How To Install Microsoft Security Essentials In Windows Server 2012 R2

Windows Defender has been built into Windows 8, 8.1 and 10 by default to provide protection against malware, however there is no such default program installed in the Windows server operating system.

To provide a basic level of security in a small server environment, we can install Microsoft Security Essentials with some simple modifications which contains most of the functionality of Windows Defender for free.

By default if you try to install Microsoft Security Essentials in Windows Server you will receive various errors which we will cover how to fix here.

While it is not possible to directly download Windows Defender to install, we can instead make use of Microsoft Security Essentials which is available as a slightly cut down version for older versions of Windows, such as Windows 7, in order to help protect against viruses, spyware and other malicious software. Microsoft Security Essentials provides most of the protection methods that Windows Defender does with the exception of rootkit and bootkit protections.

It is important to note that Microsoft Security Essentials is designed to provide a basic level of free protection for home or small business PCs rather than important server infrastructure. Despite this, users with a very small amount of Windows server installations have been looking for ways to install Windows Defender in order to provide at least a basic level of security.

While this is not officially supported, it does provide an increased level of security that is better than nothing, however it’s recommended that you look into using a proper product that is fit for purpose such as Microsoft’s System Center Endpoint Protection (SCEP) which is an enterprise antimalware solution. SCEP does require paid licensing to work, so for a very small environment Microsoft Security Essentials can at least provide a basic level of security protection.

Although installing Microsoft Security Essentials in a server operating system is not officially supported, it does work and correctly detects threats, as we’ll see here in our example.

Microsoft Security Essentials Installation Guide For Windows Server

    Download and Install

  1. Firstly you’ll want to download Microsoft Security Essentials onto your Windows server. Select the language of your choice and either 32-bit or 64-bit depending on the architecture your server operating system is using.

    Microsoft Security Essentials Download Language and Architecture

  2. Save the mseinstall.exe file somewhere locally on the server, do not simply run it as by default the installation will fail with the following error:

    Microsoft Security Essentials cannot be installed on your operating system.
    
    Your version of the Windows operating system is not supported by this program.
    
    Error code:0x8004FF04
    

    How to fix 0x8004FF04 error

  3. To get around this error message, right click the mseinstall.exe file and select properties.

    mseinstall.exe properties

  4. From the properties window, select the compatibility tab. Within the compatibility tab tick “Run this program in compatibility mode for:” under Compatibility Mode and select Windows 7 from the drop down box, as shown.

    mseinstall.exe compatibility mode

    Click OK to continue.



  5. If you were to run the mseinstall.exe file at this point, you would receive a different error as shown below:

    Microsoft Security Essentials cannot be installed on your operating system. 
    
    Windows Program Compatibility mode is not supported by this program.
    
    Error code:0x8004FF71
    

    How to fix error 0x8004FF71

    In order to resolve this, run command prompt as administrator and enter the folder where the mseinstall.exe file is located. Run the mseinstall.exe file with the /disableoslimit flag on the end as shown below.

    mseinstall.exe /disableoslimit

  6. The installation wizard should now correctly open and Microsoft Security Essentials can now be installed and will proceed without the previous error messages, click Next to continue and work through the installation wizard.

    install1

  7. Once the installation has completed you can optionally update and perform a scan, this is recommended as the definitions database needs to be kept up to date to find newer threats. An Internet connection will be required to download any available definition updates through the application, however these can also come through from Windows updates so if you have a WSUS server you can update from here as well. After updating a quick scan will take place.

    Microsoft Security Essentials Installation Complete

    You can select the Settings tab to modify when the weekly automatic scheduled scan takes place, by default a quick scan is set to run every Sunday at 2am and will not use more than 50% of the available CPU resources.

    Microsoft Security Essentials Default Settings

  8. Testing

  9. Now that Microsoft Security Essentials has been successfully installed, we will test the actual functionality of the program to ensure that it will correctly identify a threat. To do this we will create a test EICARs file and see if the real-time protection automatically detects and quarantines it.

    Essentially we are just going to open Notepad and create a .txt file containing the test string defined on that page and then save it to the desktop.

    EICAR test file

  10. Shortly after saving the file we have been visually alerted that malware has been detected and that Microsoft Security Client is taking action to clean the detected malware.

    Maleware detected

    If we check the History tab of Microsoft Security Essentials we can then see the test file listed as a quarantined item, confirming that it is working correctly as intended in Windows Server 2012 R2.

