Windows Defender Still Running with 'Use Windows Security Center' enabled in Policy for Windows Servers

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Windows Defender continues to operate when Carbon Black sensor is active and running.

Environment

• Carbon Black Cloud Console: All Versions
• Endpoint Standard Sensor: All Versions
• Microsoft Windows Defender
• Microsoft Server Operating Systems: 2016 and above

Cause

In Windows Server 2016 and other Windows server operating systems enabling "Windows Security Center" will not disable Windows Defender. 

Resolution

In Windows Server 2016 and other server Operating systems enabling "Windows Security Center" will not disable Windows Defender. Instead, it must be disabled manually if needed.
 

1) Disable it through Powershell:

1. Open PowerShell as Administrator.
2. Type the following command:

Set-MpPreference -DisableRealtimeMonitoring $true

2) To Uninstall Windows Defender:

1. Open PowerShell as Administrator.
2. Type the following command and press Type the following command and press Enter:

Uninstall-WindowsFeature -Name Windows-Defender

 

Additional Information

• Windows Security Center is not installed into Windows Server Operating Systems by default.
• Carbon Black Sensor can operate along with Defender in parallel.
• Add Permissions rules or Exclusions for both Defender and Endpoint Standard so they are not scanning one another to improve performance.