Harmony endpoint - How to scan an offline device without installing the endpoint agent

[mistercinux]

Hello guys, 

We receieved new computers managed by the machine manufacturer.

Those machines are isolated in separeted networks, but we can’t install the endpoint agent on them.

However, we  would like to scan those machines for malicious files before connecting them to the network. 

Can I do that with my harmony endpoint ?

Best ragerds,

Chris

[the_rock · Accepted solution]

Im fairly positive Chris that can NOT be done without harmony endpoint agent installed.

[mistercinux]

Hi Andy 

Thank you for your answer. 

Are there some good recommendation / best practices we can apply in this scenario ? 

Best regards,

Chris

[the_rock]

Never really tried this myself, but here is what I found online..

*************************************

Bootable malware scanning media (Best option)

Use a bootable AV scanner that runs outside the OS:

• Microsoft Defender Offline

• ESET SysRescue

• Kaspersky Rescue Disk

• Sophos Bootable Anti-Virus

Why this works well

• No agent installation required

• Scans disks before the OS loads

• Ideal for air‑gapped or isolated networks

[lluner · Accepted solution]

@mistercinux 

The only option is to use Microsoft Defender offline.

-----------AI ------------------

How to Run a Microsoft Defender Offline Scan

1. Open Windows Security (search for it in the Start menu or go to Settings > Privacy & security > Windows Security > Open Windows Security).
2. Select Virus & threat protection.
3. Under Current threats, click Scan options.
4. Choose Microsoft Defender Offline scan.
5. Click Scan now.
6. Confirm the prompt: Save any open work, as your PC will restart soon.

[the_rock]

Definitely seems like a logical approach!

[mistercinux]

Hello lluner, 

This seem to be the good way for us. 

Thank you very much for your help! 

Best regards,

[lluner]

@mistercinux 

At this link you can download offline Windows Defender signatures.

https://www.microsoft.com/en-us/wdsi/defenderupdates

[the_rock]

Excellent stuff @lluner 

[lluner]

You can create a package with the firewall blades and use it to allow access only to your Super Node. If you need help, I can provide more information.

1- Offline package

2- Updates via Supernode

[lluner]

@mistercinux 

an example with images