Jackson Felden - Cloud and Security
Jackson Felden - Cloud and Security
  • 46
  • 113 161
2.3 - Design - Best practise for full scan, MDE from Zero to Hero
Welcome to Microsoft Defender for Endpoint from Zero to Hero, Module 2.3 - Design - Best practise for full scan
You might be wondering if scheduled full scans are needed, how much time it takes to complete, what is the CPU utilization, time difference when scanning file servers and database servers, how to get scan completion reports, etc
In this video, I cover all these topics.
In this video you will see the following:
1 - Scan types overview
2 - Is there any need for full scans?
3 - Full scan in numbers
4 - Custom exclusions and scans
5 - Demos: How to start or cancel scans (GUI, PowerShell & portal)
*Commands reference
-Starting a full scan
Start-MpScan -ScanType FullScan
-Canceling a scan
C:
Cd\program files\windows defender
.\mpcmdrun.exe -scan cancel
***COURSE OUTLINE***
I have plans to record 20+ videos and the course outline is not set in stone. Below are the modules already available and the ones on the horizon:
1. Product Overview - www.youtube.com/watch?v=Ul4Zx...
1.1 - Minimum requirements and licensing - th-cam.com/video/2ElE6g1xifc/w-d-xo.html
2 - Design & key configuration
2.1 Design: MDE settings deployment - th-cam.com/video/fsXLNGcyNEk/w-d-xo.html
2.3 - Design - Best practise for full scan - th-cam.com/video/g2Gkp69VnBE/w-d-xo.html
2.10 Device tag overview - th-cam.com/video/irqGb5k7TLg/w-d-xo.html
2.11 Deploying device tag via portal, GPO and Intune - th-cam.com/video/g79Tc19nXB4/w-d-xo.html
2.12 - Device auto-tagging via Logic Apps - th-cam.com/video/ekwPRg0PjM0/w-d-xo.html&t
3 - MDE deployment
3.1 - Initial setup and advanced settings - th-cam.com/video/TwqC9wNQTbY/w-d-xo.html
3.2 - Deploying settings via MEM - th-cam.com/video/qVCBZO6pBH0/w-d-xo.html
3.3 - Deploying settings via GPO - th-cam.com/video/g-9DTpMQuPE/w-d-xo.html
4 - Onboarding
4.1 - Onboarding overview - th-cam.com/video/iephNadOIDU/w-d-xo.html
4.2 - Onboarding via GPO and local script - th-cam.com/video/1xYxQ2JtSdg/w-d-xo.html
4.3 - Onboarding via Microsoft Endpoint Manager - th-cam.com/video/GCqKdmGXyF8/w-d-xo.html
4.4 - Onboarding via helper script - th-cam.com/video/C_pVEUa2GjM/w-d-xo.html
4.5 - Auto Onboarding via Defender for Cloud
5 - Migration from 3rd party solution - th-cam.com/video/_MiNDetIAvk/w-d-xo.html
6 - Monitoring
6.1 - Alerts and incidents management - th-cam.com/video/OfaSua6fCMM/w-d-xo.html
6.2 - Ransomware attack investigation - th-cam.com/video/kOf3BXLJTkM/w-d-xo.html
6.3 - Dealing with Ransomware via Sentinel automation - th-cam.com/video/0L5djE4nf1w/w-d-xo.html
7 - Integration with SIEM (Security Information and Event Management)
8 - Troubleshooting
8.1 - Troubleshooting mode deep dive - th-cam.com/video/M6f4G1SPCGY/w-d-xo.html
8.2 - Troubleshooting PowerShell output issue - th-cam.com/video/hjebQry6vNo/w-d-xo.html
My Microsoft Defender for Endpoint - From Zero to Hero playlist can be accessed from
th-cam.com/video/UfpQq0BHAjw/w-d-xo.html
Please consider subscribing to my channel for the latest updates and upcoming modules.
Thanks for supporting this project, I hope you enjoy and learn a lot
Thanks for watching
Jackson Felden
#MicrosoftDefenderForEndpoint #MDE #CyberSecurity
มุมมอง: 1 397

