Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Migrate servers to Microsoft Defender for Endpoint by using Configuration Manager

4 September 2026Doc update+111 / −69 lines

In brief

The article now covers migrating Windows Server 2012 R2 and 2016 from MMA to the unified Defender for Endpoint solution. It clarifies that manual steps apply to Configuration Manager versions earlier than 2207, while version 2207 and later can automate deployment and upgrades, and it updates prerequisites and download instructions.

What Defender admins need to know

Administrators can use the version-specific procedure and updated prerequisite and package guidance when planning server migrations.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

MigratingMigrate servers fromto Microsoft Monitoring Agent to the unified solutionDefender for Endpoint by using Configuration Manager

This article guides you in migrating servers running Windows Server 2016 or Windows Server 2012 R2 from Microsoft Monitoring Agent (MMA) to the modern, unified solution. In this article, the phrase down-level servers refers to older versions of Windows Server, such as Windows Server 2016 and Windows Server 2012 R2.

Prerequisites

  • Use Microsoft Configuration Manager higher than 2207.
  • Down-level OS devices in your environment onboarded with Microsoft Monitoring Agent. To confirm, verify that MsSenseS.exe isto migrate servers running in Task Manager.
  • Presence of the MMA agent. You can verify it by checking if the correct Workspace ID is present in the Control Panel> Microsoft Monitoring Agent.
  • Active Microsoft Defender portal with devices onboarded.
  • A Device Collection containing down-level servers such as Windows Server 2012 R2 or Windows Server 2016 using MMA agent is set up infrom the previous Microsoft Monitoring Agent (MMA)-based Microsoft Defender for Endpoint solution to the modern unified solution. This procedure uses the Defender for Endpoint unified solution upgrade script to install the unified solution, remove the Defender for Endpoint workspace from MMA, and apply the onboarding package.

    Prerequisites

    Before you create the application, make sure your environment meets these requirements:

    • Configuration Manager instance.version earlier than 2207. Configuration Manager version 2107 or later is required if you also use it to configure Endpoint Protection policies.
    • A device collection that contains servers running Windows Server 2012 R2 or Windows Server 2016 that use the MMA-based Defender for Endpoint solution.
    • The correct Defender for Endpoint workspace ID configured in the Microsoft Monitoring Agent item in Control Panel on each server.
    • The required servicing stack updates, cumulative updates, and Microsoft Defender Antivirus platform updates. Review the prerequisites for Windows Server 2016 and Windows Server 2012 R2.
    • Access to the Microsoft Defender portal and permission to download Defender for Endpoint installation and onboarding packages.
    • A Configuration Manager content source that the site server computer account can access.

    For more information on installing

    Gather the listed prerequisites, see related articles section.

    Gather requireddeployment files

    CopyDownload the latest unified solution package, onboarding script,package, and migration script toscript. Save all three files in the same Configuration Manager content source you deploy other apps with Configuration Manager.folder.

    1. Download On the Onboarding Script page in the Microsoft Defender portal at https://security.microsoft.com/preferences2/endpointsOnboarding, select Windows Server 2016 and Windows Server 2012 R2.

    2. For Deployment method, select Group Policy, and then download the unified solution from Microsoft Defender portal settings pageinstallation package and onboarding package. The migration script requires the noninteractive .cmd onboarding file included in the Group Policy package.

      :::image type="content" source="media/onboarding-script.png" alt-text="Screenshot of the Defender portal onboarding scriptpage with server and unified solution downloadGroup Policy selections highlighted." lightbox="media/onboarding-script.png":::

    1. Download the migration script from the document: Server migration scenarios from the previous, MMA-based Microsoft Defender for Endpoint solution

    2. Download the latest Defender for Endpoint unified solution upgrade script, and extract install.ps1. ThisFor migration details and script can also be found on GitHub: GitHub - microsoft/mdefordownlevelserveroptions, see Server migration scenarios from the previous MMA-based solution.

    3. Save all three filesthe unified solution installer, the onboarding .cmd file, and install.ps1 in a shared folder used bythe Configuration Manager as a Software Source.content source folder.

      :::image type="content" source="media/ua-migration.png" alt-text="Screenshot of savinga Configuration Manager content source folder containing the shared folder by Configuration Manager.migration deployment files.":::

    Create the package as an application

    Create a script installer deployment type that runs the migration script in the system context.

    1. In the Configuration Manager console, go toselect the Software Library >workspace. Expand Application Management, select Applications >, and then select Create Application.

    2. SelectOn the General page, select Manually specify the application information, and then select Next. ::

      :::image type="content" source="media/manual-application-information.png" alt-text="Screenshot of manually specifying the Create Application Wizard with manual application information selection.selected." lightbox="media/manual-application-information.png":::

    3. SelectOn the General Information page, enter a name and any other information that your organization requires, and then select Next on the Software Center screen of the wizard..

    4. On the Software Center page, enter the required localized application name, configure any other Software Center details, and then select Next.

    5. On the Deployment Types,Types page, select Add.

    6. On the General page of the Create Deployment Type Wizard, select Script Installer from the Type list. Select Manually to specify the deployment type information, and then select Next.

