Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Take response actions on a device

4 September 2026Doc update+54 / −35 lines

In brief

The article adds a note that live response may be restricted on high-value assets according to their selective response actions. It also refreshes investigation, live response, package-content, and metadata wording.

What Defender admins need to know

No action is required. If live response is unavailable on a device, administrators can review its selective response actions.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Take response actions on a device

Initiate automated investigation

You can start a new, general-purposenew automated investigation on the device if needed. While an investigation is running,runs, any other alert generated from the device is added to an ongoing automatedthat investigation until that investigationit completes. In addition, ifIf the same threat is seenappears on other devices, those devices are added to the investigation.also added.

For more information on automated investigations, see Overview of Automated investigations.

Initiate live response session

Live response is a capability that gives you instantaneousinstant access to a device by usingthrough a remote shell connection. This givesLive response lets you the power to do in-depthdeep investigative work and take immediate response actionsquick action to promptly contain identified threats in real time.

Live response is designed to enhance investigations by enablinghelps you to collect forensic data, run scripts, send suspicious entities for analysis, remediatefix threats, and proactively hunt for emerging threats.

For more information on live response, see Investigate entities on devices using live response.

Collect investigation package from devices

As part of the investigation or response process, you can collect an investigation package from a device. By collecting the investigation package, you can identify the current state of the device and further understand the tools and techniques used by the attacker. |---|---| |Autoruns|Contains a set of files that each represent the content of the registry of a known auto start entry point (ASEP) to help identify attacker's persistency on the device.

If the registry key isn't found, the file contains the following message: "ERROR: The system was unable to find the specified registry key or value." | |Installed programs|This .CSV file contains the list of installed programs that can help identify what is currently installed on the device. For more information, see Win32_Product class.| |Network connections|This folder contains a set of data points related to the connectivity information that can help in identifying connectivity to suspicious URLs, attacker's command and control (C&C) infrastructure, any lateral movement, or remote connections.

- ActiveNetConnections.txt: Displays protocol statistics and current TCP/IP network connections. Enables you to look for suspicious connectivity made by a process.

- Arp.txt: Displays the current address resolution protocol (ARP) cache tables for all interfaces. ARP cache can reveal other hosts on a network that were compromised or suspicious systems on the network that might be used to run an internal attack.

- DnsCache.txt: Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. ThisReviewing the DNS cache can help in identifyingidentify suspicious connections.

- IpConfig.txt: Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections.

- FirewallExecutionLog.txt and pfirewall.log

The pfirewall.log file must exist in %windir%\system32\logfiles\firewall\pfirewall.log. It's included in the investigation package. For more information on creating the firewall log file, see Configure the Windows Firewall with Advanced Security LogConfigure the Windows Firewall with Advanced Security Log.| |Prefetch files|Windows Prefetch files are designed to speed up the application startup process. It can be used to track all the files recently used in the system and find traces for applications that might be deleted but can still be found in the prefetch file list.

- Prefetch folder: Contains a copy of the prefetch files from %SystemRoot%\Prefetch. We recommend downloading a prefetch file viewer to view the prefetch files.

- PrefetchFilesList.txt: Contains the list of all the copied files that can be used to track if there were any copy failures to the prefetch folder.| |Processes|Contains a .CSV file listing the processes currently running on the device. This process list can be useful when identifying a suspicious process and its state.| |Scheduled tasks|Contains a .CSV file listing the scheduled tasks, which can be used to identify routines performed automatically on a chosen device to look for suspicious code that was set to run automatically.| |Security event log|Contains the security event log, which contains records of sign-in or sign out activity, or other security-related events specified by the system's audit policy.

Open the event log file using Event viewer.| |Services|Contains a .CSV file that lists services and their states.| |Windows Server Message Block (SMB) sessions|Lists shared access to files, printers, and serial ports and miscellaneous communications between nodes on a network. ThisReviewing SMB session data can help identify data exfiltration or lateral movement.

Contains files for SMBInboundSessions and SMBOutboundSession. If there are no sessions (inbound or outbound), you get a text file that tells you that there are no SMB sessions found.| |System Information|Contains a SystemInformation.txt file that lists system information such as OS version and network cards.| |Temp Directories|Contains a set of text files that lists the files located in %Temp% for every user in the system. This can help to track suspicious files that an attacker might have dropped on the system.

