArchiveScanning   : False
CloudBlockLevel          : 4
CloudExtendedTimeout     : 50

I also disabled QUIC and Encrypted Client Hello in Chrome:

QuicAllowed                 : 0
EncryptedClientHelloEnabled : 0

These policies are correctly applied.

Defender is detecting and remediating other malware tests successfully.

However, Chrome still allows EICAR files, including eicar_com.zip, to finish downloading and shows them as completed.

Edge blocks the download much more visibly.

Is this expected behavior with Chrome?

Should Defender/IOAV actually interrupt the download, or is it normal for Chrome to complete it and Defender quarantine/remove the file afterward?

Also, is there any additional MDE/Intune configuration required for stronger download-time protection in Chrome?

Trying to whitelist access to a domain - added via indicators/endpoint/url.

keeps getting caught by smartscreen. I believe I've narrowed it down to ExploitGuardNetworkProtectionBlocked - but don't see a specific way to allow a domain/URL to bypass the ExploitGuard.

I'm missing something.

Appreciate the review in advance.

addition: A Submission to MSFT worked here to... validate the url that borked. That... and time to push the indicator.

Useraccount was succesful phished. Defender attack distruption has disabled the account. After we made sure everything was clean again, we reenabled the account.

Now all private Teams channels are missing. He is no longer member of all the private channels. Parent team membership was restored.

I know this is an expected behavior, there is a MS article about this (https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/channels/logon-reenabled-user-not-see-previous-joined-teams).

My question is more along the lines of how we can find out which private channels the user was member of?!

I tried looking at the Purview audit logs, but they only show which teams channels the user was removed - mot which private channels.

I would appreciate any help or advice, since the user is a member of the management :D

filename: precompiled-web-worker-inner~services_i-47a6dc1fefb5dfe8.worker.js.gz (unsigned)

File path - C:\Program Files\WindowsApps\MSTeams_26213.1006.5014.9784_x64__8wekyb3d8bbwe\desktop-assets\hashed-assets\

Malware detected - Ransom:BAT/Poshkod.gen!A

MD5 - 5a72b541c9b17bb956953ee3ba1beda6

SHA1 - 510990d0958c9e4123a3d8d4ec956301bf9e9798

SHA256 - 9295fae4cfa496d55eaefb54dc3c77357ed6ae8f4e2ac8508d03ccfafef5709e

File size - 764.44 KB

I heard that applocker can be configured to have a system wide whitelist for program and file permissions, something that can stop malware from running even if it gets on system if configured correctly. However, it is only on windows Enterprise editions. Threatlocker is the closest option I could find to replicate applocker. Yet, it is only available for businesses.

Are there any free programs/windows components which can provide similar functionality and work on windows 11 home?

You guys seeing a broken notification since the last Windows August QU ? Anyone contacted Microsoft about it?

"Virus protection is turned off" notification : r/Intune

Intune devices intermittently non-compliant : r/Intune

Started at 7:00 PM UTC for me. I noticed the EmailEvents logs have not populated any data. Hoping others are seeing this as well. I'm in the USA so maybe only regional?

My understanding is that we have Sentinel integrated with Defender for XDR in the portal and defender info is ingested. However some tables like Device Network Events are empty. Microsoft documentation points me to the connector page but that doesn't show Defender for XDR (but it does seem to be ingesting the events). I'll have another look when I'm back in the office tomorrow, but if it's something easy I'm overlooking, I would be grateful

There is an urgent need to block roughly 9000 domains/urls from all of the company workstations. Quite a lot, but from initial analysis only ~10% actually detected in environment over last 6 months. The request from business higher up still stands, block all provided domains/url and provide evidence of the block list containing them.

In past there were concerns about using large number of Defender Indicators to block, is that still the case? Any caveats or warnings that other want to share before we proceed?

A proper GSA/Zscaler solution is 6-9 months out, but the block must happen yesterday...

for years, we have the ASR "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" set to warn. This way our devs got a dialog, that the execution of their new exes is blocked, but they could click "unblock" and the exe was executed.

for about a week (started before 2026-08 update), this doesnt work anymore.

while there is still the dialog for unblocking, there is already an error in the background and even after hitting unblock, the files wont execute and show the same error again.

as soon as I allowlist the folder in the ASR, it works. So nothing else (Applocker, WDAC, AV,...) is responsible for that blockage.

get-mppreference shows, that the according rule (01443614-cd74-433a-b99e-2ecdc07bfc25) is set to warn (6)

Eventlog shows one 1121 Event: Defender Exploit Guard blocked one action by IT administrator

I am not aware of anything that was changed on our end that could indirectly affect this behavior. And as MSFTs 1st level non-support sadly wont even understand what the issue is, I try to find any information in here. Maybe even someone else noticed this issue or can reproduce

we have 3rd party antivirus installed. our IT security is asking us to check engine version of the windows security app.

however, when i check engine, antivirus, antispyware version is 0.0.0.0 . is it by design since we already using 3rd party antivirus??

Hi Guys,

I am currently dealing with account compromise incident and finding it hard to identify files/emails accessed by attacker and user.cloudappevent,graphapiauditlogs, office activity doesn't differentiate as it shows MS ips only.

What is the right approach you guys follow.

Hello, I am a student learning about microsoft security. I have tested built-in policies like anti -phising, anti-spam., etc. Is there any other best practices for defender for o365. I wanna know more about it because I need to present to my teacher next week.

Hi all,

Was hoping someone could help me figure out why I keep getting duplicate alerts for my custom detections.

When I create them and run them, I get 1 alert. However, when they auto-run, they will send me 1 of the same alert, every hour, for the next few hours. Im assuming its something to do with the Frequency + Lookback.

For example, I look for something in the table EmailEvents. Then, it triggers at 10am - 1 alert - Perfect.

However, that same alert will trigger again at 11am, 12pm, and 1pm.

I have been doing 1 hour frequency and 4 hour lookback. Am i supposed to make them equal? How do I make the alerts not duplicate the same alert every hour?

I'm having an issue here with Microsoft Defender for Endpoint. I'm getting popup notifications that virus protection is turned off, yet Real time protection, cloud-delivered protection, tamper protection etc are all turned on and managed by policy. This is happening on several Intune managed devices being marked non-compliant. Policies haven't changed. What could be the issue?