The issue of MDE EP2 is that they roll-out signature-based definitions to all fleets of all customers with what appears to be insufficient testing. This led to

The issue of MDE EP2 is that they roll-out signature-based definitions to all fleets of all customers with what appears to be insufficient testing. This led to a situation where it decided to delete all of the shortcuts to apps, leading end users to believe all of their apps were removed. If there is malware on a machine, it's already compromised and needs to be reimaged rather than selectively, haphazardly repaired through so-called "remediations". There should be no malware on a machine to begin with by disallowing running random software from untrusted sources. Signature-based anti-malware is a last line of defense, reactive security often unable to prevent a machine from being compromised as it already happened. Another issue is that only a fraction of malware ever has signatures for them by either being too new or not widely seen. A final problem is mis-categorizing things as "malware" when they do no harm but do things certain factions of people don't like: remote control, recover passwords, and pirate keygens.