If the file contains the following message: "The system can't find the path specified," it means that there's no temp directory for this user, and might be because the user didn't sign in to the system.| |Users and Groups|Provides a list of files that each represent a group and its members.| |WdSupportLogs|Provides the MpCmdRunLog.txt and MPSupportFiles.cab. This folder is only created on Windows 10, version 1709 or later with February 2020 update rollup or more recent versions installed:

- Win10 1709 (RS3) Build 16299.1717: KB4537816KB4537816

- Win10 1803 (RS4) Build 17134.1345: KB4537795KB4537795

- Win10 1809 (RS5) Build 17763.1075: KB4537818KB4537818

- Win10 1903/1909 (19h1/19h2) Builds 18362.693 and 18363.693: KB4535996KB4535996| |CollectionSummaryReport.xls|ThisThe CollectionSummaryReport.xls file is a summary of the investigation package collection, itcollection. It contains the list of data points, the command used to extract the data, the execution status, and the error code if there's failure. You can use this report to track if the package includes all the expected data and identify if there were any errors.|

Investigation package contents for Mac and Linux devices

:::image type="content" source="media/run-antivirus.png" alt-text="Screenshot of the notification to select a quick or full scan and add a comment." lightbox="media/run-antivirus.png":::

The Action center shows the antivirus scan information and thedetails. The device timeline includes a new event, reflectingevent that shows a scan action was submitted on the device. Microsoft Defender Antivirus alerts reflectshow any detections that surfacedthreats found during the scan.

Restrict app execution

  • Restrict app execution is available for devices on Windows 10, version 1709 or later, Windows 11, and Windows Server 2019 or later.
  • Restrict app execution is available if your organization uses Microsoft Defender Antivirus.
  • Restrict app execution needs to meet the Windows Defender Application Control code integrity policy formats and signing requirements. For more information, see Code integrity policy formats and signingCode integrity policy formats and signing.

To restrict an applicationapp from running, a code integrity policy is applied thatapplied. This policy only allows files to run if they're signed by a Microsoft Microsoft-issued certificate. Restricting app execution toAllowing only Microsoft-signed files can help prevent an attackerhelps stop attackers from controlling compromised devices and performing further malicious activities.devices.

Once you have selected Restrict app execution on the device page, type a comment and select Confirm. The Action center shows the app restriction details, and the device timeline includes a new event.

:::image type="content" source="media/restrict-app-execution.png" alt-text="Screenshot of the app restriction confirmation notification." lightbox="media/restrict-app-execution.png":::

Important points to keep in mind:

  • In environments that use web proxies (including Proxy Auto Configuration (PAC), WPAD, or static/direct proxy configurations), devices might not be able to recover from network isolation. Use selective isolation in such cases. When using selective isolation, exclusion settings aren't required to avoid this scenario.
  • Isolating devices from the network is supported for macOS for client version 101.98.84 and above. You can also use live response to run the action. For more information on live response, see Investigate entities on devices using live response.
  • Isolating devices from the network is supported for macOS for client version 101.98.84 and above. You can also use live response to run the action. For more information on live response, see Investigate entities on devices using live response
  • Full isolation is available for devices running Windows 11, Windows 10, version 1703 or later, Windows Server 2012 R2 and later, and Azure Stack HCI OS, version 23H2 and later.
  • Isolating devices from the network is supported when Defender is running in passive mode on all supported Windows operating systems, macOS and Linux supported versions.

Isolate device - automatic attack disruption (Preview)

When a device in your organization is suspected tomight be compromised, Microsoft Defender for Endpoint can automatically isolate the deviceit as part of automatic attack disruption. Automatic isolation helps reduce the risk of further impact on the organization,organization and limit attacker lateral movement, andmovement. It also helps prevent impacts such as data exfiltration and ransomware propagation.

spread. When a device is isolated automatically:

  • The compromised device is disconnected from the network, reducing the risk of further impact on the organization. If an automatically isolated device is business-critical, prioritize rapid validation and stakeholder coordination. Release isolation only after you confirm appropriate containment and remediation steps are in place. Consider using automatic attack disruption exclusions to reduce the likelihood of isolating devices that can't tolerate interruption.

Confirm automatic device isolation

To confirm that aautomatic device isolation was automatically isolated,applied, follow these steps:

  1. Open the relevant incident generated by automatic attack disruption in the Microsoft Defender portal.
  2. Review the Activity tab or Action center to see which automated response actions were applied.

Exclude devices from automatic device isolation

You can exclude specific devices from automatic device isolation by using policy applications and exclusions. Create a new device tag or use an existing tag, assign the tag to the devices you want to exclude, and configure the policy application to exclude the Isolate device action for that tag.

For detailed instructions, see Policy applications and exclusions (Preview) (Preview) feature,.

