Defender Antivirus (AV) Passive Mode

[amueller-tf]

Hi,

While researching how to set Defender AV to passive mode I stumbled upon two registry keys:

• ForceDefenderPassiveMode
  
  • https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivir...
  • https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivir...

  • 

• ForcePassiveMode
  • https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/switch-to-microsoft-defend...
  • https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/switch-to-microsoft-defend...

Does either of you know which one is the correct one?

Thanks,

Andre

[#2]

Good catch! Haven't been utilizing the passive mode yet, but this sure needs some clear statement from MS.
This article describes it as ForceDefenderPassiveMode: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/7929

However, i don't get my Defender to passive mode with the entry (most likely because of Tamper Protection).

[#3 · Accepted solution]

It looks like this has been resolved and all four links above now show that "ForceDefenderPassiveMode" puts Defender AV in passive mode.

[#4]

@amueller-tf This registry key does not work for us.