Microsoft Defender for Endpoint gets new troubleshooting mode

Microsoft says Defender for Endpoint now comes with a new 'troubleshooting mode' that will help Windows admins test Defender Antivirus performance and run compatibility scenarios without getting blocked by tamper protection.

The new mode is available in public preview and it enables admins to disable or change the tamper protection setting while diagnosing false-positive application blocks or performing performance troubleshooting

This Enterprise-only feature is disabled by default and, according to Microsoft, it requires Microsoft 365 Defender access.

"Introducing troubleshooting mode, a unique, innovative, and secure way to investigate and adjust configurations on your devices," Microsoft's Juli Hooper explained.

"This mode will enable the local admin on the device to override Microsoft Defender Antivirus security policy configurations on the device, including tamper protection."

To try this new feature in preview, you need:

• A device running Windows 10 (version 19044.1618 or later), Windows 11, Windows Server 2019, or Windows Server 2022.
• Microsoft Defender for Endpoint to be tenant-enrolled and active on the device.
• Microsoft Defender Antivirus, version 4.18.2203 or later, running on the device.

How to enable Defender for Endpoint troubleshooting

You can enable troubleshooting mode by going through the following procedure:

1. Go to the Microsoft 365 Defender portal (https://security.microsoft.com) and sign in. 
2. Navigate to the Device page/Machine page for the device you would like to enable troubleshooting mode on and select the Turn on troubleshooting mode. Note that this requires Manage security settings in Security Center permissions for Microsoft Defender for Endpoint. 
3. Confirm you want to turn on troubleshooting mode for the device.
4. Now the device page shows the device is in troubleshooting mode (note that the menu item will remain greyed out for as long as the device is in troubleshooting mode).

Admins have 3 hours to adjust and test the system's configuration to match their organization's environment after enabling troubleshooting on a specific endpoint.

Troubleshooting mode scenarios available for Microsoft Defender for Endpoint include:

• diagnosing application installation problems,
• high CPU usage due to Windows Defender (MsMpEng.exe),
• applications taking longer to perform an action, 
• Microsoft Office plugins being blocked by Attack Surface Reduction,
• and specific domains being blocked by Network Protection.

Once the testing window closes, all security settings configured before troubleshooting mode was enabled will be restored.

Also, any new security policies created by the organization's security or IT admins will be applied automatically (they would be blocked during the troubleshooting process).

"Additional diagnostic files will be available for collection after troubleshooting mode. Your security admin can collect the diagnostic files by using the Collect Investigation Package feature," Hooper added.

"The files include a before and after snapshot of the MpPreferences and the MpLogs during the troubleshooting window."

Microsoft also provides additional info on what you need to know before enabling this new mode here and on available scenarios here.