:::image type="content" source="media/policy-application-isolate-device-exclusion.png" alt-text="Screenshot of the Configure exclusions step with the Isolate device action excluded." lightbox="media/policy-application-isolate-device-exclusion.png":::

When automatic attack disruption identifies an excluded device as compromised, the Isolate device action isn't performed. The action appears with a Skipped status in the Action center, and the device continues to operate normally.

:::image type="content" source="media/isolate-device-action-skipped.png" alt-text="Screenshot of a skipped Isolate device action in the Action center." lightbox="media/isolate-device-action-skipped.png":::

Forcibly release device from isolation

The device isolation feature is an invaluable tool for safeguarding devices against external threats. However, there are instances when isolated devices become unresponsive.

There's a downloadable script for cases where isolated devices become unresponsive that you can run to forcibly release them from isolation. The script is available through a link on the device page in the Microsoft Defender portal.

Contain critical assets

When a critical asset is compromised and used to spread threats, stopping the spread can be hard. These assets must keep running to avoid productivity loss. Defender for Endpoint contains the critical asset at a granular level. It stops the attack from spreading while keeping the asset running.

Through automatic attack disruption, Defender for Endpoint flags a malicious device and identifies its role. It then applies a matching policy to contain the critical asset. This containment blocks only specific ports and communication directions.

You can identify critical assets by the critical asset tag on the device or IP page. Device containment supports critical asset types like domain controllers, DNS servers, and DHCP servers.

Contain devices from the network

When you find an unmanaged device that is compromised or might be compromised, you can contain it from the network. This prevents the attack from moving laterally. When you contain a device, all Defender for Endpoint onboarded devices block incoming and outgoing communication with that device. Containment helps protect nearby devices while the security analyst finds and fixes the threat.

How to contain a device

To contain a device from the Device inventory page, follow these steps:

  1. Go to the Device inventory page and select the device to contain.

  2. Select Contain device from the actions menu in the device flyout.

Defender for Endpoint can also contain IP addresses linked to devices that are undiscovered or not onboarded. Containing an IP address stops attackers from spreading attacks to other devices. When an IP address is contained, all onboarded devices block incoming and outgoing traffic with devices that use that IP address.

You can stop an IP address' containment at any time. To stop containment, select the Contain IP action in the Action center. In the flyout, select Undo. This action restores the IP address’ connection to the network.

Contain a user from the network

When an identity in your network might be compromised, you must prevent that identity from accessing the network and different endpoints. Defender for Endpoint can contain an identity, blocking it from access, and helping prevent attacks, specifically, ransomware. When an identity is contained, all supported Defender for Endpoint onboarded devices block incoming traffic in attack-related protocols (network logons, RPC, SMB, RDP). The devices also end ongoing remote sessions and log off existing RDP connections, including all related processes. Legitimate traffic continues to flow normally. Containing an identity can significantly help to reduce the impact of an attack. When an identity is contained, security operations analysts have extra time to locate, identify, and remediate the threat to the compromised identity. Once contained by automatic attack disruption, a user is automatically appliesremoved from containment in the next five days.

Contain user important notes

View the contain user actions

After a user is contained, you can view the action in the History view of the Action Center. In the Action Center History view, you can see when the action occurred and which users in your organization were contained:

:::image type="content" source="/defender/media/defender-endpoint/user-contain-action-center.png" alt-text="Screenshot of the user contain action in the Action center." lightbox="/defender/media/defender-endpoint/user-contain-action-center.png":::

GPO hardening - predictive shielding (Preview)

The predictive shielding (Preview) feature lets Defender for Endpoint apply the GPO hardening action. GPO hardening temporarily blocks new Group Policy Object (GPO) hardening temporarily stops new GPO policies from being applied to devices identified as high risk.on high-risk devices. This action helps prevent potential compromise by limiting changes to critical configurations.key settings.

To enrichget better results from predictive shielding actions, we recommend youshielding, use the Microsoft Defender for Identity sensor in your environment.sensor. For more information, see Enrich predictive shielding with Microsoft Defender for Identity.

After the action is applied, you can view the actionits impact in the incident graph, track the actionsit in the Action center, and investigate further usingwith advanced hunting. For more information, see Manage predictive shielding actions.

Consult a threat expert

You can consult a Microsoft threat expert for more insights regardingabout a compromised or potentially compromised device or already compromised ones.device. Microsoft Threat Experts can be engagedwork with you directly from within the Defender portal for a timely and accurate response. Experts provide insights not just regarding a potentially compromised device, but also to betterhelp you understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, or aand threat intelligence context that you seeshown on your portal dashboard.

See Configure and manage Endpoint Attack Notifications for details.

The Activities tab in the Incident page shows the details and status of actions that were taken as part of the incident response. For more information, see Track the action status in the Activities tab (Preview).

See alsoRelated content