EDR in block mode, passive mode and third-party AV

Plenty of organisations run Microsoft Defender for Endpoint (MDE) as their EDR while another vendor's antivirus stays primary, at least during a migration. That is supported, but it changes what Defender Antivirus does on each device, and the details differ between clients and servers. Get them wrong and you end up with two products fighting, or with Defender quietly doing nothing while everyone assumes it is protecting the machine.

This guide explains the modes, how devices end up in each one, what EDR in block mode adds, and how to prove the state of every device. It builds on the Defender Antivirus hardening pillar and the wider Microsoft Defender topic.

The modes

Check it on any device:

Get-MpComputerStatus | Select-Object AMRunningMode, AMServiceEnabled, RealTimeProtectionEnabled,
  AMProductVersion, AntivirusSignatureAge, IsTamperProtected

Windows Security Center tells you which product is registered as primary:

Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct |
  Select-Object displayName, productState   # SecurityCenter2 exists on client editions only

What you keep and lose in passive mode

The table is the argument for finishing a migration: every row that says No is a protection you configured in policy but are not getting. For the full list, including automated investigation behaviour, see Microsoft's compatibility matrix for Defender Antivirus with other security products; it is updated as features change.

How devices end up in each mode

Windows 10 and 11 clients

Clients switch automatically. When a third-party antivirus registers with Windows Security Center:

• If the device is onboarded to MDE, Defender Antivirus moves to passive mode.
• If it is not onboarded, Defender Antivirus is disabled (optionally with limited periodic scanning).

When the third-party product is uninstalled, Defender returns to active mode by itself. A leftover policy can stop that: Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Turn off Microsoft Defender Antivirus (DisableAntiSpyware) is ignored on current platforms but still appears in many old GPOs. Remove it anyway so it can't confuse troubleshooting.

Windows Server

Servers do not switch automatically. With another antivirus installed and Defender still active, you get two real-time scanners on the same I/O: slow, and sometimes unstable. Before or during onboarding, set:

HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
  ForceDefenderPassiveMode   REG_DWORD 1

Deploy it with Group Policy Preferences or your server management tool, then onboard. To return a server to active mode, set the value to 0 (or remove it) and restart. Set the value before onboarding if the server should stay passive. From platform 4.18.2208, once an onboarded server is active with Tamper Protection on, Tamper Protection blocks the switch back to passive even with ForceDefenderPassiveMode = 1.

Do not uninstall the Windows Defender feature to "make room" for another product if the server is onboarded to MDE. Passive mode keeps EDR in block mode and a fallback available.

Clients that don't go passive

Microsoft documents ForceDefenderPassiveMode for Windows Server; on clients, passive mode depends on the third-party product registering with Windows Security Center. If the Windows Security Center Service is disabled, Defender can't see the other product and stays active alongside it, which Microsoft doesn't support. Fix the registration or the service rather than relying on a registry override.

EDR in block mode

EDR in block mode lets Defender Antivirus act on what the EDR sensor sees, even when another product is primary. If behavioural detection in MDE decides a file or process is malicious, Defender in passive mode blocks and remediates it: quarantining the file, stopping the process. Without it, MDE would raise an alert and wait for the other antivirus, or an analyst, to act.

Requirements:

• Defender for Endpoint Plan 2 (or a licence that includes it) and devices onboarded.
• Windows 10 or 11, Windows Server 2019 or later, or Server 2016 / 2012 R2 with the modern unified solution.
• Defender Antivirus installed and in passive or active mode, with platform 4.18.2001.10 and engine 1.1.16700.2 or later (in practice, keep both current).
• Cloud-delivered protection enabled in Defender's configuration.

Turn it on in the Microsoft Defender portal: Settings > Endpoints > General > Advanced features > Enable EDR in block mode. That toggle is tenant-wide; from platform 4.18.2202 you can instead target device groups with the Defender CSP Configuration/PassiveRemediation or the GPO Microsoft Defender Antivirus > Features > Enable EDR in block mode. Microsoft positions it primarily for devices where Defender is in passive mode.

Detections remediated this way appear in the portal's Action center as completed actions with the status Blocked or Prevented; the alert may name Microsoft Defender Antivirus as the source even though it is in passive mode. On the device, the remediation is visible in Defender's protection history and the Windows Defender Operational log (detection 1116, action 1117).

Running two products without conflict

When a third-party antivirus and Defender coexist, each must ignore the other's files, or you get false positives, deadlocks and slow scans.

1. In the third-party product, exclude Defender's binaries and data: C:\Program Files\Windows Defender\, C:\ProgramData\Microsoft\Windows Defender\, and the MDE sensor (MsSense.exe, SenseCncProxy.exe, SenseIR.exe and the C:\Program Files\Windows Defender Advanced Threat Protection\ folder). Use the vendor's own mechanism and Microsoft's published list, which is the authoritative version.
2. In Defender, add exclusions for the third-party product's install and data folders only if you see conflicts. In passive mode, Defender doesn't scan in real time, so these are mostly for the future active phase. Keep them narrow and owned, as in the exclusions audit.
3. Configure Defender fully anyway. Deploy your ASR, network protection, CFA and cloud settings now. They are ignored in passive mode and apply the moment the device becomes active, which is exactly what you want at cut-over.

Migration cut-over

A typical order when moving from another antivirus to Defender:

1. Set ForceDefenderPassiveMode on servers, then onboard devices to MDE.
2. Enable EDR in block mode tenant-wide.
3. Deploy Defender policies (AV, ASR rules in audit, network protection, exclusions).
4. Uninstall the third-party product by ring. Clients go active automatically; on servers, set ForceDefenderPassiveMode to 0 and restart.
5. Verify Normal mode, then move ASR rules to block.
6. Enable Tamper Protection as each ring goes active.

What breaks

• Two active real-time scanners on a server that was never set to passive: high CPU, file locks, failed backups. Fix with ForceDefenderPassiveMode.
• Defender stuck in passive mode after the other product is removed, because a leftover registration in Security Center or a forgotten ForceDefenderPassiveMode value. Check both.
• Defender feature removed on servers, so EDR in block mode silently can't act. Reinstall with Install-WindowsFeature Windows-Defender where supported.
• Old intelligence on passive devices. Updates still need to flow; a passive device with week-old intelligence gives poor EDR in block mode results.

Verify it

Build a fleet report, not a spot check:

$s = Get-MpComputerStatus
[pscustomobject]@{
  Computer     = $env:COMPUTERNAME
  Mode         = $s.AMRunningMode
  Platform     = $s.AMProductVersion
  SigAgeDays   = $s.AntivirusSignatureAge
  Tamper       = $s.IsTamperProtected
  ForcePassive = (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection' -ErrorAction SilentlyContinue).ForceDefenderPassiveMode
}

In the Defender portal, the Microsoft Defender Antivirus health report (under Reports > Device health) shows the antivirus mode for every onboarded device. Every device should be in exactly one expected state: Normal where Defender is primary, EDR Block Mode where another product is still primary. Passive Mode without block mode, or SxS Passive Mode on an onboarded device, is a gap to fix.

Checklist

• Running mode inventoried for every device, with expected state documented
• ForceDefenderPassiveMode set on servers running another AV; removed after cut-over
• Defender feature kept installed on onboarded servers
• EDR in block mode enabled tenant-wide
• Mutual exclusions in place between Defender and the third-party product
• Defender policies (ASR, network protection, CFA) deployed ahead of cut-over
• Legacy "Turn off Microsoft Defender Antivirus" GPOs removed
• Devices in unexpected modes reported and alerted