IT Support Playbooks / IT Support Guides
Check Microsoft Defender state before a security escalation
A device security alert needs context about the active protection engine and signature status. Collect state without disabling protection to make an application run.
Environment and inputs: Everyday IT support · Windows PowerShell examples unless specified
Try the diagnostic command
Use the stated shell and platform. Replace sample domains, addresses, services and paths with values from the system you are authorized to support.
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdatedHow to read the result
With the Defender module available, these fields report service and antivirus state. An organization's third-party security product or managed mode can affect the expected values.
What to do next
Compare the values with the managed endpoint policy and recent security alerts. Escalate unexpected protection gaps to the security owner with the device and observation time.
Before you make a change
Do not add broad exclusions or disable real-time protection as a troubleshooting shortcut. A healthy status snapshot does not prove the absence of an incident.