Forum Discussion
EDR in block mode on Server 2016?
EDR block mode is listed as supported on Windows Server 2016 and later. This appears a bit strange since 2016 is onboarded in MDE/ATP with MMA agent so how does the EDR block mode policy apply on 2016? For 2019 it is different as the Sense agent is onboarded directly. Additionally, it appears to be no way to control which systems get EDR block mode, there is no way to exclude servers and apply to desktops only, or subset of pilot systems.
Tsachev EDR is associated with Microsoft Defender Antivirus. Microsoft Defender Antivirus uses the latest device learning models, behavioral detections, and heuristics to detect and remediate malicious items.
Now, since Windows Server 2016 already comes with built-in Microsoft Defender Antivirus, this feature is applicable to Server 2016 as well.
As of now, there is no way to push EDR in block mode to only specific devices as it is just a radio button which needs to be turned on from Microsoft Defender Security Center.
- If the functionality depends on Defender AV how is agent receiving the policy from Defender Security Center on 2016 OS?
