Can anyone recommend a method for identifying agents where Windows Defender is enabled?
Thanks in advance.
Check the service Start DWORD for value of 2: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
There are also policy values that can be set: support.microsoft.com/.../927367
And remember, Microsoft Security Essentials was renamed back to Windows Defender and built-in to Windows 8 by default.