Policy

Enable EDR in block mode

This policy setting enables or disables EDR in block mode (also known as "passive remediation"). EDR in block mode is recommended for devices running Microsoft Defender Antivirus in passive mode. Available with platform release: 4.18.2202.X The data type is integer Supported values: 1: Turn EDR in block mode on 0: Turn EDR in block mode off

Policy
Pack Microsoft Windows
Category Windows Components / Microsoft Defender Antivirus / Features
Policy ID eb841e9bd0d9
Internal name Features_PassiveRemediation

Registry

Copy registry mappings

HKLM\Software\Policies\Microsoft\Windows Defender\Features\PassiveRemediation (enabled) = 1
HKLM\Software\Policies\Microsoft\Windows Defender\Features\PassiveRemediation (disabled) = 0

Policy notes

This policy setting enables or disables EDR in block mode (also known as "passive remediation"). EDR in block mode is recommended for devices running Microsoft Defender Antivirus in passive mode. Available with platform release: 4.18.2202.X The data type is integer Supported values: 1: Turn EDR in block mode on 0: Turn EDR in block mode off

Related policies

Device ControlIntel TDT Integration Level