วีดีโอ

6.3 Dealing with Ransomware via Sentinel automation, MDE from Zero to Hero
มุมมอง 1.2K11 หลายเดือนก่อน
Welcome to Microsoft Defender for Endpoint from Zero to Hero, Module 6.3 - Dealing with Ransomware via Sentinel automation Today ransomware attacks represent a real threat to organizations in every industry independently of size or location. Check out how Defender for Endpoint, Microsoft Sentinel, and Logic Apps can be used to respond to a Ransomware attack. In this video you will see the follo...
6.2 Ransomware attack investigation, MDE from Zero to Hero
มุมมอง 1.1Kปีที่แล้ว
Welcome to Microsoft Defender for Endpoint from Zero to Hero, Module 6.2 - Ransomware attack investigation Today ransomware attacks represent a real threat to organizations in every industry independently of size or location. Check out the effect of a WannaCry attack on unprotected devices and how Defender for Endpoint works to prevent and provide all the insights related to the attack. In this...
6.1 Alerts & incidents management, MDE from Zero to Hero
มุมมอง 1.4Kปีที่แล้ว
Welcome to Microsoft Defender for Endpoint from Zero to Hero, Module 6.1 - Alerts and incidents management. Managing alerts and incidents created by Defender for Endpoint is a critical task in any organization regardless of the size or type of business. In this video you will see the following: 1 - Alert generation 2 - How to work with alerts & incidents COURSE OUTLINE I have plans to record 20...
2.12 Device auto-tagging via Logic Apps, MDE from Zero to Hero
มุมมอง 903ปีที่แล้ว
Welcome to Microsoft Defender for Endpoint from Zero to Hero, Module 2.12 - Device auto-tagging via Logic Apps There are multiple ways to deploy device tags and Logic Apps is my favourite. With workflows, you can easily add and remove tags on-demand or schedule them to run dynamically. It is very useful when implementing MDE. In this video you will see the following: 1 - Logic Apps Overview 2 -...
2.11 Deploying device tag via portal, GPO and Intune, MDE from Zero to Hero
มุมมอง 1.1Kปีที่แล้ว
Welcome to Microsoft Defender for Endpoint - from Zero to Hero, 2.11 - Deploying device tags via portal, registry & Intune. There are multiples ways to deploy device tags, in this video you will see the following: 1 - Deploying tags via portal 2 - Deploying tags via registry 3 - Deploying tags via Intune Please, make sure you also watch the 2.10 - Device tag overview - th-cam.com/video/irqGb5k7...
2.10 Device tag overview, MDE from Zero to Hero
มุมมอง 1.4Kปีที่แล้ว
Welcome to Microsoft Defender for Endpoint - from Zero to Hero, 2.10 - Device tag overview Device tagging is an important part of any MDE project. You can benefit from logically grouping devices together to easily filter devices or deploying key configurations to target devices. In this video you will see the following: 1 - Device Tag Overview 2 - How to deploy device tag 3 - Using device tag 4...
5 .1 Migration from 3rd party solution, MDE from Zero to Hero
มุมมอง 1.5Kปีที่แล้ว
Welcome to Microsoft Defender for Endpoint - from Zero to Hero, 5.1 Migration from 3rd party solution When migrating from a 3rd party AV there are key elements you need to pay attention to minimize security gaps and avoid spikes in CPU utilization. Check this video to get all details. In this video you will see the following: 1 - Understanding the migration process 2 - AV mode - Active vs Passi...
8.2 Troubleshooting PowerShell output issue, MDE from Zero to Hero
มุมมอง 579ปีที่แล้ว
Welcome to Microsoft Defender for Endpoint - From Zero to Hero, 8.2 - Troubleshooting PowerShell output issue Interestingly enough issue I've been getting time by time when uninstalling and installing the Defender feature. This quick video might save you a lot of time if you encounter the same issue. In this video you will see the following: 1 - How to uninstall / install Defender feature 2 - I...
8.1 Troubleshooting mode deep dive, MDE from Zero to Hero
มุมมอง 972ปีที่แล้ว
Welcome to Microsoft Defender for Endpoint - From Zero to Hero, Module 8.1 Troubleshooting mode deep dive. It can be challenging when trying to troubleshoot performance or other issues you might encounter when deploying MDE. Troubleshooting mode allows you temporarily “downgrade” critical security settings even if they are controlled by the organization policy (GPO, Configuration Manager, or Mi...
