Enable Defender

Purpose

This solution contains the automation to enable the defender and provide an option to create a ticket for failure.

Associated Content

Content	Type	Function
cPVAL Enable Defender Only	Custom Field	This custom field is required to be set to enable defender only without ticket creation on failure.
cPVAL Enable Defender With Ticket On Failure	Custom Field	This custom field requires enabling Defender with ticket creation on failure.
cPVAL Defender Enable Status	Custom Field	This custom field stores the success or failure of the Enable Defender automation.
Enable Defender	Script	Enables / repairs Microsoft Defender Antivirus when Webroot or another active AV is not present.
Create Ticket for Enable Defender Failure - Server	Compound Condition	This compound condition is used to create a ticket if the Enable Defender Automation fails on a Windows server and the custom field cPVAL Enable Defender With Ticket On Failure is set to either Windows or Windows Server.
Create Ticket for Enable Defender Failure - Workstation	Compound Condition	This compound condition is used to create a ticket if the Enable Defender Automation fails on a Windows workstation and the custom field cPVAL Enable Defender With Ticket On Failure is set to either Windows or Windows Workstation
Enable Defender - Workstation	Compound Condition	This compound condition is used to run automation to enable Defender on the Windows workstation if the custom field cPVAL Enable Defender Only or cPVAL Enable Defender With Ticket On Failure is set to Windows or Windows Workstation.
Enable Defender - Server	Compound Condition	This compound condition is used to run automation to enable Defender on the Windows server if the custom field cPVAL Enable Defender Only or cPVAL Enable Defender With Ticket On Failure is set to Windows or Windows Server.

Implementation

1. Create the below custom fields:
   • cPVAL Enable Defender Only
   • cPVAL Enable Defender With Ticket On Failure
   • cPVAL Defender Enable Status
2. Create the script Enable Defender
3. Create the below compound conditions:
   • Enable Defender - Workstation
   • Enable Defender - Server
   • Create Ticket for Enable Defender Failure - Workstation
   • Create Ticket for Enable Defender Failure - Server
4. Enable the custom fields as per your requirement
5. Enable both the compound conditions.

FAQs

Q1. What is the difference between cPVAL Enable Defender Only and cPVAL Enable Defender With Ticket On Failure?

A: cPVAL Enable Defender Only triggers the Defender enablement automation without creating a ticket if the automation fails. This option is suitable when you want Defender enabled but do not require failure notifications through ticketing.

cPVAL Enable Defender With Ticket On Failure not only triggers the Defender enablement automation but also creates a ticket if the automation fails, allowing technicians to investigate and remediate the issue.

Q2. Do I need to enable both cPVAL Enable Defender Only and cPVAL Enable Defender With Ticket On Failure?

A: No. Either enable cPVAL Enable Defender Only when no ticket is required. Or enable cPVAL Enable Defender With Ticket On Failure to generate a ticket.

Q3. What should I do if I want a ticket if Defender fails to enable for Server but do not want a ticket if it fails for workstations?

A: Select Windows Workstation from the drop-down for cPVAL Enable Defender Only and select Windows Server for cPVAL Enable Defender With Ticket On Failure at client or site as per your requirement.

Q4. How do I enable Microsoft Defender on Windows devices using this automation?

A: To enable Microsoft Defender, configure either cPVAL Enable Defender Only or cPVAL Enable Defender With Ticket On Failure with one of the supported values: Windows (applies to both servers and workstations) Windows Server (applies only to servers) Windows Workstation (applies only to workstations)

The appropriate compound condition Enable Defender - Server or Enable Defender - Workstation will then execute the Enable Defender script on eligible devices.

Q5: What role do the compound conditions play in the Defender automation workflow?

A: The compound conditions act as decision points that determine whether the automation should run and whether a failure ticket should be created.

The workflow is as follows:

• A supported value is configured in either cPVAL Enable Defender Only or cPVAL Enable Defender With Ticket On Failure.
• The applicable compound condition (Enable Defender - Server or Enable Defender - Workstation) evaluates the device type and initiates the Enable Defender script.
• The automation result is written to cPVAL Defender Enable Status.
• If the automation fails and ticketing is enabled, the appropriate ticket creation compound condition (Create Ticket for Enable Defender Failure - Server or Create Ticket for Enable Defender Failure - Workstation) generates a service ticket.

Changelog

2026-10-12

• Initial version of the document