When it comes to protecting your endpoints,
especially your endpoints servers, you can make use of Microsoft 365 Defender.
Microsoft 365 Defender enables you to work with the various Microsoft
Defender components such as Microsoft Defender for Identity,
Microsoft Defender for Endpoints, and Microsoft Defender for 365.
To onboard a device onto Microsoft Defender for Endpoints,
you would need to navigate to the Microsoft 365 Defender
portal and scroll down towards the Settings.
When you click on Settings, you will select Endpoints,
and this will bring you to the configuration for
Microsoft Defender for Endpoints.
Now the configuration items are pretty straightforward; however,
there are a few that I would like to point out.
The first one being the Advanced features.
Generally when you set this up, some of these advanced features are not enabled.
You'll notice here, I do not have the Live Response enabled,
and that, ultimately,
does not allow me to make use of the Live Response for Servers.
So I'm going to go ahead and turn this on,
and I would also like to make use of the Live Response
using unsigned script execution.
This means that if I would like to leverage a PowerShell
script within a live response session, I can make use of any unsigned scripts.
As I scroll down, the rest of the features are enabled,
which allow me to have quite a good variety of options and protections
that's available on Microsoft Defender for Endpoint.
I'll keep scrolling down and there's one that I would like to enable,
which is the Share endpoint alerts with Microsoft Compliance Center.
And as I continue to scroll down, the rest of them are enabled.
Remember to click on Save preferences.
Once we have clicked on Save preferences,
let's move on to actually onboarding a server.
So I'll scroll all the way down to the bottom and under Device management,
I will select Onboarding.
Within the Onboarding section,
I can now select the operating system that I would like to
onboard starting from Windows Server 1803,
2019, and 2022,
the Microsoft Defender for Endpoint agent is built into the operating system.
This means that you do not need to install any additional agents.
So let's go ahead and select Windows Server,
and we are onboarding our member server,
which is Server 2022.
And now I've got a variety of deployment methods that I could use.
If I was onboarding a limited amount of servers,
I could make use of a simple script, which I can run on the servers.
However, Microsoft has made it easy so that you can also leverage a group policy,
endpoint configuration, and VDI scripts for non‑persistent devices.
In our case, I'm going to leverage the local script.
Once I select Local Script, I now can download the onboarding package.
This package essentially is a script file,
and we'll take a look at what this looks like in a minute.
So I'm going to go ahead and download this,
and then I will switch to my member server where we
will execute this onboarding package.
All right, so now I've switched to my member server,
and I've copied across the onboarding package.
So let's take a look at what the script is actually doing.
As I edit the script and scroll through it,
we can see that this script is running a number of tasks.
It's, of course, checking for permissions,
and then it goes ahead and starts setting various
registry keys with different values.
Ultimately,
what it's doing is actually just setting your endpoint to speak to
your Microsoft Defender for Endpoints tenant.
So let's go ahead and run this.
We need to ensure that we run this as administrator,
so I will continue and the script will do its thing.
After a minute or so, this will complete,
and then my endpoint, which is my server in this case,
will be onboarded into Microsoft Defender for Endpoint.
So what we can do now is we can actually run a detection test
by using the script that Microsoft provides.
I've now switched back to the Defender for Endpoint portal.
I'll copy this detection script.
So I'm going to go ahead and run this detection script within PowerShell and,
ultimately,
what this will do is actually download the file that will
trigger Microsoft Defender for Endpoints.
As soon as I hit Enter, the window will close.
So now we'll give it a minute or so and then we'll take a
look at the Microsoft Defender for Endpoint portal to see if
we have the detection showing up.
In the meantime, I will onboard my domain controller, and we will pick up in the next video.