[mdt] MDT Task Sequence generates Trojan warning on target

[fiza]

Been using the same MDT Task Sequence for the last few weeks, tweaking it here and there to do what I want.

Now each time I run it to deploy an image it gets to 58% and the client is rebooted and logs into Windows, it should then go to downloading windows updates but instead just sits there and does nothing. On the workstation, in the System tray there is a notification from Windows Defender saying that it has blocked Trojan:Script/Cloxer.D!cl

 

The affected item is C:ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Litetouch.lnk

 

Does anyone know why this is happening?

 

My MDT Server has Sophos protection and it has not picked anything up.

[FragglePete]

Welcome to my world!!!

 

http://www.edugeek.net/forums/o-s-deployment/208239-1903-task-sequence-blocked-windows-defender.html

 

Pete

 

- - - Updated - - -

 

I'm re-capturing my base image with the updated definitions database in an attempt to resolve it.

 

Pete

[Arthur]

Does anyone know why this is happening?

Bad virus definition?

 

https://twitter.com/jsiewert/status/1123970642439811072

[fiza]

But I have been using the same 1809 reference image the past few months and its only today that the Windows Defender is picking this up. I have rebuilt the same machine many times with the same image but only having issues since yesterday.

 

edit

 

Don't really want to redo my reference image as at this moment in time we have a fat image. Currently working on putting all applications we need in PDQ Deploy but this is not ready to use yet.

Edited July 10, 2019 by fiza

[FragglePete]

I recaptured my base image with updated definitions and latest updates - so far, so good - the test PCs that I have running with the new sequence have got past the stage that they were getting stuck on.

 

....and breathe......!

 

Pete

[garethEds]

But I have been using the same 1809 reference image the past few months and its only today that the Windows Defender is picking this up. I have rebuilt the same machine many times with the same image but only having issues since yesterday.

 

edit

 

Don't really want to redo my reference image as at this moment in time we have a fat image. Currently working on putting all applications we need in PDQ Deploy but this is not ready to use yet.

@fiza - I'm doing this but having a nightmare getting pdq deploy to run from the task sequence.

 

GJE

[fiza]

Not at that point yet so can't help really. Still putting all apps into pdq

[Pauljm]

I moved my Windows Update and Recover from Domain to After my Antivirus installation, which of course turns of Defender as it takes over from Defender. First pass through, now working.

 

What is sad is that this task sequence order for Updates and Recover from domain, has remained unchanged for close on a decade (I've been using MDT since late 2009). How Msoft manage to mess this up for their own product is beyond me.