topic Re: Defender remains running on Windows 11 in Cortex XDR Discussions

Defender remains running on Windows 11

Rocky-25 — Mon, 21 Oct 2024 08:45:49 GMT

Hi Everony

We've noticed that under Windows 11 the MS Defender Antivirus remains running in passive mode even after Cortex XDR is installed. The Cortex integration in Windows security center works, but Defender services are still running.

Does anyone experience the same behavior?

Best Regards

Re: Defender remains running on Windows 11

mavraham — Mon, 21 Oct 2024 14:41:19 GMT

Hi @Rocky-25,

Thank you for reahcing out to Live Community.

When Cortex XDR is deployed it automatically registers to MS security center and sets MS defender to passive mode.
As long as Defender is running in passive mode you should not expect any conflicts between the two.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Compatibility-Matrix/Cortex-XDR-agent-compatibility-with-third-party-security-products

Re: Defender remains running on Windows 11

Rocky-25 — Tue, 22 Oct 2024 06:25:02 GMT

Hi @mavraham

As I understood this was not the case with Windows 10. Defender was not running in passive mode, it was disabled.

With Windows 11 we experienced that it's running in passive mode.

Best Regards

Re: Defender remains running on Windows 11

Rocky-25 — Tue, 22 Oct 2024 12:01:58 GMT

Found the answer with help of TAC support. Smart App Control keeps the Defender Service in passive mode.

"In Windows 11, if SmartAppControl is enabled, Microsoft Defender Antivirus goes into passive mode."

Microsoft Defender Antivirus compatibility with other security products - Microsoft Defender for Endpoint | Microsoft Learn