Microsoft Endpoint Protection and Windows Server

For current versions of Windows Server, antivirus technologies are somewhat similar to those offered for the Windows client but are packaged differently at key layers.

On Windows Server 2012 R2 and newer, the options include the following:

• Microsoft Defender Antivirus: a free, unmanaged antivirus (AV) client now built into all editions of Windows Server
• Configuration Manager (CM) and Endpoint Protection (EP): endpoint protection management and reporting for organizations
• Microsoft Defender for Servers: a paid subscription service delivering the in-depth endpoint detection and response (EDR) features of Microsoft Defender for Endpoint, integrated with Windows Server 2012 R2 and newer and with Linux servers.

The features of Microsoft Defender Antivirus on Windows Server are effectively identical to its capabilities when running on Windows. Both editions of Windows Server offer the same security features limited to Windows Enterprise edition.

CM can be used in concert with EP to manage Microsoft Defender Antivirus running on Windows Server systems, in addition to OS-native security features (such as Credential Guard), whether protected systems are running on-premises or in a hosting provider. Managing in this manner requires Server Management Licenses (Server MLs) for every operating system environment (OSE) that is managed. The Intune management service is designed only for client mobile device management (MDM) and cannot be used to manage servers of any kind.