ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Files are quarantined with WS.Reputation detections after enabling 'Co-Exist with Windows Defender' feature in SEPM or from ICDM console.

book

Article ID: 213330

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

After enabling the Windows Defender Co-Exist option in the Virus and Spyware policy, clients start seeing a large number of WS.Reputation.1 detections on non-executable files.

Cause

The Co-Exist option incorrectly triggers the SEP client to perform reputation lookups on file types that we do not support reputation for resulting in them being detected as WS.Reputation.1 incorrectly.

Environment

14.3 RU1 / 14.3 RU1 MP1

Windows Defender Co-Exist option is enabled

Resolution

For 14.3 RU1 and 14.3 RU1 MP1, disable the Windows Defender Co-exist option in the Virus and Spyware policy.

The Windows Defender Co-exist option is no longer available as of 14.3 RU2.