Defender remains running on Windows 11

[Rocky-25]

Hi Everony

We've noticed that under Windows 11 the MS Defender Antivirus remains running in passive mode even after Cortex XDR is installed. The Cortex integration in Windows security center works, but Defender services are still running.

Does anyone experience the same behavior?

Best Regards

[mavraham]

Hi @Rocky-25,

Thank you for reahcing out to Live Community.

When Cortex XDR is deployed it automatically registers to MS security center and sets MS defender to passive mode.
As long as Defender is running in passive mode you should not expect any conflicts between the two.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Compatibility-Matrix/Cortex-XDR-age...

[Rocky-25]

Hi @mavraham

As I understood this was not the case with Windows 10. Defender was not running in passive mode, it was disabled.

With Windows 11 we experienced that it's running in passive mode.

Best Regards

[Rocky-25 · Accepted solution]

Found the answer with help of TAC support. Smart App Control keeps the Defender Service in passive mode.

"In Windows 11, if SmartAppControl is enabled, Microsoft Defender Antivirus goes into passive mode."

Microsoft Defender Antivirus compatibility with other security products - Microsoft Defender for End...