Windows 10: Defender for Endpoint stuck in EDR Block/Passive Mode and will not switch to Active Mode

I've searched and asked Microsoft directly about this.I've been onboarding devices to Defender for Endpoint. So far I have 13 devices in Active Mode and 36 in EDR Block Passive Mode.I tried switching the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\ForceDefenderPassiveMode dword to "0".I tried uninstalling the current 3rd party antivirus softwareI contacted Microsoft directly and they tell me I need to uninstall my 3rd party software. I did that but those devices ended up being unprotected still, even after multiple restarts and confirmation of full unins

:)

 

Defender in Passive Mode?

I installed Avast (free version) on my new pc because I have had good success with Avast on my Mac for years.

I have repeatedly read that if third-party AV software is installed, Defender will automatically be disabled. This does not appear to be the case because in the System Tray I have the Defender Icon showing with a green checkmark. If I click the Defender icon the Defender Security Center opens and I get green checkmarks across the board.

I googled and found information about Defender's "Passive Mode," but I don't know if that's what's going on:

Windows Defender Antivirus compatibility with other security products | Microsoft Docs

I also found information about Defender not turning off even when third-party AV software is installed.:

http://www.thewindowsclub.com/window...l-not-turn-off

I would like to know if Defender is in Passive Mode, which I suppose is okay, or if it is running, and if so, what to do about it.

 

How can I permanently disable windows defender FOREVER(not temporarily)???

You CAN'T

From 1809, windows defender cannot be disabled unless you're install a 3rd party sulution that Depends Defender, (Any EDR depened on defender) . In that case Defender will forward all the events to the 3rd Party, and will be passive, unless you have Defender for Endpoint in parallel with EDR Block mode turned on.

That promise in any case your other sulution is down, you have at least the free edition of dzfender to protect the OS.

Like describe before, you still have the option to temporarily disable it for troubleshoot.

 

Forcing Microsoft defender Antivirus (MDAV) activation

Hello everyone,



I am currently investigating how to force the activation of Microsoft Defender Antivirus (MDAV) even when installing another third-party antivirus.



For me, MDAV is the primary antivirus in my work environment. When I execute the "get-mpcomputerstatus" command, it shows that MDAV is in normal mode. However, as soon as I install another antivirus, it automatically switches to EDR block mode.



I want to know how I can always keep MDAV in normal mode, meaning the main antivirus, even if I install another antivirus. I have already deployed Microsoft Defender for Endpoint (MDE) – both Endpoint Protection (EPP) and Endpoint Detection and Response (EDR) – and the Group Policy setting "Turn off Defender Antivirus" is set to "disabled."



I don't want to uninstall the other antivirus; I want to ensure that even if another antivirus is installed, MDAV remains the primary antivirus.