4.4 Onboarding via helper script, MDE from Zero to Hero
มุมมอง 799ปีที่แล้ว
Welcome to Microsoft Defender for Endpoint - From Zero to Hero, Module 4.4 - Onboarding via helper script The process I presenting on this video can save you a lot of time in case you are facing challenges when onboarding Windows servers 2012 and 2016. In this video you will see the following: 1 - Onboarding issues 2 - Preparing the onboarding 3 - Onboarding via helper script COURSE OUTLINE I h...
4.3 Onboarding via MEM / Intune, MDE from Zero to Hero
มุมมอง 1.6Kปีที่แล้ว
Welcome to Microsoft Defender for Endpoint - From Zero to Hero, Module 4.3 - Onboarding via MEM / Intune. In this video you will see the following: 1 - Managing device groups 2 - Creating an onboarding policy on MEM 3 - Showing onboarding results COURSE OUTLINE I have plans to record 20 videos and the course outline is not set in stone. Below are the modules already available and the ones on th...
4.2 Onboarding via GPO and local script, MDE from Zero to Hero
มุมมอง 6Kปีที่แล้ว
Welcome to Microsoft Defender for Endpoint - From Zero to Hero, Module 4.2 - Onboarding via GPO and local script In this video you will see the following: 1 - Onboarding devices via local policy 2 - GPO configuration 3 - Onboarding devices via GPO COURSE OUTLINE I have plans to record 20 videos and the course outline is not set in stone. Below are the modules already available and the ones on t...
4.1 Onboarding overview, MDE from Zero to Hero
มุมมอง 1.1Kปีที่แล้ว
Welcome to Microsoft Defender for Endpoint - From Zero to Hero, Module 4.1 - Onboarding overview In this video you will see the following: 1 - Onboarding options 2 - Onboarding Windows Servers 3 - Useful Tools 4 - Troubleshooting guide COURSE OUTLINE I have plans to record 20 videos and the course outline is not set in stone. Below are the modules already available and the ones on the horizon: ...
3.3 Deploying AV settings via GPO, MDE from Zero to Hero
มุมมอง 2.1Kปีที่แล้ว
Welcome to Microsoft Defender for Endpoint - From Zero to Hero, Module 3.3 - Deploying AV settings via GPO When configuring antivirus settings via GPO, there are some aspects you need to take into consideration. The GPO approach and permissions to support the deployment are essential. In this video you will see the following: 1 - GPO Approach OU hierarchy Permissions for GPOs at higher level AS...
3.2 Deploying AV settings via MEM, MDE from Zero to Hero
มุมมอง 1.9Kปีที่แล้ว
3.2 Deploying AV settings via MEM, MDE from Zero to Hero
1.1 Minimum requirements and licensing, MDE from Zero to Hero
มุมมอง 2.4Kปีที่แล้ว
1.1 Minimum requirements and licensing, MDE from Zero to Hero
3.1 Initial setup and advanced settings, MDE from Zero to Hero
มุมมอง 3.8Kปีที่แล้ว
3.1 Initial setup and advanced settings, MDE from Zero to Hero
2.1 Design: MDE Settings Management, MDE from Zero to Hero
มุมมอง 3.9Kปีที่แล้ว
2.1 Design: MDE Settings Management, MDE from Zero to Hero
1. Product Overview, MDE from Zero to Hero
มุมมอง 4.6Kปีที่แล้ว
1. Product Overview, MDE from Zero to Hero
Introducing my Defender for Endpoint, from Zero to Hero course
มุมมอง 4.4Kปีที่แล้ว
Introducing my Defender for Endpoint, from Zero to Hero course
Implementing FIDO2 authentication for Azure AD users
มุมมอง 6Kปีที่แล้ว
Implementing FIDO2 authentication for Azure AD users
Attack Surface Reduction implementation report
มุมมอง 1.4Kปีที่แล้ว
Attack Surface Reduction implementation report
How to implement device auto-tagging on Defender for Endpoint
มุมมอง 3.8Kปีที่แล้ว
How to implement device auto-tagging on Defender for Endpoint
Welcome to my cloud & security channel
มุมมอง 708ปีที่แล้ว
Welcome to my cloud & security channel
Microsoft Defender antivirus health report
มุมมอง 2.3Kปีที่แล้ว
Microsoft Defender antivirus health report
Hunting for ransomware activities with Advanced Hunting
มุมมอง 551ปีที่แล้ว
Hunting for ransomware activities with Advanced Hunting
Commodity vs human-operated ransomware
มุมมอง 351ปีที่แล้ว
Commodity vs human-operated ransomware
Implementing attack surface reduction via group policy
มุมมอง 3Kปีที่แล้ว
Implementing attack surface reduction via group policy
Understanding Defender for Endpoint client analyzer
มุมมอง 2.5K2 ปีที่แล้ว
Understanding Defender for Endpoint client analyzer

