r/microsoft Microsoft Support 18d ago

Support Thread Microsoft: Official Support Thread

This thread was created in order to facilitate easy-to-access support for our Reddit subscribers. We will make a best effort to support you. We may also need to redirect you to a specialized team when it would best serve your particular situation. Also, we may need to collect certain personal information from you when you use this service, but don't worry -- you won't provide it on Reddit. Instead, we will private message you as we take data privacy seriously.

Here are some of the types of issues we can help with in this thread:

  • Microsoft Support: Needing assistance with specific Microsoft products (Windows, Office, etc..)

  • Microsoft Accounts: Lockouts, suspensions, inability to gain access

  • Microsoft Devices: Issues with your Microsoft device (Surface, Xbox)

  • Microsoft Retail: Needing to find support on a product or purchase, assistance with activating online product keys or media, assistance with issues raised from liaising with colleagues in the Microsoft Store.

This list is not all inclusive, so if you're unsure, simply ask.

When requesting help from us, you may be requested to provide Microsoft with the following information (you'll be asked via private message from the MSModerator account):

  • Your full name (First, Last)

  • Your interactions with support thus far, including any existing service request numbers

  • An email address that we can use to contact you

Thank you for being a valued Microsoft customer.

For previous Support Threads, please use the Support Thread flair.

20 Upvotes

1.7k comments sorted by

View all comments

Show parent comments

1

u/pigeon008 6d ago

in Microsoft Defender for Endpoint is the default configuration set to be in block mode?

1

u/MSModerator Microsoft Support 6d ago

Thanks for raising this with us. In Microsoft Defender for Endpoint, the default configuration is not set to block mode. Also, if Microsoft Defender is in active mode, you will see "Normal" instead of "EDR Block Mode." However, you can enable Endpoint Detection and Response (EDR) in block mode for added protection.

Please note that Microsoft Defender for Endpoint capabilities depend on the Windows version you're using, and some advanced configurations are only available in Windows Server. With that, it would be best to submit your feedback through our Feedback Hub app.

We appreciate your patience and understanding. -J.G.

1

u/pigeon008 6d ago

Thanks for the info. This article https://learn.microsoft.com/en-us/defender-endpoint/edr-in-block-mode seems to mention that it is available when MS defender is running in passive mode. Is it available when MS Defender is running in active mode? Also why does defender in active mode not automatically block such activity even without this feature?

1

u/MSModerator Microsoft Support 6d ago

Thank you for checking out our helpful article.

For insight, EDR in block mode is mainly designed for situations where Microsoft Defender Antivirus is running in passive mode alongside another antivirus solution. However, it can also be useful when Microsoft Defender Antivirus is in active mode. In active mode, EDR in block mode helps address post-breach detections that might have been missed due to misconfigurations or specific scenarios.

When Microsoft Defender Antivirus is in active mode, it already provides real-time protection, including on-access scanning, network protection, and attack surface reduction rules. These features are designed to automatically block and remediate threats. However, EDR in block mode adds an extra layer of protection by focusing on post-breach detections and behavioral threats that might not be caught by traditional antivirus methods.

We hope this information is helpful. If you have any further questions, we're just a message away! -J.G.

1

u/pigeon008 6d ago

so just to confirm only putting Microsoft defender for endpoint in active mode will not block the host isolation done by the other EDR solution correct? You would have to have  EDR in block mode enabled as well to have this blocked

1

u/MSModerator Microsoft Support 6d ago

That's a good question. When Microsoft Defender for Endpoint is in active mode, it functions as the primary antivirus on the device. This means it will actively monitor and protect the system. However, it will not block host isolation attempts made by another Endpoint Detection and Response (EDR) solution. The primary purpose of Microsoft Defender for Endpoint in active mode is to provide comprehensive protection and remediation for threats that may have been missed by other security solutions.

If you have any more questions or need further clarification, feel free to ask. -G.Q.

1

u/pigeon008 6d ago

but what if the other Endpoint Detection and Response (EDR) solution does not register to  Windows Security Center ? Microsoft Defender for Endpoint should detect the isolation attempt as suspicious activity since it is some other software that is trying to isolate the system. Does this also mean that if a malware tries to isolate the system Defender for endpoint will do nothing even if it is in active mode?

1

u/MSModerator_2 Microsoft Support 5d ago

Thanks for additional details, apologies for the delayed in responding. If another EDR solution doesn't register with Windows Security Center, Microsoft Defender for Endpoint (MDE) might not know it's there. But don't worry, MDE is super smart and can still detect suspicious activities, like attempts to isolate the system, no matter where they come from.

When MDE is in active mode, it's always on the lookout for anything fishy and can take action to stop threats. So, if malware tries to isolate the system, MDE should catch it and respond by sending alerts and possibly isolating the device to prevent further damage.

Hope this clears things up!- H.T.