Microsoft defender passive mode vs not running

Question

Why are some Windows 11 Pro computers "Passive Mode" and others are "Not running" for Microsoft Defender after installing a third party antivirus where I do not want to run both in parallel.

Microsoft documentation mentions if a computer is "onboarded" or depending on the original operating instalation the endpoint will be "Passive Mode" otherwise it will be disabled. What is causing some domain joined Windows 11 24H2 computers to be in "Passive Mode" while others are "Not running"?

PowerShell Administrator

Get-MpComputerStatus | select AMRunningMode

Results are: Normal, Passive Mode, Not running

Answer 1

Hi Jason,

Normal → Defender AV is fully active (real-time protection, scanning, etc.).

Passive Mode → Defender AV is installed and running in a “monitoring only” role. This happens when: The device is onboarded into Microsoft Defender for Endpoint (MDE), and a third-party AV is present (so Defender won’t do real-time protection but still provides telemetry for MDE).

Not Running → Defender AV service is disabled entirely. This happens when: No MDE onboarding, and a third-party AV is detected, so Windows disables Defender instead of switching it into passive telemetry mode.

Onboarding status:

• Devices enrolled (onboarded) into Microsoft Defender for Endpoint → Defender AV goes into Passive Mode when third-party AV is installed.
• Devices not onboarded → Defender AV goes Not Running (completely off) when third-party AV is detected.

Run in PowerShell (admin):

Get-MpComputerStatus | Select AMServiceEnabled, AMRunningMode, AntispywareEnabled, AntivirusEnabled

And to check onboarding status:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection" | Select OnboardingState

(1 = onboarded, 2 = not onboarded)

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.