ความคิดเห็น

  • @shat1478
    @shat1478 2 วันที่ผ่านมา

    It is helpful video, cheer!! but I have some issue on my branch offices with onboard by GPO... it seems client computers can't run WindowsDefenderATPOnboardingScript.cmd has block on UNC path file.. have you faced issue like this ?

  • @monikamoni4176
    @monikamoni4176 6 วันที่ผ่านมา

    Hello can you help me which policy will block the fido2 key to use on the device

  • @adriancoyote81
    @adriancoyote81 20 วันที่ผ่านมา

    Thank you very much for the excellent explanation it was just what I needed Greetings from Argentina.

  • @EqDior
    @EqDior 25 วันที่ผ่านมา

    isnt the onboarding script the same for each OS? The only differences is the msi file that is needed for 2012 and 2016. Awesome Video by the way!

  • @papajohnscookie
    @papajohnscookie หลายเดือนก่อน

    Thanks Jackson, you've gained a subscriber. I like watching videos like this before digging into the MS documentation as it makes it a bit easier to understand.

  • @chebrets
    @chebrets 2 หลายเดือนก่อน

    how to create admin account using this method but without the password?

  • @lawaluthman5536
    @lawaluthman5536 3 หลายเดือนก่อน

    always very good

  • @user-zu4ft8yw9e
    @user-zu4ft8yw9e 3 หลายเดือนก่อน

    The stages involved in Microsoft Defender antivirus health report include real-time intelligence from the Intelligent Security Graph, stopping threats based on behaviors and process trees, running different types of scans, checking for issues with Windows update, storage capacity, and device drivers, and providing continuous antivirus and anti-phishing scans. This helps in identifying and resolving problems by detecting malware based on abnormal behavior, showing scan results, quarantining threats, and offering solutions to resolve detected issues.

  • @user-zu4ft8yw9e
    @user-zu4ft8yw9e 3 หลายเดือนก่อน

    The stages involved in Microsoft Defender antivirus health report include real-time intelligence from the Intelligent Security Graph, stopping threats based on behaviors and process trees, identifying and blocking malware based on abnormal behavior, running different types of scans, viewing scan results, managing device performance and health, and accessing device inventory. This helps in identifying and resolving problems by providing continuous antivirus and anti-phishing scans, alerting if malicious apps are found, offering solutions to detected issues, and allowing users to take actions such as starting scans, locating devices, and wiping devices for better security and protection.

  • @user-vm8wp3zm8i
    @user-vm8wp3zm8i 3 หลายเดือนก่อน

    Good course and good video. in our organization we need to implement this process and i will try it for one of the key to see if everything is good. thanks for this video

  • @kvv6452
    @kvv6452 3 หลายเดือนก่อน

    Is there any significance of different colors for same tags ? Eg: Win-10 here. Also, I read that there is only 1 device tag(i.e GROUP) that can be configured from registry. Any rationale behind this ?

