Defender on Windows server only detects - not prevents

Question

Hello,we noticed that on the Windows server Defender only detects things but doesn't block anything. Shouldn't it at least block something?Should we apply ASR rules to the server(all rules or some of them)?&nbsp;It is WindowsServer2019, onboarded using local script(no MDM and Group policies).Defender is primary(and only one) antivirus installed on the server.Example here:&nbsp;&nbsp;

jirilacina · Answer

Hey,from the alert timeline it looks like the server is only detecting activity, not blocking it. Could you confirm whether EDR in block mode is enabled on this host?Please run this on the server and share the output:Get-MpComputerStatus | Select AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled, EdrBlockMode, CloudProtectionEnabled&nbsp;

djolenole · Answer

Hello,&nbsp;according to Microsoft I do not need EDR in block mode to be enabled since Defender is primary and the only one antivirus.Do I need to turn EDR in block mode on if I have Microsoft Defender Antivirus running on devices?No, Microsoft recommends disabling EDR in block mode, when the primary antivirus software on the system is Microsoft Defender Antivirus. The primary purpose of EDR in block mode is to remediate post-breach detections that were missed by a non-Microsoft antivirus product.https://learn.microsoft.com/en-us/defender-endpoint/edr-block-mode-faqs#do-i-need-to-turn-edr-in-block-mode-on-if-i-have-microsoft-defender-antivirus-running-on-devices-And this is my situation:&nbsp;In Defender portal I see that cloud protection is enabled(not visible in powershell output):&nbsp;&nbsp;

jirilacina · Answer

Ah ok. Could you run this PowerShell command on the server to confirm it’s correct what we can see in console?Get-MpComputerStatus | select *enabled,*mode,*Realtime* -ea silentlyContinueI’d also start by enabling ASR Standard protection in Audit mode:https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-report#simplified-standard-protection-option

djolenole · Answer

Ok, I understand that ASR rules are highly recommended ADDITIONAL layer of protection but Defender should prevent/block some suspicious actions be default?

cssns · Answer

It may also be worth checking the 'Remediation Level' set for the Device Groups..

Settings -> Device Groups -> check if "No Automated Response" or "Semi-Approval' or 'Full-Remediation' enabled.

Also, worth testing ASR rules in Block Mode. Prefer to attempt this in pilot groups prior to all roll-out.

Forum Discussion

Defender on Windows server only detects - not prevents

7 Replies

Do I need to turn EDR in block mode on if I have Microsoft Defender Antivirus running on devices?

Resources