Microsoft Defender for Endpoint is a paid security product that extends Microsoft Defender Antivirus (included for free in Windows) with enterprise capabilities, including a full EDR product that reports security telemetry into a security operations center (SOC).
Recently, some recently-retired Microsoft employees have been surprised to discover that their personal PCs that had previously been used in a BYOD (bring your own device) manner are still applying Microsoft security policies. For example, an ex-employee might see this block from Network Protection when visiting Grammarly.com:
When this happens, the user is often confused, either thinking Microsoft Defender is blocking everyone from visiting Grammarly’s website (it’s not), or realizing that it’s only their device previously used for work but not understanding why/how.
Some ex-employees are especially confused because they know that they remembered to “offboard” their device from Microsoft Corp, leaving the domain and/or performing the Intune offboarding process.
The confusion arises because Microsoft Defender for Endpoint doesn’t care whether your device has been disjoined from the domain or offboarded from Intune policies: neither of those actions will offboard your device from the enterprise’s Microsoft Defender tenant.
Today, the Windows Security app makes no mention of the fact that a given device is onboarded to a Microsoft Defender tenant:
To see whether your device is onboarded, you can check the registry. Look inside the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection key for the OnboardedInfo for information about which tenant your device is onboarded to. The senseId and senseGuid are the unique identifiers sent to the SOC when reporting security telemetry.
To offboard your device from an enterprise’s Defender tenant, you can’t simply delete a few registry keys and call it a day. Many of Defender’s registry keys and services are protected from modification by Tamper Prevention code inside Defender’s kernel module designed to prevent unauthorized modifications.
Instead, you must run a signed offboarding script generated by the organization that tells the MDE client that the machine has been offboarded. Only after the client verifies the validity (signature, expiration) of the offboarding blob, will the device successfully offboard. These validity checks are critical, because otherwise initial access malware on a device could simply begin its attack by offboarding the device before further elevating privileges, moving laterally, and attacking the rest of the organization.
Unfortunately for ex-employees without access to their former-company’s IT helpdesk (to allow them to run the offboarding script), the easiest way to resolve this situation is to back up your files and then reinstall Windows.
Stay safe out there!
-Eric