Onboarding Servers to Defender for Endpoint with Third-Party AV
You have a hybrid environment that contains the following servers: 50 Azure virtual machines that run Windows Server 2019 20 physical, on-premises servers that run Windows Server 2019 All the servers use a third-party antivirus solution that must remain active during a phased security rollout. You need to onboard all the servers to Microsoft Defender for Endpoint by using a centralized deployment method. The solution must meet the following requirements: Endpoint detection and response (EDR) capabilities must be enabled. Antivirus conflicts must be prevented during onboarding. What should you do on the servers?
Community Insight
The question tests the specific configuration needed to coexist with third-party antivirus on Windows Server, where automatic passive mode does not occur as it does on client OS versions.
This page explains how to resolve conflicts between Microsoft Defender Antivirus and third-party antivirus solutions during the onboarding of Windows Server 2019 machines to Microsoft Defender for Endpoint. It establishes that configuring passive mode is the required step to prevent conflicts while maintaining EDR capabilities.
Learners often select 'Disable real-time protection' or assume automatic behavior, failing to realize that Windows Server requires manual intervention via the ForceDefenderPassiveMode registry key to enter passive mode safely.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
To onboard servers to Microsoft Defender for Endpoint while a third-party antivirus remains active, you must ensure Microsoft Defender Antivirus operates in Passive Mode. Unlike Windows 10/11 clients, Windows Server 2019 does not automatically switch to Passive Mode when another antivirus is installed. Therefore, you must manually configure theForceDefenderPassiveMode registry value (or use Group Policy) to force this state. This prevents conflicts and allows the third-party solution to remain primary while enabling EDR telemetry collection.Why the Other Options Are Wrong
Option A is incorrect because disabling the service entirely would stop EDR data collection, violating the requirement for EDR capabilities. Option B is insufficient; disabling real-time protection alone does not place the engine into the proper Passive Mode required for safe coexistence and onboarding, potentially leading to conflicts or incomplete telemetry. Option D is incorrect because enabling EDR in block mode is an operational setting for threat response, not a prerequisite for resolving installation conflicts with other AV software.Community Comment Notes
Commenters highlighted that Windows Server behaves differently than client OS versions regarding automatic passive mode. One user noted that 'Unlike desktop operating systems, Windows Server 2019 does not automatically enter passive mode,' emphasizing the need for manual configuration. Another comment questioned whether passive mode disables EDR, but clarified that passive mode still allows for detection and response telemetry, just without active remediation by Defender.Exam Strategy
Always distinguish between Windows Client and Windows Server behaviors in security questions. If a question involves onboarding to Defender with existing third-party AV on a server, look for 'Passive Mode' configurations rather than assuming automatic transitions.
Frequently Asked Questions
Does Passive Mode disable EDR capabilities?
No. Passive Mode allows Microsoft Defender Antivirus to run without actively scanning or remediating threats, but it still collects telemetry and supports EDR functionality.
Why doesn't Windows Server auto-enable Passive Mode?
Windows Server 2019 does not automatically detect third-party AV and switch to Passive Mode like Windows 10/11 client OS versions do; manual configuration is required.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →