Intercept X not being recognized as primary AV - Win Defender not in passive mode.

Question

In Server 2022, it looks like Windows Defender is not recognising that Sophos Endpoint is installed. 
 AMRunningMode should be reporting SxS Passive Mode 
 I've checked this on multiple servers and all report the same. 
 Sophos is fully up-to-date, all Windows patches have been run in, and a reboot of the server performed.

learn.microsoft.com/.../microsoft-defender-antivirus-windows

Stuart James · Accepted Answer

Further to this, uninstalling Defender is not possible as SQL Server pretty much grinds to a halt without Defender installed for some bizarre reason that's not obvious to me. 
 Not sure why Defender doesn't acknowledge the existence of Sophos - perhaps Sophos doesn't comply with Microsoft standards. I've installed another couple of AV products and they are all recongised just fine.

Intercept X not being recognized as primary AV - Win Defender not in passive mode.

Top Replies