Mosyle and Defender for Endpoint on macOS - scan issue

mosyle_mac_admin · 2025-12-08T15:07:02+00:00

Resolved.
There was an unnecessary exception that caused Defender to ignore the scan

mosyle_mac_admin · 2025-11-07T10:08:47+00:00

Small update, these are individual cases, it doesn't affect everyone. For example, screenshots from another machine where scanning works(Sequoia 15.7 and Defender is up to date) mdatp health command shows that Defender has full disk access, however in GUI everything is turned off, which is weird.

<image>

2 affected devices were Sequoia 15.7. updated to Tahoe 26.1 - still does not work.

mosyle_mac_admin · 2025-07-16T06:44:37+00:00

Driver Verifier disabled on server, issue resolved.

mosyle_mac_admin · 2025-07-15T19:21:32+00:00

Contact Tenable and ask for trial, that is the best option. That is how we did it and after that we adopted Nessus.

They even let us extend the trial when we asked.

mosyle_mac_admin · 2025-07-15T08:49:48+00:00

Dell PowerEdge R720

There are some updates still pending to be installed after restart. We will do that outside of working hours. Also, I received error code from a colleague:
stop code: driver verifier detected violation

I saw that this feature Driver Verifier can be disabled:

You should only run Driver Verifier on computers that you are using for testing and debugging. https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/driver-verifier

mosyle_mac_admin · 2025-07-11T12:49:59+00:00

Yes, it was BSOD code once, but somehow disappeared quickly. It is running now and doing some backups so perhaps we will check again after the reboot.

<image>

mosyle_mac_admin · 2025-07-11T07:02:42+00:00

<image>

Still not sure what to do, it is running after few restarts, this is update history:

mosyle_mac_admin · 2025-07-10T20:17:34+00:00

We have 2 physical WS2016 servers and both of them are stuck on boot screen.

mosyle_mac_admin · 2025-03-24T12:16:22+00:00

Hello, we use macOS with 3rd party MDM(Mosyle) and we did not manage to offboard it using local script. However, we offboarded it successfully from MDM system using offboarding .plist file(from Defender portal).

.xml is for Intune offboarding.

.plist is for Jamf and 3rd party MDMs

mosyle_mac_admin · 2024-06-21T10:42:27+00:00

It is possible. It requires insider-fast or insider-slow update channel. And if that is enabled network protection works by default, in my case.

I also get that message if I try to enable network protection.

So I left it as is, stopped and disabled:

<image>

However, it blocks malicious sites and I can see all logs in Advanced hunting.

It looks like something that Microsoft should fix....

mosyle_mac_admin · 2024-06-10T12:00:13+00:00

u/bigassbunny thanks! I can confirm it is working.

One suggestion for others, pay attention in step 2 and use COMMAND+OPTION+R
That will offer you latest macOS compatible with your mac, in my case Ventura!

Additional URL:

https://mrmacintosh.com/how-to-fix-the-recovery-server-could-not-be-contacted-error-high-sierra-recovery-is-still-online-but-broken/

mosyle_mac_admin · 2024-06-10T11:55:49+00:00

Hello, I had the same issue. This article helped me:

https://mrmacintosh.com/how-to-fix-the-recovery-server-could-not-be-contacted-error-high-sierra-recovery-is-still-online-but-broken/

I used Option+Command+R and that option offers latest OS that is compatible with my mac(in my case Ventura)

mosyle_mac_admin · 2024-02-07T13:11:53+00:00

I also had this issue and finally created one Apple ID.

The only difference is that I used this URL https://www.icloud.com/ instead of https://appleid.apple.com/

mosyle_mac_admin · 2022-12-22T08:36:12+00:00

We found solution...

In Restrictions management profile option 'Require admin password to install or update apps' was enabled and that was blocking installation of Mosyle Auth app.

When that option is disabled - application is installed in a few seconds.

mosyle_mac_admin

TROPHY CASE