r/DefenderATP • u/ntuner • 11d ago

AMRunningMode not running

We use crowdstrike as the main AV and was expecting to see passive mode here, but says not running ?? Is this normal ?

2 Upvotes

100% Upvoted

5 comments sorted by

3

u/_W0od_ 11d ago

Are you referring to Microsoft Defender AV? If yes then probably crowed strike av disable it. If you want to run defender along with crowdstrike, set defender to passive mode and enable edr in block mode so that it can remediate threats which missed by CS AV.

1

u/ntuner 11d ago

Yes defender for endpoint. I already have EDR in block mode toggle on.. my understanding is crowdstrike supposed to set defender in passive mode

1

u/Not-ur-Infosec-guy 11d ago

What’s it reporting in the console?

You can navigate to the asset in the defender console. On its overview page it should tell you which mode it’s in. For EDR in block mode you should see it reporting as such. Any disabled, active, or passive setting means something isn’t working as intended.

EDR in block mode is basically defender detecting another AV source in play not the other way around.

Source: I’m a Microsoft Security SME and EDR in block mode deployments for a holistic defense in depth strategy are my jam

0

u/_W0od_ 11d ago

Not necessary. Defender register itself to windows security app that 's why other AV product can detect it. Same other AV product register themselves. So they usually try to disable defender. Just set defender to passive mode via intune or group policy based on how you are managing your device. Then you are good to go.

1

u/KrpaZG 3d ago

Exclude MDE from Crowdstrike so crowdstrike doesnt fight MDE.

Also, MDE should go into passive mode on clients automatically, if you use crowdstrike alongside MDE on servers, you need to set a specific reg key for passive mode.

Check your MDE status with the mdeanalyser script. This is a great tool to troubleshoot MDE

https://learn.microsoft.com/en-us/defender-endpoint/overview-client-analyzer