09-15-2020 03:09 PM
@DKasabji, No it cannot be disabled any longer unless you have an Intune subscription per MS documentation (link below). Our GPO has had Windows Defender turned off for many years now going back to before we added Cortex XDR Prevent to our environment. (The prior solution did not disable automatically so we have always used the GPO setting.) The GPO setting is active and Defender has never been observed doing anything on our systems to my knowledge. But for some reason some systems, all running Win10 v1903, some systems have the Windows Defender Antivirus Service running and others do not. I am going to guess that this was an issue before Cortex XDR Prevent and it was just not noticed. We have an application misbehaving and the vendor claims Windows Defender is the cause so as part of my info gathering I noticed the service running on the system.