  • @kendimce3309
    @kendimce3309 4 หลายเดือนก่อน

    It is amazing! Thank you so much. I am looking forward to seeing more content about alerts, incidents and investigations.. Could you provide as well some content about Email Security?

  • @shubhamgalhotra
    @shubhamgalhotra 4 หลายเดือนก่อน

    great video❤

  • @oliverjenkins4825
    @oliverjenkins4825 5 หลายเดือนก่อน

    Will this work for only enabling discovery on a select set of devices?

  • @youssefzhioua8566
    @youssefzhioua8566 5 หลายเดือนก่อน

    Thanks for the video, is there a video for migration from 3rd party AV to defender for endpoint on Linux Server!

  • @samrathansar2596
    @samrathansar2596 5 หลายเดือนก่อน

    U literally saved my life

  • @user-kl1bm2gt4e
    @user-kl1bm2gt4e 5 หลายเดือนก่อน

    i am unable to install defender agent getting error on all windows 2012R2 servers 2012 R2 - MpAsDesc.dll 310

  • @user-ck3cj9cp4i
    @user-ck3cj9cp4i 5 หลายเดือนก่อน

    Thank you for your work. May god bless you.

  • @the_fatshark
    @the_fatshark 5 หลายเดือนก่อน

    Thanks for the detailed GPO configuration. Can I download an export of the GPO you showed? or can you share an export of the GPO you showed? There are a lot of settings and some you unfortunately skipped. Other question, ever deployed your specific GPO in a real production environment & what was the outcome aka is it safe to deploy?

  • @tandasherman1360
    @tandasherman1360 6 หลายเดือนก่อน

    Awesome video!!

  • @RightPhalanges
    @RightPhalanges 6 หลายเดือนก่อน

    Thank for the info.

  • @fameee8
    @fameee8 6 หลายเดือนก่อน

    Amazing video, thank you

  • @stevenhageman8255
    @stevenhageman8255 6 หลายเดือนก่อน

    does this work if you don't have an intune license

  • @conorpodonoghue
    @conorpodonoghue 6 หลายเดือนก่อน

    Many thanks - very helpful

  • @JeanClaudeGnahoui
    @JeanClaudeGnahoui 6 หลายเดือนก่อน

    To Identifying ASR Recommendations You can also filter recommendations by "Category" and choose "Attack Surface Reduction".

  • @mehabcoorg
    @mehabcoorg 6 หลายเดือนก่อน

    fantastic

  • @tanu14188
    @tanu14188 6 หลายเดือนก่อน

    all your videos are superb and easy to understand. Please keep posting your new videos. Thanks so far for all your efforts and really appreciated :)

  • @tanu14188
    @tanu14188 7 หลายเดือนก่อน

    Very good and simple to understand ... Thanks :)

  • @user-zu3jc2mk1l
    @user-zu3jc2mk1l 7 หลายเดือนก่อน

    Olá Jackson, eu sou um estudante da escola municipal de ensino fundamental Rotermund, cujo você estudou durante sua infância e deu uma palestra nesse dia 14, depois de conversar com meu pai ele te reconheceu, o nome dele é Márcio Radtke Trentini, ele trabalhou e morou com você durante um ano em 1991. Justamente por me interessar muito pela informática, eu agradeço muito por uma palestra como a que você fez, que me inspira muito a seguir nessa área.

  • @Niketa21
    @Niketa21 7 หลายเดือนก่อน

    Can it detect if you're connecting with a VPN address?

  • @kranthikiran2636
    @kranthikiran2636 7 หลายเดือนก่อน

    Dear Jack where can i get your complete course on MDE with continuous sessions . Please help me

  • @khaldunazar
    @khaldunazar 7 หลายเดือนก่อน

    Hello and grating , thank you for your very great video I have a question please from the beginning from where you have the windows inside intune that you on-boarded win10-26 it was not on-boarded but you can find it inside intune does it a member of azure or it s vm in your laptop? and how you find it in your intune portal

  • @wangjirao6573
    @wangjirao6573 7 หลายเดือนก่อน

    I do appreciate all the videos you uploded. Great help!

  • @seansmith1994
    @seansmith1994 8 หลายเดือนก่อน

    Very nice tutorial.

