Just finished upgrading to SCCM 2012 R2 SP1 and noticed that EndPoint Protection installed on my Windows 10 machines. I can't see the EP interface on those machines, just Windows Defender. Is that expected

Yes. Defender and SCEP have always been the same product (more or less) even in Win 8.x so it doesn't make any sense for them to disable Defender and install SCEP. Instead, with Win10 as a client, they simply take over management of Defender directly as if it were SCEP (which it is, just by a different name).

Thanks Jason. I didn't see the EndPoint icon in the Taskbar as it is on my Win 8.1 machines so I wondered what the deal was. I also noticed in the EndpointProtectionAgent.log these lines:

EP version 4.7.213.0 is already installed.
Expected Version 4.7.213.0 is exactly same with installed version 4.7.213.0

In Win 10, The Antimalware client version is 4.8.10122.0.

Maybe in RTM the versions will line up perhaps? I sure wish I had windowsupdate.log in Win 10!

The joys of pre-release software :-)

Amen!

Although this is expected behavior, it is actually big hassle. The interface is extremely limiting compared to Endpoint Protection. So even though the virus databases may be the same, the client is vastly different. Here is an article describing some of the changes. http://www.proweb-solutions.net/blog/sccm-2012-r2-sp1-windows-defender-explained/