Applications/Microsoft Defender ATP.app/Contents/Resources/wdavdaemon.app/Contents/MacOS/wdavdaemon The plist responsible for weavedaemon is Library/LaunchDaemons Tools % ls /Library/LaunchDaemonsĬom.Ĭom.plistĬom. MacOS houses instructions for LaunchDaemons in the following directory PROCESS Microsoft Defender is running, pid=2665

Shell-init: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory Running check_state.sh returned the following results Tools % /Library/Extensions/wdavkext.kext/Contents/Resources/Tools/check_state.sh

There are a number of scripts inside the extension package that can be used to check on the health of the Defender status Looking inside the wdavkext.kext has returned some interesting results Tools % ls /Library/Extensions/wdavkext.kext/Contents/Resources/Tools My first assumption was an issue with Kernel Extensions, which are located in Health check has now regressed with the following error message Downloads % mdatp -healthįailed to connect to daemon.

Defender for endpoint mac