Policy

Enable EDR in block mode

This policy setting enables or disables EDR in block mode (also known as "passive remediation"). EDR in block mode is recommended for devices running Microsoft Defender Antivirus in passive mode. Available with platform release: 4.18.2202.X The data type is integer Supported values: 1: Turn EDR in block mode on 0: Turn EDR in block mode off

Policy
PackMicrosoft Windows
CategoryWindows Components / Microsoft Defender Antivirus / Features
Policy IDeb841e9bd0d9
Internal nameFeatures_PassiveRemediation

Registry

Copy registry mappings

HKLM\Software\Policies\Microsoft\Windows Defender\Features\PassiveRemediation (enabled) = 1
HKLM\Software\Policies\Microsoft\Windows Defender\Features\PassiveRemediation (disabled) = 0

Policy notes

This policy setting enables or disables EDR in block mode (also known as "passive remediation"). EDR in block mode is recommended for devices running Microsoft Defender Antivirus in passive mode. Available with platform release: 4.18.2202.X The data type is integer Supported values: 1: Turn EDR in block mode on 0: Turn EDR in block mode off

Related policies

Device ControlIntel TDT Integration Level