Microsoft Defender for Endpoint
Endpoint protectionRun a detection test on a device recently onboarded to Microsoft Defender for Endpoint
In brief
The article now explains that the PowerShell test verifies whether a recently onboarded device reports correctly to Defender for Endpoint and that the command simulates a malicious download-and-execute pattern. It also updates the supported operating systems wording and metadata.
What Defender admins need to know
Administrators can more clearly understand the test’s purpose and expected behavior when validating device onboarding.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Run a detection test on a device recently onboarded to Microsoft Defender for Endpoint
When you add a device to the Microsoft Defender for Endpoint service for management, it's referred to as onboarding. Onboarding allows devices to report signals about their health status to Microsoft Defender for Endpoint.
Verifying that a device is added to the service successfully is a critical step in the entire deployment process. It helps ensure that all the devices expected are being managed.
This article explains how to run a PowerShell detection test on a recently onboarded device to confirm that it's properly reporting to the Defender for Endpoint service.
Prerequisites
Supported operating systems
The following operating systems are supported for thisthe onboarding verification detection test:
- Windows Server 2012 R2
- Windows Server 2016 and later
On the device, open Command Prompt as an administrator.
At the prompt, copy and run the following
command:command. This command simulates a malicious download-and-execute pattern so that Microsoft Defender for Endpoint can detect it and confirm that the device is reporting correctly:powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference = 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-MDATP-test\\invoice.exe');Start-Process 'C:\\test-MDATP-test\\invoice.exe'
@@ -5,7 +5,7 @@ ms.service: defender-endpoint ms.author: painbar author: paulinbar ms.localizationpriority: medium-ms.date: 06/17/2026+ms.date: 07/02/2026 ms.collection: - m365-security - tier1@@ -14,20 +14,22 @@ ms.subservice: onboard appliesto: - Microsoft Defender for Endpoint Plan 1 and 2 ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- # Run a detection test on a device recently onboarded to Microsoft Defender for Endpoint When you add a device to the Microsoft Defender for Endpoint service for management, it's referred to as onboarding. Onboarding allows devices to report signals about their health status to Microsoft Defender for Endpoint. -Verifying that a device is added to the service successfully is a critical step in the entire deployment process. It helps ensure that all the devices expected are being managed. +Verifying that a device is added to the service successfully is a critical step in the entire deployment process. It helps ensure that all the devices expected are being managed.++This article explains how to run a PowerShell detection test on a recently onboarded device to confirm that it's properly reporting to the Defender for Endpoint service. ## Prerequisites ### Supported operating systems -The following operating systems are supported for this detection test:+The following operating systems are supported for the onboarding verification detection test: - Windows Server 2012 R2 - Windows Server 2016 and later@@ -39,7 +41,7 @@ Run the following PowerShell script on a newly onboarded device to verify that t 1. On the device, open Command Prompt as an administrator. -1. At the prompt, copy and run the following command:+1. At the prompt, copy and run the following command. This command simulates a malicious download-and-execute pattern so that Microsoft Defender for Endpoint can detect it and confirm that the device is reporting correctly: ```powershell powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference = 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-MDATP-test\\invoice.exe');Start-Process 'C:\\test-MDATP-test\\invoice.exe'