How to Check if Microsoft Defender for Endpoint is Running

What Is Microsoft Defender for Endpoint?

Microsoft Defender for Endpoint (MDE) is Microsoft's enterprise endpoint detection and response (EDR) platform. Unlike the built-in Windows Defender Antivirus, MDE provides advanced threat detection, investigation, automated response, and centralised management through the Microsoft Defender portal (security.microsoft.com).

MDE is included with Microsoft 365 Business Premium, E3, and E5 licences — making it the default EDR for most Melbourne businesses already on Microsoft 365. But having the licence doesn't mean it's running. The sensor (the SENSE service) must be correctly onboarded, and the service must be active on each device.

Method 1 — Check the SENSE Service (sc query sense)

The quickest way to check if MDE is running is to query the SENSE service from an elevated command prompt. The SENSE service is the MDE sensor responsible for sending telemetry to the Defender portal.

Open Command Prompt as Administrator and run:

sc query sense

Look for the STATE line in the output:

Method 2 — PowerShell: Get-MpComputerStatus

PowerShell gives you much more detail about both the antivirus and the EDR components. Open PowerShell as Administrator and run:

Get-MpComputerStatus

Key properties to check in the output:

To check just the MDE onboarding state quickly:

Get-MpComputerStatus | Select-Object OnboardingState, AMRunningMode, AntivirusEnabled

Method 3 — Check Defender Sensor Status via PowerShell

For a more detailed MDE-specific check, you can query the registry where the MDE onboarding state is stored:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" | Select-Object OnboardingState, SenseIsRunning, OrgId

Method 4 — Windows Security App (GUI)

For end users or non-technical staff, the Windows Security app provides a simple status check:

1. Open Windows Security (search from Start menu)
2. Click Virus & threat protection
3. Check that Real-time protection is On
4. Click Virus & threat protection settings
5. Verify no warning banners appear at the top of the page

Note: The Windows Security app reflects the antivirus status, not MDE's EDR onboarding state. A device can show "Protected" here while still not being onboarded to the Defender portal.

Method 5 — Verify in the Microsoft Defender Portal

The authoritative way to confirm MDE is running and reporting correctly is to check the device in the Defender portal:

1. Go to security.microsoft.com
2. Navigate to Assets → Devices
3. Search for the device by name
4. Check the Sensor health state column

Understanding Passive Mode

When MDE is deployed alongside a third-party antivirus, Windows Defender Antivirus automatically switches to passive mode. In passive mode:

• Real-time protection is disabled (the third-party AV handles this)
• Scheduled scans still run but don't remediate
• MDE EDR functions (detection, investigation, response) continue normally
• Get-MpComputerStatus will show AMRunningMode = Passive Mode

Check the current running mode with:

(Get-MpComputerStatus).AMRunningMode

About KB2461484 — Microsoft Endpoint Protection Updates

You may see references to KB2461484 in Windows Update history or error logs. This Knowledge Base article refers to update packages for Microsoft Endpoint Protection — the enterprise version of Windows Defender that was part of System Center Configuration Manager (SCCM/MECM) before it was rebranded as part of the Microsoft Defender suite.

KB2461484 updates typically contain definition (signature) updates for Microsoft Endpoint Protection. If you're seeing this in update logs, it generally indicates:

• Your organisation is using SCCM/MECM to manage endpoint protection
• Definition updates are being deployed via the software update point
• This is expected and healthy behaviour in a managed environment

If KB2461484 updates are failing, common causes include:

• WSUS synchronisation issues — definition updates require frequent sync (every few hours)
• Software Update Point not configured for definition update products
• Client policy not set to allow definition updates from WSUS
• Connectivity issues between the endpoint and the WSUS/MECM server

Common Issues and Fixes

Quick Reference: All Status Check Commands

# Check SENSE service status
sc query sense

# Full Defender status (PowerShell - Admin)
Get-MpComputerStatus

# Quick MDE onboarding + mode check
Get-MpComputerStatus | Select-Object OnboardingState, AMRunningMode, AntivirusEnabled, DefenderSignaturesOutOfDate

# Registry-based MDE status
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" | Select-Object OnboardingState, SenseIsRunning, OrgId

# Check passive mode
(Get-MpComputerStatus).AMRunningMode

# Check when signatures were last updated
(Get-MpComputerStatus).AntivirusSignatureLastUpdated

Need Help with Microsoft Defender for Endpoint?

Deploying and maintaining MDE across a fleet of Melbourne business devices requires more than running a few PowerShell commands. A well-configured MDE deployment includes onboarding via Intune, custom detection rules, attack surface reduction policies, and regular review of the Defender portal.

Melbits manages Microsoft Defender for Endpoint deployments for Melbourne businesses across professional services, healthcare, legal, and accounting. We're a Microsoft Partner with hands-on experience configuring MDE for organisations of 10–150 staff.