User request to install .NET framework once Threat Defense for Active Directory policy is assigned.

Products

• Endpoint Threat Defense for Active Directory
• Complete Endpoint Defense (with SEP)

Issue/Introduction

Upon deploying the Threat Defense for Active Directory (TDAD) policy fusers are requested to install .NET framework 3.5. Microsoft Office apps may also prompt to start in safe mode.

Environment

Threat Defense for Active Directory (cloud) - SES Complete.

Threat Defense for Active Directory on premises 

Cause

If Enable Legacy .NET Obfuscation is on in the TDAD policy, any endpoint without .NET 3.5 will trigger an install of the same

Resolution

For SESC, this was enable automatically in the policy. Please be sure the option "Enable Legacy .NET Obfuscation" setting has set on "Disabled".  This option in the Advanced Options section of the TDAD policy

For TDAD on-premises, .NET is a requirement for the process to inject in memory, therefore it should be installed and no workaround is available.

Additional Information

CRE-9762