Deploy Endpoint Security Settings on Windows Non-Persistent VDI

For non-persistent VDIs that are not Intune-managed and not supported by Security Settings Management, use the VDI-specific onboarding and then apply Defender settings through traditional management channels (for example, Group Policy or your VDI/image management tooling).

1. Onboard the non-persistent VDIs correctly
   • In the Microsoft Defender portal go to Settings > Endpoints > Device management > Onboarding.
   • Select the OS.
   • For Deployment method, select VDI onboarding scripts for non-persistent endpoints.
   • Download the package and copy the content from WindowsDefenderATPOnboardingPackage into the golden/primary image under: C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup.
   • For a single Defender entry per device, copy both:
     • Onboard-NonPersistentMachine.ps1
     • WindowsDefenderATPOnboardingScript.cmd
   • Configure the startup script in Local or Domain Group Policy:
     • Open Computer Configuration > Windows Settings > Scripts > Startup.
     • On the PowerShell Scripts tab, add Onboard-NonPersistentMachine.ps1. The .cmd file is triggered automatically.
   This ensures each non-persistent VM is onboarded correctly to Microsoft Defender for Endpoint.
2. Deploy Defender Antivirus and security settings
   • Use Group Policy, your VDI management platform, or other configuration tools against the golden image and/or VMs to configure Microsoft Defender Antivirus and related protections.
   • For non-persistent VDI, follow the guidance in Configure Microsoft Defender Antivirus on a remote desktop or virtual desktop infrastructure environment, including:
     • Setting up update sources and cache maintenance.
     • Applying recommended configuration such as Attack Surface Reduction rules, network protection, SmartScreen, tamper protection, and exclusions as appropriate for the environment.
3. Avoid onboarding the primary/template image with the single-entry method
   • If the primary image, template VM, or replica VM is onboarded using the single-entry method, Defender for Endpoint will not create entries for new non-persistent VDIs in the portal. Ensure onboarding follows the non-persistent VDI script method described above.
4. Verify that policies and settings are applied
   • After policy deployment and VDI startup, validate locally on a VM:
     • Use Get-MpPreference to confirm Defender Antivirus configuration values (for example, exclusions, ASR rules, network protection state) match the intended policy.
   • In the Microsoft Defender portal, confirm that:
     • Non-persistent VDI devices appear as separate devices (if using multiple entries per device) or as expected single entries.
     • Device configuration and protection status reflect the applied settings.
   • For VDI performance tuning, run the Windows Defender Cache Maintenance scheduled task on the main image before sealing, as documented, to avoid high CPU usage on each VM.

This combination—VDI onboarding scripts plus Group Policy or equivalent configuration, and local verification with Get-MpPreference—is the supported way to deploy and validate Defender Endpoint security settings on non-persistent VDIs that are not managed by Intune.

References:

• Onboard non-persistent virtual desktop infrastructure (VDI) devices in Microsoft Defender XDR
• Configure Microsoft Defender Antivirus on a remote desktop or virtual desktop infrastructure environment
• Learn how to use Intune endpoint security policies to manage Microsoft Defender for Endpoint on devices that are not enrolled with Intune