    7. GiveOn the General Information page, enter a name to your scriptfor the deployment type, and then select Next.

      a. :::::image type="content" source="media/manual-deployment-information.png" alt-text="Screenshot specifyingof the scriptCreate Deployment Type Wizard with general deployment type information.":::

    8. CopyOn the UNCContent page, enter the Universal Naming Convention (UNC) path to the folder that your content is located. Example:contains the deployment files in Content location. For example, \\ServerName\h$\SOFTWARE_SOURCE\path.

      :::image type="content" source="media/deployment-type-wizard.png" alt-text="Screenshot that shows UNC path copy.":::

    9. Set the installationIn Installation program by using, enter the following command:command. Replace <workspace ID> with the Defender for Endpoint workspace ID used by the MMA-based solution: 

       Powershell.exe -ExecutionPolicy ByPass -File install.ps1 -RemoveMMA <workspace ID> -OnboardingScript .\WindowsDefenderATPOnboardingScript.cmd

      Select Next, and make sureThe ExecutionPolicy parameter value Bypass applies only to add your own Workspace ID inthe PowerShell process started by this section.

    10. Select Next, and then select add a clause.

    11. command. The detection method is based on this registry key:migration guidance recommends the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SenseAllSigned.

      Select execution policy. If the option: This registry setting must exit onscript runs as SYSTEM, import the target system to indicate presence of this application.

      :::image type="content" source="media/detection-wizard.png" alt-text="Screenshot that shows detection type wizard":::script signing certificate into the Local Computer Trusted Publishers store.

    :::image type="content" source="media/deployment-type-wizard.png" alt-text="Screenshot of the deployment type Content page with content location and installation program fields.":::

    1. Select Next. On the Detection Method page, select Add Clause.

    2. In the Detection Rule dialog, configure these settings:

      • Setting type: Registry
      • Hive: HKEY_LOCAL_MACHINE
      • Key: SYSTEM\CurrentControlSet\Services\Sense
      • Value: Leave blank.
      • Detection option: This registry setting must exist on the target system to indicate presence of this application

      The registry key detects whether the Defender for Endpoint sensor service is installed. It doesn't confirm that the server is onboarded or reporting to the Defender for Endpoint service.

      :::image type="content" source="media/detection-wizard.png" alt-text="Screenshot of the Detection Rule dialog with the Sense service registry key configured.":::

    3. Select OK, and then select Next.

    4. On the User Experience page, configure these settings:

      • Installation behavior: Install for system
      • Logon requirement: Whether or not a user is logged on
      • Installation program visibility: Use Normal for a pilot deployment if you need to observe the installation. Use Minimized for a broader deployment.
      • Allow users to view and interact with the program installation: Clear this option.
      • Maximum allowed run time (minutes): Enter a value that allows the script to complete and fits within your maintenance windows. The Configuration Manager default is 120 minutes.

      :::image type="content" source="media/user-experience-in-deployment-type-wizard.png" alt-text="Screenshot of the deployment type User Experience page with system installation settings." lightbox="media/user-experience-in-deployment-type-wizard.png":::

    5. Select Next.

    6. On the Requirements page, add requirements if needed to limit installation to Windows Server 2012 R2 and Windows Server 2016, and then select Next.

    7. On the Dependencies page, add any dependencies that your environment requires, and then select Next.

    8. Review the deployment type settings on the Summary page, select Next, and then select Close after the deployment type is created.

    9. In the Create Application Wizard, review the application settings, select Next, and then select Close after the application is created.

    Deploy the application

    Deploy the application to the device collection that contains the servers you want to migrate.

    1. In the Applications node of the Configuration Manager console, select the application, and then select Deploy.

      :::image type="content" source="media/deploy-application.png" alt-text="Screenshot of the Configuration Manager application menu with Deploy selected." lightbox="media/deploy-application.png":::

    2. On the General page of the Deploy Software Wizard, select the device collection that contains the servers to migrate.

    3. On the Content page, add the distribution points or distribution point groups that should host the application content.

    4. On the Deployment Settings page, select Install. Select Required to install the application automatically according to the configured schedule, or select Available to allow an administrator to start installation from Software Center.

    5. Configure scheduling, user notifications, and alert settings for your environment.

    6. Review the deployment settings on the Summary page, select Next, and then select Close after the deployment is created.

    Verify the migration

    Configuration Manager application detection confirms that the Defender for Endpoint sensor service is installed. Verify onboarding and reporting separately.

    1. In the Configuration Manager console, select the Monitoring workspace, and then select Deployments to review deployment status.

    2. On a migrated server, review C:\Windows\CCM\Logs\AppEnforce.log for application enforcement details.

    3. Confirm that the server appears in the device inventory in the Microsoft Defender portal and has a recent sensor health status.

    4. To confirm that the server reports detections to the service, run a detection test on the onboarded server.

    The migration script creates Event Trace Log (ETL) files by default. During a Configuration Manager deployment, these files are typically in the script's working directory under C:\Windows\ccmcache\. Provide the ETL files to Microsoft Support when you troubleshoot installation or onboarding failures.

    Related content