# All eligible endpoints are onboarded to Microsoft Defender for Endpoint
Microsoft Defender for Endpoint provides next-generation antimalware, endpoint detection and response, and threat and vulnerability management on Windows…
Source: https://maester.dev/docs/tests/ZTA.41045
## Overview
Microsoft Defender for Endpoint provides next-generation antimalware, endpoint detection and response, and threat and vulnerability management on Windows, macOS, Linux, iOS, and Android devices. When an endpoint is not onboarded, the device has no sensor reporting behavioral telemetry back to the service. An adversary who reaches that device can disable local security tools, harvest credentials, move to adjacent systems, and stage destructive or exfiltration activity without generating any alert in the Defender XDR portal. The unmonitored host becomes a stable foothold precisely because the security operations team has no visibility into what is happening on it. The risk is not limited to the individual device: because an attacker can use the blind spot to pivot into monitored segments undetected, a single onboarding gap can undermine the detection coverage of the entire environment. Onboarding every eligible endpoint ensures that the EDR telemetry pipeline has no gaps, that automated investigation and response can act on threats wherever they appear, and that the security team's mean time to detect remains bounded across the full device estate.
## Remediation
- [Onboard devices to Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/onboard-configure)
- [Onboard Windows client devices](https://learn.microsoft.com/en-us/defender-endpoint/onboard-windows-client)
- [Onboard non-Windows devices to Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-non-windows)
- [Run a detection test on a newly onboarded device](https://learn.microsoft.com/en-us/defender-endpoint/run-detection-test)
- [Fix unhealthy sensors in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/fix-unhealthy-sensors)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Endpoint threat protection |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Endpoint antivirus |
| Area | Devices and endpoints |
| ATT&CK | [T1685](/docs/tests?mitre=T1685) Disable or Modify Tools, [T1003](/docs/tests?mitre=T1003) OS Credential Dumping, [T1021](/docs/tests?mitre=T1021) Remote Services |
| Licence | WINDEFATP, MDE_LITE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.