Install System Center Endpoint Protection (SCEP) During SCCM OSD Task Sequence Process

Adding System Center Endpoint Protection (SCEP) installation directly into your OSD task sequence means every freshly imaged machine has antivirus protection active from first boot, rather than waiting for a separate post-deployment install cycle.

Prerequisite

SCEP needs to already be set up as a deployable Application in your Software Catalog first (with the Endpoint Protection client package created and a test install confirmed working from Software Center) before you can reference it in a task sequence.

Adding It to the Task Sequence

1. Open your OSD task sequence for editing.
2. Add an Install Application step, positioned after the step that installs the Configuration Manager client.
3. Give the step a clear name (e.g. “Install SCEP”).
4. Click the yellow star/Add button and select your System Center Endpoint Protection application from the list.

When the task sequence reaches this step, SCEP installs with your default antivirus policy applied automatically. Test on a pilot deployment collection first to confirm the install completes before the task sequence moves on to any subsequent steps that assume protection is already active.

This Step Isn’t Needed on Windows 10/11 (Updated for 2026)

Worth flagging before you build this into a task sequence today: the separate “Install Application” step above is specifically for Windows 8.1 and earlier, where Microsoft’s own documentation confirms the Endpoint Protection client installs alongside the Configuration Manager client as a distinct package. On Windows 10, Windows 11, and Server 2016 and later, Microsoft Defender Antivirus already ships built into the OS, and a management client for it gets wired up automatically the moment the Configuration Manager client itself installs during OSD — no separate SCEP application step required. What you still need is an Endpoint Protection custom client settings policy (with your antimalware policy configured) targeted at the collection your new machines land in, so Defender picks up your organisation’s settings as soon as it’s managed. For a modern build, skip the Install Application step here and confirm client settings deployment instead.

Resources

• OSD
• Install Endpoint Protection (SCEP) using the SCCM Software Catalog
• guide