Huntress EDR now surfaces Windows Subsystem for Linux (WSL) status on your Windows endpoints, showing where Linux workloads run across your fleet.
WSL lets users run Linux directly on Windows, which may often go unnoticed, making it a blind spot for shadow IT and unsanctioned use. Now you can see whether it's running and decide whether to allow it, investigate it, or remove it.
Because WSL environments are tied to a Windows user account, the EDR agent page in your portal now shows:
- WSL status: Installed or Uninstalled
- Per account with WSL: instance name, user account, SID, WSL version, and state (running or stopped)