1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Administrator’s Guide (Compute)
    5. Install
    6. Deploy Prisma Cloud Defenders
    7. Install a single Host Defender
    8. Deploy Windows Defender

    Deploy Windows Defender

    Prisma Cloud can secure Windows containers running on Windows Server 2016 and Windows Server 2019 hosts. A single instance of Prisma Cloud Console can simultaneously protect both Windows and Linux containers on both Windows and Linux hosts. Prisma Cloud’s Intelligence Stream includes vulnerability data from Microsoft, so as new CVEs are reported, Prisma Cloud can detect them in your Windows images.
    The architecture for Defender on Windows is different than Defender on Linux. The Defender runs as a Docker container on Linux, and as a Windows service on Windows. On Linux, it is implemented as runtime protection in the userspace, and on Windows it is implemented using Windows drivers. This is because there is no concept of capabilities in Windows Docker containers like there is on Linux. Defender on Windows runs as service so it can acquire the permissions it needs to secure the containers on your host. When you deploy the Defender, it appears as a service. The Defender type "Container Defender - Windows" means that Defender is capable of securing your containers, not that it’s deployed as a container.
    To deploy Defender on Windows, you’ll copy a PowerShell script from the Prisma Cloud Console and run it on the host where you want to install Defender.

    Feature matrix

    The following table compares Prisma Cloud’s Windows Server feature support to Linux feature support:
    Platform
    Vulnerability
    Compliance
    Runtime defense
    Firewalls
    >Processes
    >Network
    >Filesystem
    >CNNS
    >WAAS
    Linux
    Yes
    Yes
    Yes
    Yes
    Yes
    Yes
    Yes
    Windows Server 2016
    Yes
    Yes
    No
    No
    No
    No
    Yes
    Windows Server 2019 (Host Defender)
    Yes
    Yes
    No
    No
    No
    No
    Yes
    Windows Server 2019 (Container Defender) with Docker runtime
    Yes
    Yes
    Yes
    No
    No
    No
    No
    Windows Server 2019 (Container Defender) with containerd runtime
    1
    Yes
    Yes
    Yes
    No
    No
    No
    No
    1
    Supported on AKS only.
    Windows Host Defenders support Windows compliance checks for hosts. Only Windows Container Defenders for Windows based containers support custom compliance checks.
    As a quick review, Prisma Cloud runtime defense builds a model of allowed activity for each container image during a learning period. After the learning period has completed, any violation of the model triggers an action as defined by your policy (alert, prevent, block).
    As Prisma Cloud builds the model, any interactive tasks that are run are logged. These interactive tasks can be viewed in each model’s history tab. On Windows, Prisma Cloud can’t currently detect when interactive tasks are run with the docker exec command, although Prisma Cloud does correctly record interactive tasks run from a shell inside a container with the docker run -it <IMAGE> sh command. No matter how the interactive task is run, however, the model will correctly allow a process if it’s in learning mode, and it will take action if the model is violated when in enforcement mode.
    Windows Container Defenders scan both the containers and the hosts where they run for vulnerabilities.

    Deploying Defender on Windows with Docker runtime

    Install Prsima Cloud Defenders on every Windows host you want to protect.
    Defenders are deployed with with a PowerShell 64-bit script, defender.ps1, which downloads the necessary files from Console. Defender is registered as a Windows service.
    Run the Prisma Cloud Defender deployment PowerShell script from a Windows PowerShell 64-bit shell.
    Prisma Cloud Windows container defenders are tested and supported for GKE Windows server containers.
    After the install is completed, Prisma Cloud files can be found in the following locations:
    Prerequisites:
    • Windows Server 2016 or Windows Server 2019. Prisma Cloud is not supported on Windows 10 or Hyper-V.
    • Docker for Windows (1.12.2-cs2-ws-beta) or higher. For more information about installing Docker on Windows, see Windows Containers on Windows Server.
    1. Log into Console
    2. Go to
      Manage > Defenders > Deploy
    3. Select
      Single Defender
    4. In
      Choose the Defender type
      , select
      Container Defender - Windows
    5. Copy the curl script and run it on your host to install Windows Defender
      If you install Windows locally on your laptop, the 'netsh' commands are not needed. They are only applicable to the GCE environment.

    Deploy Container Defender on Windows with containerd runtime

    You can also deploy the Windows container defender to protect your containers running on