    Malware quarantined



Summary

Although not officially supported, we have successfully installed Microsoft Security Essentials (a cut down Windows Defender) in Windows Server 2012 R2 and confirmed that it is working correctly and detecting security threats.

This is better than the default level of security, which is none as Windows Defender is only built into Windows 8, 8.1 and 10 client operating systems, however it is recommended that server operating systems make use of enterprise solutions such as System Center Endpoint Protection (SCEP) or some other option available from some security vendor.

Leave a comment ?

33 Comments.

  1. Thanks a lot this really Helped

  2. Hi… great help… one problem though, if you disable the protection (my case while I made some tests) you wont be able to turn it on again, worse since you wont be able to uninstall or re install the application. Any ideas… please?

  3. Hi Jarrod,
    thank you for quality instruction.
    I was needed to uninstall msse, however Programs and Features Uninstall result error (your version of Windows is not supported), running mseinstall /disableoslimit is resulting error (only one instance can be instaled).
    I would apprechiate your advice.
    Regards

    • Hmm I’m not too sure there, I’ve just tested uninstalling through add or remove programs and it worked fine without error, I confirmed it properly uninstalled and even deleted the C:\Program Files (x86)\Microsoft Security Client\ directory after itself during clean up, the uninstaller for me exited with no error. Without being able to replicate there’s not too much I can try to test unfortunately.

  4. Another problem is program updates fail, although the definitions updates are OK
    Is there a cure for that?

  5. To uninstall mse:
    1. Go to Control Panel and try to uninstall the program.
    2. When you get the error message, DO NOT CLOSE IT, go to process viewer and see the location of the setup.exe which is the source of the message
    3. Go to the file location and do with it the same trick as with the installation, just add one more parameter: “/u” – for uninstall.

    • Oh good tip, as I mentioned I was able to remove it through add or remove programs without any issues.

    • I am still not able to uninstall it. I’ve navigated to C:\Users\Administrator\AppData\Local\Temp\{0A85E946-FDF1-4DC0-9C0E-04A4AD5E2F90} in the command prompt then tried setup.exe /disableoslimit /u but it still says that it cannot be installed on this OS

      It is killing my CPU and I cannot change its properties as everything is grayed out.

      Urgh!!!

      Any help would be most welcome

      Pete

    • Worth a note there, you can uninstall it by this instructions but add the compatibility to Windows 7 along with the /u

  6. Good Stuff. I like how you documented and screen captured each step. I ran this and it worked perfectly. I added my Exclusion list to each server we have 2012 R2 and all is running perfectly. BTW all our VM’s are in Azure. Only issue I am seeing, is Operations Manager is showing it is does not see Anti-Virus on the systems. Great document. Have a great weekend.

  7. Worked for me as well Thanks a lot. Gotta be protected since WannaCryptor is nearby you never know :P

  8. Thanks for the workaround.

  9. C:\Users\vo2\AppData\Local\Temp\{B24B6149-6EE7-4CA8-90FA-F437E76BE649}\setup.exe /disableoslimit /u

    This works, BUT! You must change setup.exe to run in Windows 7 compatibility mode first.

  10. Thank you for the post. Easy-to-follow guide.

  11. Thanks! Worked great

  12. Thank you very much..

  13. Good job. Still works on a fresh install of Server 2012 R2 on 4/5/19.

  14. BRUCE GRAYTON MUZAWAZI

    thanks so much.. this really helped me.

  15. Fantastic Tutorial!
    You did a perfect and thorough job!!!

    Thanks a lot!!!
    Pat

  16. in my case i tried the 8th step. but my mse failed to detect it. tried installing it again but shows that only one instance of mse can be installed. so finally figured that mse is present. need guide how to open mse using cmd bcz it dosent show anywhere on the server.
    tnq

  17. Thanks you very much

  18. FYI, these steps also help UNinstall MSE from a server that you upgraded from 2012 to 2019. Have to do the steps on the file at c:\program files\microsoft security client\setup.exe and then add a /x to the end of the path along with the /disableoslimit.

  19. Christos Topakas

    One of the best articles i found regarding antivirus solution for windows server. Thank you very much for sharing this!

  20. Thank you for this! Been spending a lot of time researching on Microsoft’s security solution for Server 2012 R2, and couldn’t find a straight forward answer until I stumbled upon your article.

  21. Thanks alot for taking the time to put this out there. Much appreciated!

  22. This is gold! Pure gold! Thanks for creating it. It is working great for me as a short term solution until I add something more substantial.

Leave a Comment

NOTE - You can use these HTML tags and attributes:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>