Windows 10: Windows Defender and Microsoft's E5 for ATP products

Scenario:- I have 2000 windows workstations( windows 8.1 on 1000 and windows 10 on the remaining workstations). Default windows Defender enabled and running on all of the 2000 workstations. I purchased Microsoft E5 licenses so i can use some of its ATP products/capabilities on 500 of my high priority workstations( that are a mix of 8.1 and 10)


Questions:-


1. If i decide to use 500 of the E5 license over 250 of my windows 8.1 and 250 of windows 10 workstations, will the Defender that is enabled and running gets disabled automatically after the E5 license is enabled for those workstations?

2. Once I use those 500 workstations ( mix of 8.1 and 10) to be covered by E5 for ATP, is there an agent related to E5 that gets installed on these 500 workstations so that they can be centrally managed by Microsoft's SaaS ATP console ?

3. Can both Defender and E5 (ATP) be enabled and co-exist at the same time on the workstation?

4. Also, if i decide to have a third party endpoint security solutions ( for example , carbon black, trendmicro....etc) agent installed on one of the 500 high priority workstations, I am aware that the default defender gets disabled automatically, what about the E5 ATP that its covered by, how will that get affected?

:)

 

Windows Defender Advanced Threat Protction (ATP)

Its only available to volume license customers subscribed to one of Microsofts licensing programs.

Applies to:

Windows 10 Enterprise

Windows 10 Education

Windows 10 Pro

Windows 10 Pro Education

Windows Defender Advanced Threat Protection (Windows Defender ATP)

There are some minimum requirements for onboarding machines to the service.

Want to experience Windows Defender ATP? Sign up for a free trial.

https://www.microsoft.com/en-us/WindowsForBusin...

Licensing requirements

Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers:

Windows 10 Enterprise E5

Windows 10 Education E5

Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5

For more information, see Windows 10 Licensing.

https://www.microsoft.com/en-us/Licensing/produ...

Source:
https://docs.microsoft.com/en-us/windows/securi...

 

Windows Defender ATP.

Windows Defender ATP isn't protection, rather it's more after the fact forensics. Any sized firm can run ATP as you can enable it on Windows 10 pro with merely a script. What you have to have is a Windows E5 subscription license which now is sold in single
units by cloud service providers.

The naming of "Windows defender ATP" is IMHO a bad marketing name. It doesn't defend. It reports. It helps an admin understand when intrusions take place what IP the workstation talked to and what may have occurred but it still takes a technical person
to interpret the findings.

 

Defender ATP

Hi,



Thank you for writing to Microsoft Community Forums.



Usually we do not suggest to disable Windows Defender feature, Windows Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents, and improves security posture. However, if you
still wish to disable it, please follow the steps mentioned below and check if it helps:

1. Open Windows Settings (Windows key + I).
   
2. Then click on Updates & Settings.
   
3. Then click on Windows Security.
   
4. You can disable Cloud based and automatic submissions.
   

If you need any additional assistance, then please write back with the following information:

1. What is the exact error message which you are getting?
   
2. Is the issue specific to an application?
   
3. Could you please
   post a screenshot for a better understanding?
   

Regards,