Uninstall disabled Windows Defender or enable it for updates?

[-]

SVD_NL@reddit

Just enable it and run it in passive mode without scans, add mutual exclusions for your AV software (so exclude defender in your primary AV, and exclude your primary AV in defender). If you don't use the defender portal or their EDR features at all, you can leave it disabled and create ignore rules for the disabled AV (but make sure the device is flagged if your third party AV is disabled)

Reply

[-]

dirmhirn@reddit (OP)

For passive mode, we need licensed defender, as far as I understood the last time I checked it. And is far as my colleagues could explain me, we have no defender license. With all the alerts recently about defender, I'd preferer to remove it instead of keeping outdated files.

Reply

[-]

SVD_NL@reddit

In that case i'd just uninstall the feature. No point in keeping it around if you don't use licensed features (and you're correct, you need a license to run in passive mode. None of the passive mode features work without a license anyways). Like i said, just make sure you've got solid detection and remediation in place for your third party AV status.

Reply

[-]

hardingd@reddit

You don’t need a license to run in passive mode. There are GPOs to disable defender if you don’t want to use it.

Reply

[-]

SVD_NL@reddit

[Microsoft Defender Antivirus compatibility with other security products - Requirements for Microsoft Defender Antivirus to run in passive mode | MS Learn](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility#requirements-for-microsoft-defender-antivirus-to-run-in-passive-mode) >Endpoints must be onboarded to Defender for Endpoint. (which you can't do without a license). The paragraph above describes some considerations specific for servers. Also: [Microsoft Defender Antivirus and non-Microsoft antivirus solutions without Defender for Endpoint | MS Learn](https://learn.microsoft.com/en-us/defender-endpoint/defender-antivirus-compatibility-without-mde) >**Q:** Can I use Microsoft Defender Antivirus in passive mode without onboarding to Microsoft Defender for Endpoint? >**A:** No. Passive mode is a functionality in Microsoft Defender for Endpoint Plan 1, Microsoft Defender for Endpoint Plan 2 and Microsoft Defender for Business. Lastly, it just doesn't make sense. The only feature that works in passive mode, but doesn't require a license, is scanning. And even scheduled scans are turned off except for some very specific circumstances.

Reply

[-]

hardingd@reddit

You can just disable Defender in GPO. If you don’t use it, why would you pay for it?

Reply

[-]

hardingd@reddit

No, defender comes with the OS. If you need the Advanced Threat Protection (that’s the old name) , that’s what you have to license.

Reply

[-]

dirmhirn@reddit (OP)

hm it's a plain Windows 2022, we didn't add any Defender installation. Just to new AV. The msmpeng.exe keeps running and consumes resources. Disabling it via GPO stopped this. But update fails/is not running.

Reply

[-]

hardingd@reddit

Defender comes with Server 2019, 2022 and 2025. If you want to use the ATP function for 2012, 2012 R2 and 2016, you have to update the built in component.

Reply

[-]

PixelSage-001@reddit

If you're running a third-party AV, it's usually best to remove the Defender features entirely on Windows Server rather than letting it sit there disabled. A disabled Defender still has its registry keys and engine binaries on disk, which vulnerability scanners will flag as outdated because the definitions aren't updating. Running `Uninstall-WindowsFeature -Name Windows-Defender` will clean it up and stop the alerts. We ran into this exact compliance headache last year. To manage the remediation, we set up a quick verification pipeline on **Runable** to audit our inventory. The runner queries our servers, checks the active AV status, and automatically runs the uninstall command on any machines where Defender is installed but inactive. It keeps the scanners happy without us having to log into every server to check.

Reply

[-]

Mayorbbee@reddit

What’s the other AV you are using? Usually defender will disable itself when it detects another AV installed. I would check the other AVs documentation for this. Vulnerability scanners should only flag on defender if the windefend service is running, it should be stopped if it detects another AV but I believe there are also some registry settings to disable it as well that you can look into.

Reply

[-]

che-che-chester@reddit

Defender only disables itself on Windows 10/11. On Server editions, you must manually switch it to passive mode or uninstall it.

Reply

[-]

hankhalfhead@reddit

How do you switch it to passive mode?

Reply

[-]

jcwrks@reddit

* regedit * `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` * Right-click and create a new **DWORD (32-bit) Value**. * Name it: `ForceDefenderPassiveMode` * Set the value data to `1` (Base: Hexadecimal) *Verify Passive Mode* To confirm that Defender is successfully running in passive mode, run this command in PowerShell: `Get-MpComputerStatus | Select-Object AMRunningMode`

Reply

[-]

hankhalfhead@reddit

Thanks!

