Skip to content

Commit 9f56ec0

Browse files
committed
Update microsoft-defender-antivirus-compatibility.md
1 parent 3e87243 commit 9f56ec0

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

defender-endpoint/microsoft-defender-antivirus-compatibility.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ The following table summarizes what to expect:
6262
|Windows version|Primary antivirus/antimalware solution|Microsoft Defender Antivirus state|
6363
|---|---|---|
6464
|Windows 10 <br/>Windows 11|Microsoft Defender Antivirus|Active mode|
65-
|Windows 10 <br/>Windows 11|A non-Microsoft antivirus/antimalware solution|Disabled mode (happens automatically) <br/><br/> Note that in Windows 11, if SmartAppControl is enabled, Microsoft Defender Antivirus goes into passive mode.|
65+
|Windows 10 <br/>Windows 11|A non-Microsoft antivirus/antimalware solution|Disabled mode (happens automatically) <br/><br/> In Windows 11, if SmartAppControl is enabled, Microsoft Defender Antivirus goes into passive mode.|
6666
|Windows Server 2022 <br/>Windows Server 2019<br/>Windows Server, version 1803, or newer <br/>Windows Server 2016 <br/>Windows Server 2012 R2 |Microsoft Defender Antivirus|Active mode|
6767
|Windows Server 2022<br/>Windows Server 2019<br/>Windows Server, version 1803, or newer <br/>Windows Server 2016 |A non-Microsoft antivirus/antimalware solution|Disabled<br/>(set manually; see the note that follows this table) |
6868

@@ -80,7 +80,7 @@ If the device is onboarded to Microsoft Defender for Endpoint, you can use Micro
8080
8181
Whether Microsoft Defender Antivirus runs in active mode, passive mode, or is disabled depends on several factors, such as:
8282

83-
- Which version of Windows is installed on an endpoint
83+
- The version of Windows installed on an endpoint
8484
- Whether Microsoft Defender Antivirus is the primary antivirus/antimalware solution on the endpoint
8585
- Whether the endpoint is onboarded to Defender for Endpoint
8686

@@ -166,8 +166,8 @@ Defender for Endpoint affects whether Microsoft Defender Antivirus can run in pa
166166

167167
|Microsoft Defender Antivirus in passive mode| Real-time protection state|
168168
| -------- | -------- |
169-
|Endpoint DLP is disabled|Disabled. <br/><br/> Doesn't provide any antivirus real-time protection blocking or enforcement.|
170-
|Endpoint DLP is enabled|Enabled for DLP specific functionalities. <br/><br/> Doesn't provide any antivirus real-time protection blocking or enforcement. <br/><br/>Make sure to add Microsoft Defender Antivirus and Microsoft Defender for Endpoint binaries to the exclusion list of the non-Microsoft antivirus or EDR solution.|
169+
|Endpoint DLP is disabled|Disabled <br/><br/> Doesn't provide any antivirus real-time protection blocking or enforcement.|
170+
|Endpoint DLP is enabled|Enabled for DLP specific functionalities <br/><br/> Doesn't provide any antivirus real-time protection blocking or enforcement. <br/><br/>Make sure to add Microsoft Defender Antivirus and Microsoft Defender for Endpoint binaries to the exclusion list of the non-Microsoft antivirus or EDR solution.|
171171

172172
2. When Microsoft Defender Antivirus is in passive mode, scans aren't scheduled. If scans *are* scheduled in your configuration, the schedule is ignored. Unless:
173173

@@ -262,7 +262,7 @@ The following sections describe what to expect when Microsoft Defender Antivirus
262262

263263
In active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. Settings that are configured by using Configuration Manager, Group Policy, Microsoft Intune, or other management products apply. Files are scanned, threats are remediated, and detection information is reported in your configuration tool (such as in the Microsoft Intune admin center or the Microsoft Defender Antivirus app on the endpoint).
264264

265-
### Passive mode or EDR Block mode
265+
### Passive mode or EDR in block mode
266266

267267
In passive mode, Microsoft Defender Antivirus isn't used as the antivirus app, and threats aren't* remediated by Microsoft Defender Antivirus. However, [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md) can remediate threats. Files are scanned by EDR, and reports are provided for threat detections that are shared with the Defender for Endpoint service. You might see alerts showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode.
268268

0 commit comments

Comments
 (0)