  • @mohammedjameel8213
    @mohammedjameel8213 8 หลายเดือนก่อน

    Can’t hear you!

  • @ashleykenyon1744
    @ashleykenyon1744 8 หลายเดือนก่อน

    Great effort with these, thanks for the videos! The numbering is somewhat confusing. If we just watch the playlist are we getting all the videos or are some missing?

  • @omasanjuwamaleghemi4679
    @omasanjuwamaleghemi4679 9 หลายเดือนก่อน

    Hi Jackson, Thank you very much for taking the time out to make this video. I'm so happy I came across this Video. I have been able to create another KQL query that would work for various sections of my organization. It allowed me find devices with different IP addresses running on Windows OS. However, I still have one unclear part. On what device do I run the Powershell script? Is it on the cloud active directory DC, the on premises DC, or just any device in the organization with MDE installed? I have been stuck on this part for a couple hours. I would really love it if you could write back. Regards,

  • @Rideables
    @Rideables 9 หลายเดือนก่อน

    Amazing! Straight and to the point, just what I was looking for! I'm subscribed! While user was created, do you know why the status might be "Error" and error code "-2016281112" for both the LUG and Password when I assign it to a group of Users for each of user's machines? Should it be assigned to devices instead?

  • @mikez9929
    @mikez9929 9 หลายเดือนก่อน

    *promosm*

  • @alslinet
    @alslinet 9 หลายเดือนก่อน

    I ran into an issue with the api limits. Max 100 tags per minute and 1500 per hour. Running the logic app every 4-5 minutes with "| take 100" at the end of the query limits it to only do 100 tags each time and seems to have fixed most of my issues. It was more of a temporary issue as the automatic tagging i do normally wont include that many devices. But this was for a large group of newly onboarded ones.

  • @TheSKORPS
    @TheSKORPS 9 หลายเดือนก่อน

    Great stuff, and thanks for sharing your knowledge! Can you please check if all videos are available? I dont see the video 2.2, and from 6.3 jumps to 8 and skips chapter 7. Once again, thank you!

  • @IamHere2007de
    @IamHere2007de 9 หลายเดือนก่อน

    Great video. Let’s say you start a pilot deployment for Windows servers. Which servers would you add first without having issues and which servers should I be careful with?

  • @unkownuser2320
    @unkownuser2320 9 หลายเดือนก่อน

    please let throw some lights on defender portal capabilities, prerequisites, how to enroll. advantages of defender compare other antivirus, how to enable antivirus and defender on computers, advantage of deploying defender updates, other capabilities related to end point, Intune defender capabilities, prerequisites

  • @stewheelie7874
    @stewheelie7874 10 หลายเดือนก่อน

    Great video, thanks for posting

  • @osho0001
    @osho0001 10 หลายเดือนก่อน

    Please clarify why we required sentinel to isolate, if there is any malware found defender has capability to identify and isolate the device right

  • @Thomaseldias
    @Thomaseldias 11 หลายเดือนก่อน

    Thank you Jackson! You helped me out with this tutorial.

  • @Happ13rAbroad
    @Happ13rAbroad 11 หลายเดือนก่อน

    How would one accomplish this for MacOS that is enrolled in Intune?

  • @sameershetty1527
    @sameershetty1527 11 หลายเดือนก่อน

    What if I dont want to fully isolate the endpoint I want users to have the option to communicate via teams & outlook but rest everything blocked As this option is available when we do manual isolation from defender portal Which action should we select for trigger isolation in logic apps

  • @Luk-dn2ip
    @Luk-dn2ip 11 หลายเดือนก่อน

    Excellent Videos, Jackson! Quick question - any idea how to onboard MDE devices to Intune?

  • @drlorafrancis
    @drlorafrancis 11 หลายเดือนก่อน

    But, what if we already have a AV solution and you need to uninstall that AV solution before you onboard the MDE for Desktops or Servers, then how would you do that? I am not sure you would see it, but if you do see this question, please do respond. Can you offboard the existing AV solution like SEP or Trend and then use MDE for Windows 10/11 or Servers?