Onboarding Servers to Defender for Endpoint with Third-Party AV
Short answer
C Configure the ForceDefenderPassiveMode registry value to enable Microsoft Defender Antivirus passive mode, preventing conflicts with third-party antivirus while allowing EDR onboarding.
Question
50 Azure virtual machines that run Windows Server 2019
20 physical, on-premises servers that run Windows Server 2019
All the servers use a third-party antivirus solution that must remain active during a phased security rollout.
You need to onboard all the servers to Microsoft Defender for Endpoint by using a centralized deployment method. The solution must meet the following requirements:
Endpoint detection and response (EDR) capabilities must be enabled.
Antivirus conflicts must be prevented during onboarding.
What should you do on the servers?
Key Takeaways
The question tests the specific configuration needed to coexist with third-party antivirus on Windows Server, where automatic passive mode does not occur as it does on client OS versions.
This page explains how to resolve conflicts between Microsoft Defender Antivirus and third-party antivirus solutions during the onboarding of Windows Server 2019 machines to Microsoft Defender for Endpoint. It establishes that configuring passive mode is the required step to prevent conflicts while maintaining EDR capabilities.
Common mistake: Learners often select 'Disable real-time protection' or assume automatic behavior, failing to realize that Windows Server requires manual intervention via the ForceDefenderPassiveMode registry key to enter passive mode safely.
Expert Analysis
Why the Answer Is Correct
To onboard servers to Microsoft Defender for Endpoint while a third-party antivirus remains active, you must ensure Microsoft Defender Antivirus operates in Passive Mode. Unlike Windows 10/11 clients, Windows Server 2019 does not automatically switch to Passive Mode when another antivirus is installed. Therefore, you must manually configure the ForceDefenderPassiveMode registry value (or use Group Policy) to force this state. This prevents conflicts and allows the third-party solution to remain primary while enabling EDR telemetry collection.
Why the Other Options Are Wrong
Option A is incorrect because disabling the service entirely would stop EDR data collection, violating the requirement for EDR capabilities. Option B is insufficient; disabling real-time protection alone does not place the engine into the proper Passive Mode required for safe coexistence and onboarding, potentially leading to conflicts or incomplete telemetry. Option D is incorrect because enabling EDR in block mode is an operational setting for threat response, not a prerequisite for resolving installation conflicts with other AV software.
Community Comment Notes
Commenters highlighted that Windows Server behaves differently than client OS versions regarding automatic passive mode. One user noted that 'Unlike desktop operating systems, Windows Server 2019 does not automatically enter passive mode,' emphasizing the need for manual configuration. Another comment questioned whether passive mode disables EDR, but clarified that passive mode still allows for detection and response telemetry, just without active remediation by Defender.
Exam Strategy
Always distinguish between Windows Client and Windows Server behaviors in security questions. If a question involves onboarding to Defender with existing third-party AV on a server, look for 'Passive Mode' configurations rather than assuming automatic transitions.
Frequently Asked Questions
Does Passive Mode disable EDR capabilities?
Why doesn't Windows Server auto-enable Passive Mode?
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
Eltooth 👍 2 Answered CC. Configure the ForceDefenderPassiveMode registry value. To safely onboard Windows Server 2019 machines while a third-party antivirus remains active, force Microsoft Defender Antivirus into Passive Mode before onboarding to avoid critical endpoint conflicts. Unlike desktop operating systems, Windows Server 2019 does not automatically enter passive mode when a third-party antivirus is detected. https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-passive-mode#configure-passive-mode
-
Greens 👍 1 Answered COn Windows Server, unlike Windows client, Microsoft Defender Antivirus does not switch to passive mode automatically when a third-party antivirus is installed. If you onboard the servers without preparing them, Defender AV can stay in active mode and conflict with the existing product. To prevent that, set this value before onboarding: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection ForceDefenderPassiveMode (DWORD) = 1 You can push it centrally through Group Policy, Intune, or Configuration Manager, or through the Defender for Servers integration in Defender for Cloud for the Azure VMs and Arc-connected on-prem servers. In passive mode, Defender AV doesn’t perform real-time blocking, so the third-party AV keeps that job. Defender for Endpoint’s EDR still works fully, which meets both requirements.
-
dmacdonald82 👍 1Aren't you missing the reqm't of making sure EDR needing to be enabled? Passive mode would disable EDR capabilities
-
dmacdonald82 👍 1 Answered DActive EDR is a requirement, so EDR in block mode would be the config
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →