However that did create a number of events in the system.log file Oct 31 22:49:26 Daniils-MBP (): Service only ran for 0 seconds. Loading and starting the daemon has not proven successful launchctl load /Library/LaunchDaemons/

Applications/Microsoft Defender ATP.app/Contents/Resources/wdavdaemon.app/Contents/MacOS Applications/Microsoft Defender ATP.app/Contents/Resources/wdavdaemon.app/Contents/MacOS/wdavdaemon The plist responsible for weavedaemon is Library/LaunchDaemons Tools % ls /Library/LaunchDaemonsĬom.Ĭom.plistĬom. MacOS houses instructions for LaunchDaemons in the following directory PROCESS Microsoft Defender is running, pid=2665 Shell-init: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory Running check_state.sh returned the following results Tools % /Library/Extensions/wdavkext.kext/Contents/Resources/Tools/check_state.sh There are a number of scripts inside the extension package that can be used to check on the health of the Defender status Looking inside the wdavkext.kext has returned some interesting results Tools % ls /Library/Extensions/wdavkext.kext/Contents/Resources/Tools My first assumption was an issue with Kernel Extensions, which are located in Health check has now regressed with the following error message Downloads % mdatp -healthįailed to connect to daemon.

Microsoft defender for endpoint mac