Reply

[-]

jcwrks@reddit

Check my edit in case you notice that it's still running.

Reply

[-]

hankhalfhead@reddit

I’ve been using disable realtime monitoring

Reply

[-]

dirmhirn@reddit (OP)

This does not work on Server OS (without license). I have this regkey on a test machine and it shows AMRunningMode: Normal

Reply

[-]

jcwrks@reddit

Did you see my **Prerequisites?**

Reply

[-]

dirmhirn@reddit (OP)

ah ok, yes in licensed mode you can set it to passive. true MS 😃

Reply

[-]

dirmhirn@reddit (OP)

It's Palo Alto Cortex XDR. I know this from Windows 10/11 but should this work on Server OS too? We experienced high CPU and Memory usage by running defender in parallel. Tenable is flagging it anyway. I would preferer to not add a general Defender exception.

Reply

[-]

repairbills@reddit

This is where you’re going to find the right mix of what to disable and what to let run. Memory dumps and debug the server for what is being used in memory and then you can do the same thing with your vm host.

Reply

[-]

WhiteWidowGER@reddit

Uninstalling it can be painful, it will usually just run in passive mode as soon as you install a third party AV. Updates should still be pushed with windows updates. So a classic "it depends" as my response on your question 😃

Reply

[-]

dirmhirn@reddit (OP)

but passive mode on Servers is only available with licensed defender, as far as I understood.

Reply

[-]

JwCS8pjrh3QBWfL@reddit

You would be mistaken. It's a built in feature. You are thinking of "EDR in Block Mode," which is a feature of MDE P2. The Defender AV engine disabling itself is just built-in functionality.

Reply

[-]

dirmhirn@reddit (OP)

but only on Windows 10/11 not on Server 2016-2022. (2025 idk)

Reply

[-]

Previous-Low4715@reddit

Defender works with other antivirus solutions. Defender antivirus is just one component of defender. You can have windows defender running while sophos is the antivirus module for example

Reply

[-]

dirmhirn@reddit (OP)

We had issues with high CPU and Memory on some servers, with both AV running in parallel.

Reply

[-]

Previous-Low4715@reddit

You don’t run two AV in parallel. You run windows defender without windows defender antivirus, and the other antivirus slots in

Reply

[-]

dirmhirn@reddit (OP)

But disabling real-time protection, automatically disables tamper-protection. So somehow the whole Defender stack is running and even unprotected.

Reply

[-]

PsychoGoatSlapper@reddit

Consider setting exceptions

Reply

[-]

Vodor1@reddit

Yeah it’s good like that, I have policies where it kicks in if a device doesn’t have Sophos installed (for whatever reason)

Reply

[-]

Royal_Bird_6328@reddit

Why not Investigate why it had performance issues? Maybe some exclusions were needed, some are required if you have SQL server etc. You can still leave defender in passive mode you just need to add a reg key.

Reply

[-]

Gumbyohson@reddit

Defender performance analyser is a great PowerShell tool for figuring these out.

Reply

[-]

Burgergold@reddit

Defender can run in passive mode

Reply

[-]

Gumbyohson@reddit

As long as it's enrolled in defender for endpoint yes. This is the right idea though as long as you have the licenses for it.

Reply

[-]

che-che-chester@reddit

We had the same issue with performance. It wasn’t common, but it happened on multiple groups of servers. There is no harm with uninstalling it, as long as you know you won’t need to switch to Defender at some point. We asked our Security team, they said something like “why are you idiots running Defender when we use CrowdStrike?”, we asked if we should just leave it and switch to passive mode, Security said “no, you idiots”, we uninstalled it on hundreds of servers and then two weeks later Security said “CrowdStrike says we should be using Defender in passive mode”.

Reply

[-]

dirmhirn@reddit (OP)

haha, I tried to play it over security to, but they just ignored the topic... Passive Mode isn't for free on servers. We do not have any Defender license.

Reply

[-]

jcwrks@reddit

You can just diable RTP Set-MpPreference -DisableRealtimeMonitoring $true

Reply

[-]

techvet83@reddit

If you have other antivirus running, get rid of Defender completely.

Reply

[-]

valar12@reddit

MDAV is capable of detecting a third party solution and going into passive mode. Check that out for starters.

Reply

Reply to Post

41 Comments