Defender Antivirus active, passive and EDR block mode next to a third-party antivirus

Installing a third-party antivirus doesn't simply switch Microsoft Defender Antivirus off. Depending on the Windows version and whether the device is onboarded to Defender for Endpoint, Defender runs in active mode, passive mode or is disabled, and each state changes which protections you actually have. In this post I'll explain how the mode is decided, what works in each one, how EDR in block mode fills the gap, and how to check and change the mode safely.

How the mode is decided#

Windows 10 and Windows 11#

On clients the decision is automatic. Windows Security Center detects the registered antivirus product, and Defender reacts:

Smart App Control on Windows 11 adds exceptions: with it on or in evaluation, Defender can enter passive mode next to another antivirus even on a device that isn't onboarded (Microsoft notes this isn't the same as Defender for Endpoint passive mode), and Microsoft lists a "hybrid mode" for Defender on non-onboarded devices with Smart App Control on.

Windows Server#

Servers behave differently. On Windows Server 2016 and later, Windows Server 2012 R2 and Azure Stack HCI OS 23H2 and later, Defender does not drop into passive mode when you install another antivirus. You set it with a policy registry value, ideally before onboarding:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v ForceDefenderPassiveMode /t REG_DWORD /d 1 /f

Servers that aren't onboarded and run another antivirus should have Defender disabled or removed: Uninstall-WindowsFeature Windows-Defender (on Windows Server 2016 also Windows-Defender-Gui), followed by a restart. Windows Server 2012 R2 and 2016 only support passive mode when they're onboarded with the modern unified solution; see onboarding Windows Server 2012 R2 and 2016 with the unified solution.

What works in each mode#

Defender for Endpoint indicators (file hash, IP address, URL and certificate) also need active mode, so in passive mode your third-party product has to cover those controls. Scheduled scans are ignored in passive mode, but the 30-day catch-up quick scan, the quick scan after a security intelligence update and existing Task Scheduler scan tasks still run unless you disable them.

EDR in block mode#

EDR in block mode lets Defender act on post-breach, behavioral detections from the EDR sensor even when it isn't the primary antivirus. Remediated items appear in the Action center as completed actions with the status Blocked or Prevented, and related alerts can show Defender Antivirus as the source.

Requirements, as Microsoft lists them:

• Defender for Endpoint Plan 2, with the device onboarded, and the Security Administrator role to turn it on.
• Windows 10 or 11, Windows Server 2019 or later, or Windows Server 2012 R2/2016 with the unified solution.
• Defender Antivirus installed and running in active or passive mode, with cloud-delivered protection enabled.
• Platform version (AMProductVersion) 4.18.2001.10 or later and engine (AMEngineVersion) 1.1.16700.2 or later.

Turn it on tenant-wide in the Microsoft Defender portal under Settings › Endpoints › General › Advanced features › Enable EDR in block mode. To target device groups instead (platform 4.18.2202.X or later), use the Defender CSP node Configuration/PassiveRemediation through Intune, or the Group Policy setting Computer configuration › Administrative templates › Windows components › Microsoft Defender Antivirus › Features › Enable EDR in block mode. EDR in block mode honors Defender Antivirus exclusions but not Defender for Endpoint indicators.

Step-by-step: running Defender next to another antivirus#

1. Add the Defender Antivirus and Defender for Endpoint binaries to the exclusion list of the third-party product, as Microsoft recommends.
2. On servers, set ForceDefenderPassiveMode to 1 before you run the onboarding package.
3. Onboard the device. Clients switch to passive mode on their own as long as the Windows Security Center service (wscsvc) is running.
4. Turn on EDR in block mode and leave real-time protection, cloud-delivered protection and limited periodic scanning turned on; Microsoft warns against turning them off in passive mode.
5. Keep security intelligence updates approved (for example in WSUS) so passive-mode scanning and EDR in block mode use current definitions.

Verify the mode#

Get-MpComputerStatus |
    Select-Object AMRunningMode, AMProductVersion, AMEngineVersion

AMRunningMode returns Normal (active), Passive or EDR Block Mode when Defender is enabled. If MsMpEng.exe isn't listed on Task Manager's Details tab, Defender is disabled or uninstalled. In Windows Security › Virus & threat protection, select Manage providers under Who's protecting me? to see which antivirus Windows considers active.

Switching back to active mode#

On clients, a Defender that was disabled automatically can re-enable itself when the other product is uninstalled, expires or stops providing real-time protection. On servers it should also switch automatically, but on some versions, such as Windows Server 2016, it can stay passive or disabled. Set ForceDefenderPassiveMode to 0 and restart, and if Defender was removed, reinstall it with Install-WindowsFeature -Name Windows-Defender. Confirm with Get-Service -Name windefend and AMRunningMode.

Tips and gotchas#

• Never disable wscsvc, SecurityHealthService, Sense or WinDefend. Without Security Center, a client can't detect the other antivirus and Defender stays active next to it, which Microsoft doesn't support.
• Settings for features that need active mode, such as ASR rules, network protection and cloud protection, have no effect in passive mode; that's a common reason for Defender settings not applying.
• Defender-specific update schedules are ignored in passive mode; Windows Update settings control the cadence.
• If a passive-mode device is slow during quick scans, profile it before adding exclusions: fixing Defender Antivirus high CPU.

References#

• Microsoft Defender Antivirus compatibility with other security products
• Endpoint detection and response in block mode
• Configure Microsoft Defender Antivirus on Windows Server