Files are quarantined with WS.Reputation detections after enabling 'Co-Exist with Windows Defender' feature in SEPM or from ICDM console.

Products

• Endpoint Protection

Issue/Introduction

After enabling the Windows Defender Co-Exist option in the Virus and Spyware policy, clients start seeing a large number of WS.Reputation.1 detections on non-executable files.

Environment

14.3 RU1 / 14.3 RU1 MP1

Windows Defender Co-Exist option is enabled

Cause

The Co-Exist option incorrectly triggers the SEP client to perform reputation lookups on file types that we do not support reputation for resulting in them being detected as WS.Reputation.1 incorrectly.

Resolution

For 14.3 RU1 and 14.3 RU1 MP1, disable the Windows Defender Co-exist option in the Virus and Spyware policy.

The Windows Defender Co-exist option is no longer available as of 14.3 RU2.