Windows Defender Advanced Threat Protection Service isn't listed as a seperate Software Installation since Windows Server 2019Summary<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Discovery uses the Windows Registry to identify Installed Software. The consolidated registry paths currently being checked by the ServiceNow WMI: Installed Software probe to identify installed software are as follows:https://{instance_name}.service-now.com/nav_to.do?uri=discovery_probes_wmi.do?sys_id=df4905820a0a0ba500b7ea51b460326cHKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Installer/UserData/*/Products/*/InstallProperties/HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/ProductIdHKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Uninstall/*/DisplayNameHKEY_LOCAL_MACHINE/SOFTWARE/WOW6432Node/Microsoft/InetStp/HKEY_LOCAL_MACHINE/Software/Wow6432Node/Microsoft/Windows/CurrentVersion/Installer/UserData/HKEY_LOCAL_MACHINE/Software/Wow6432Node/Microsoft/Windows/CurrentVersion/Uninstall/HKEY_USERS/*/SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall/For recent windows server versions, Microsoft Defender is integrated as a built-in Windows component and does not require a separate installation via MSI or EXE. As a result, the registry paths listed above—particularly those used by the WMI probe—do not contain Defender installation data, which limits its discoverability using these keys.