In this article, I will list all the SCCM Endpoint Protection log files and their locations. SCCM allows you to manage anti-malware policies and Windows Firewall security for client computers in your Configuration Manager hierarchy.
SCCM Endpoint Protection also helps protect your PC from malware, viruses, spyware, and other potentially harmful software. In this post, I will cover the SCCM EPP log files and their locations.
I covered the procedures for installing the Endpoint Protection role and the necessary prerequisites in one of my posts. In another blog post, I covered Configuration Manager 1602 Endpoint Protection Improvements. SCCM 1602 adds some new settings in the Endpoint Protection anti-malware policy for Windows Defender.
It might be a good idea to learn what the endpoint protection log files are before enabling the endpoint protection role. Most importantly, knowing where the SCCM EPP log files are located is essential and will be very helpful to you when troubleshooting endpoint protection-related problems.
SCCM Endpoint Protection Log Files and Locations
The below table lists all the SCCM endpoint protection log files and the location of each log file. For a list of all other log files, refer to SCCM log files.
| SCCM Endpoint Protection Log File | Description | Endpoint Protection Log File Location |
| EPCtrlMgr.log | Records details about the synchronization of malware threat information from the Endpoint Protection role server into the Configuration Manager database. | Site system server hosting the role.
C:\Program Files\Microsoft Configuration Manager\Logs |
| EPMgr.log | Records the status of Endpoint Protection site | Site system server hosting the role.
C:\Program Files\Microsoft Configuration Manager\Logs |
| EPSetup.log | Provides information about the installation of the Endpoint Protection site system role. | Site system server hosting the role.
C:\Program Files\Microsoft Configuration Manager\Logs |
| EndpointProtectionAgent.log | Records details about the installation of the Endpoint Protection client and the application of anti-malware policy to that client. | Located on client machine. C:\Windows\CCM\Logs |
| MPLog-XX.log | Records Endpoint Protection activity on the client side. | Located on client machine.
C:\ProgramData\Microsoft\Windows Defender\Support |
| MPDetection-XX.log | Records details about each case of malware detected on the system. | Located on client machine.
C:\ProgramData\Microsoft\Windows Defender\Support |
| NisLog.txt | Records details about the Network Inspection System. | Located on client machine.
C:\ProgramData\Microsoft\Windows Defender\Network Inspection System\Support |
Is it possible to limit how much of these logs get saved on client workstations?
Additionally, I would add WUAHandler.log as this is where the definition updates installations are being logged.
Is it possible if logs of the client to SCCM? I want the hash value of threat to be sent to SCCM. IS it customizable?
Is the given log files list remains same in SCCM 1906 (Version:5.00.8853.1000)?