Malwarebytes Endpoint Protection on VM's

[WORKS2016]

Never installed Endpoint Protection on a VM, any objections? Running 2012 Server Standard with two VM's. One is the PDC the other is the Exchange server. I read installing on the PDC can create issues with DNS and DHCP and some configuration, mainly exclusions are recommended. Didn't matter if the PDC was a VM or not. How about a VM / Exchange server? Any issues that it's a VM and does it interfere with mail flow, the information store, etc? 

Thank you.

[gonzo]

I found this. Maybe it will be of some value.

 

 

[Kalrand]

@djacobson mentioned there was some updates to the above matrix.

 

[AndrewPP]

Do not put on a DC/DNS without reading/doing this - https://support.malwarebytes.com/docs/DOC-2591 

 

[Kalrand]

@AndrewPP The above link is in the resources for Malwarebytes Endpoint Security, the on-premise solution. Is this a concern for Malwarebytes Endpoint Protection, the cloud solution, which this forum is geared toward?

[djacobson]

@Kalrand that doc-2591 is for MBEP, MBES's Anti-Malware 1.80.2.1012 does not run mwac.sys, that is unique to the MB3 tech. What the KB outlines for DC's, that also run the DNS, is in line with Microsoft's best practices.

@WORKS2016 @gonzo and kalrand, I do have another matrix whipped up to represent the new MB3, 3.5.1.2600, in use with the latest agent updates.

 

Edited September 25, 2018 by djacobson

[AndrewPP]

Article is filed in support under business, Endpoint Protection content and correct as per Dyllon's clarification.

Direct filtered link to all EP content is this - https://support.malwarebytes.com/community/business/content?filterID=contentstatus[published]~category[endpoint-protection] 

[Kalrand]

Then I'm confused. We've been running MEP on our AD server with DNS for quite sometime, end of December of last year, and we haven't encountered this issue with the DNS being it's private address. Granted, we've never turned on active protection which may be the key. 

[AndrewPP]

If the four real-time detectors are turned off, MBAMService is not run, a different MBIR incident response plugin/service runs.

[anyWARE-Mainz]

Thank you for the information, but I'm confused. 

There are situations, where you do not enter 127.0.0.1 or do not enter as primary the DC/DNS it self.
There are also multiple Microsoft articles or articles from other IT-Pros, that differ a lot.

Just two examples:
https://blogs.technet.microsoft.com/notesfromthefield/2008/03/25/dns-client-configuration-for-windows-dns-servers/
https://www.dell.com/support/article/de/de/debsdt1/sln155801/best-practices-for-dns-configuration-in-an-active-directory-domain?lang=en

The MS article you refer to also says:
"A combination of the two strategies is possible, with the remote DNS server set as Preferred DNS server, and the local Domain Controller set as Alternate (or vice versa)"
(https://support.microsoft.com/en-us/help/825036/best-practices-for-dns-client-settings-in-windows-2000-server-and-in-w)

 

We use Malwarebytes cloud on a customers network on two virtual DCs, which have each other as primary DNS and themselves as secondary - without issues.
Or do I misunderstand some of your posts?
 

[AndrewPP]

You previously stated "Granted, we've never turned on active protection which may be the key "

Correct - If you configure this, you are running the MBIR plugin which has zero IP blocking capability and would see no symptom

If you turn on any realtime protection, MBIR plugin will be replaced by MBAMPlugin and you will see MBAMService started.  

The workaround on our support site was written in response to customers experiencing a problem with ActiveDirectory and DNS on the same host.  DNS was inadvertently blocked, the defect was reproducible, hence the article published. 

If you are not experiencing the issue/never had the issue and have realtime protection enabled, can you please provide some more specifics about your Windows operating system and configuration for each, so we can add to testing.  The defect is in our queue for resolution.

Edited October 17, 2018 by AndrewPP

[anyWARE-Mainz]

[...]
You previously stated "Granted, we've never turned on active protection which may be the key "
Correct - If you configure this, you are running the MBIR plugin which has zero IP blocking capability and would see no symptom
[...]

No, that was Kalrand (but interesting for me, too).
I'm wondering, if we use "active protection" - I'm not sure, but I think "yes", if it is the term for "real-time protection".
I like to provide some more information (did not want to hijack this thread, but it was interesting/informational - especially most
bigger companies use more than 2 or 3 DCs).

Here you are - maybe it helps - if you need more info, feel free to ask for:
OS of 2 DCs: 2012 R2
Virtual: yes
Roles: AD, DNS, one is DHCP
Each DC/DNS points 1st to the other DC and 2nd to itself. Example:
DC01: 192.168.0.2/192.168.0.1
DC02: 192.168.0.1/192.168.0.2

MBAM Options: