Windows 11 security features

[Kamal.Kishore]

We are in the process of testing/implementing Windows 11 OS on endpoints and noticed upgraded security features that are available to toggle on. Some of these protection features are already within the cortex polices. 

If we toggled these features on would any of them interfere with the Cortex agent or its protection polices? 

Windows 11 Protection Features (Updated List):

• Memory Integrity (within Core Isolation):
  • Prevents attacks from inserting malicious code into high-security processes.
• Kernel-mode Hardware-enforced Stack Protection:
  • Prevents attacks that substitute return addresses in kernel-mode memory to launch harmful code.
• Memory Access Protection:
  • Protects your device's memory from attacks by malicious external devices.
• Local Security Authority (LSA) Protection:
  • Helps protect user credentials by preventing unsigned drivers and plugins from loading into the Local Security Authority. 1   
• Smart App Control:
  • Enhanced protection from untrusted apps.
• Reputation-based protection:
  • Protects your device from malicious or potentially unwanted apps, files, and websites.
• Exploit protection:
  • Built into Windows to help protect your device against attacks.

Thank you in advance. 

[aspatil · Accepted solution]

Hello @Kamal.Kishore ,

You can't use Windows Defender and Cortex XDR together. Its like running other AV or EDR along with XDR agent which can create conflict.

When you install Cortex XDR, it automatically disables Defender. 

On server its recommended to put defender in passive mode or disable as advised by Microsoft if using other security product:

https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.

[Kamal.Kishore]

Thank you for your reponse.

I was not sure if all these features were tied to MS Defender, but most if not all are.

Thank you.