Antivirus Transition Frequently Asked Questions

Overview

Below are frequently asked questions and answers related to the transition to Microsoft Defender to antivirus protection.

Detail

How do I confirm Microsoft Defender is running on my device?

In Windows 10, the Windows Security Center icon should be present in the system tray with a green checkmark if Defender is running.

You can also complete the following steps to confirm Microsoft Defender is running on your Windows 10 or Windows 8.1 device:

1. Open Task Manager and click the Details tab.
2. Scroll down and locate MsMpEng.exe. The Status column will indicate whether it is running.

How do I confirm Microsoft Defender for Endpoint is running on my University-owned device?

In Windows 10, the Windows Security Center icon should be present in the system tray with a green checkmark if Defender for Endpoint is running.

You can also complete the following steps to confirm Microsoft Defender for Endpoint is running on your Windows 10 or Windows 8.1 device:

1. Open Task Manager and click the Details tab.
2. Scroll down and locate MsSense.exe. The Status column will indicate whether it is running.

How does Microsoft Defender for Endpoint differ from Microsoft Defender?

Microsoft Defender for Endpoint is actually two products in one. It includes Microsoft Defender, Microsoft’s antivirus solution that is included with recent versions of the Windows operating system. It also includes Defender for Endpoint, which is a cloud-based enterprise security solution that builds on Defender’s antivirus features and enhances its capabilities for managed computers. Microsoft Defender for Endpoint also provides antivirus services to macOS-based Apple devices when deployed with our installation package. Computers that are transitioned to Microsoft Defender for Endpoint become centrally managed in order to take advantage of the features provided by this solution. The process of transitioning University-owned devices to Microsoft Defender for Endpoint is not automatic, but it can be automated with enterprise management tools used by Pitt IT or departmental IT support staff.

Why do I see a yellow warning icon when I check my Windows Security settings?

If you are not signed in to Microsoft OneDrive, you may see a yellow warning icon next to the Virus & threat protection category that looks similar to the warning in the image below. This warning is a recommendation to set up OneDrive for file recovery to protect against ransomware attacks. It does not mean that Microsoft Defender for Endpoint is not protecting your computer. It is not necessary to enable OneDrive, and you can dismiss the warning by clicking Dismiss while in the Virus & threat protection menu 

Do I have to install Microsoft Defender to pass the Health Check and use the PittNet VPN (virtual private network) service?

No. Microsoft Defender for Endpoint and Microsoft Defender are the University’s recommended antivirus solutions, but they are not required to pass the PittNet VPN Health Check. Please view our website for a list of antivirus products compatible with PittNet VPN. 

What does it mean to have administrative (admin) rights to my computer, and how do I know if I have admin rights?

If you have administrative rights on your computer, it means you can install and remove programs. Sometimes the account you use to access a computer does not have these rights. This may be the case if your computer is managed by your department's IT staff. To check if you have administrative rights on your computer, follow these steps:

Windows

1. Open the Control Panel.
2. Click the User Accounts option.
3. Click the User Accounts link again.
4. In User Accounts, your account name will be listed on the right-hand side of the screen. If your account has admin rights, it will say "Administrator" under your account name.

Mac OS X

1. Open the Apple menu.
2. Select System Preferences.
3. In the System Preferences window, click on the Users & Groups icon.
4. On the left side of window that opens, locate your account name in the list.
   1. If the word Admin is immediately below your account name, then you are an administrator.
   2. If the word Standard displays, then you are not an administrator.