Forum Discussion
Defender for Endpoint "EDR in Block Mode" useful when using Windows Defender as primary AV
Hi, we're currently looking for pros / cons for enabling the "EDR in Block Mode" Feature. All of our clients are using only the Windows Defender as the primary Antivirus solution. We already foun...
I already understood this and i understood the benefits in this case.
But: As i mentioned: The only thing i want to know in addition: Are there any benefits as long as Defender IS the primary AV and Realtime protection IS on (Assumed no one switches it off)
(Yes i will enable EDR in Block mode anyway, because in real-world it could happen that AV gets disabled, but just assumed ...)
From my experience and from what I know about the MS documentation about MDE, there is no benefit to turn the block mode on in your scenario. The 'little' or 'minimal' benefit is not explained anywhere but one could assume it's more about the potential rather than actual benefits.