[Defender365] - Question about Update Microsoft Defender for Endpoint core components

[AlteredAdmin]

Good morning i have some questions about the Update Microsoft Defender for Endpoint core components Security Recommendation.

Windows Server 2016 64-bitVersion 1607

 

I have done update path 2 as the servers that seem to be effect are 2016. I have installed the onboarding package that installs Microsoft Defender for Endpoint and ran the onboarding script. the Microsoft Monitoring Agent is still installed. I have also ran all windows updates so the server is fully patched.

 

However that security recommendation does not go away. I know sometimes you have to give it 24 hours before that list updates, but the other security recommendation have fell off since i have done them.

 

How come this still lingers around? Does any one else have this issue?

 

Is their something I'm missing?

 

=======================

DescriptionIndicates that the Microsoft Defender for Endpoint EDR sensor (Windows Server 2012 R2, 2016) or Microsoft Defender for Endpoint agent (Linux, macOS) installed on the machine is not up to date.Windows Server 2012 R2 and 2016

If you’re currently running the legacy Microsoft Defender for Endpoint agent solution (based on the Microsoft Monitoring Agent - MMA) with MsSenseS.exe version 10.3720.*, please skip directly to Update path 2.

Update path 1

Update the latest EDR sensor version described in Microsoft Defender for Endpoint update for EDR Sensor using one of the following methods:Windows UpdateA patch management solution such as WSUSDownloading and applying the package from the Microsoft Update Catalog.

Update path 2

This option only applies if you’re currently running the legacy Microsoft Defender for Endpoint agent solution (based on the Microsoft Monitoring Agent - MMA) with MsSenseS.exe version 10.3720.*, in which case you will first need to upgrade to the new solution by following these steps:Go to the onboarding page in the M365 Defender portalSelect the ‘Windows Server 2012 R2 and 2016 (Preview)’ operating systemsChoose your preferred deployment methodDownload the installation and onboarding packagesInstall the package and apply the onboarding script via your chosen deployment channelOnce the new solution has been installed, future updates should be done by following the instructions described in Update path 1.For additional information on what’s new and how to install, including applying Defender Antivirus passive mode configuration if you’re using a non-Microsoft antimalware solution,please refer to Onboard Windows servers to the Microsoft Defender for Endpoint service | Microsoft Docs.

[Schwarzwald]

Hello,

 

We had the same issue. After running the onboarding script, we also had to ensure that KB5005292 was installed on our servers, the EDR security recommendation then updated correctly.

https://support.microsoft.com/en-gb/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac