McAfee ENS and Windows Defender conflict

[User58495780]

I had previously brought up some anomalies with my internal Endpoint Security team that appeared as if Windows Defender was interfering with McAfee ENS 10.6.1.x and newer versions. I've been working on an internal ticket which is a recurring issue for one of our customers since their system was upgraded to Windows 10 v1809 (within the last few weeks) where hyperlinks in emails were being blocked by antivirus. According to the logs McAfee was not blocking it and there were Event log entries pointing to Windows Defender being the source of the block. I did a quick check of the customer's registry at the "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\" key and found that the 'DisableAntiSpyware' DWORD value was not present unlike mine which has the value set to 1. Adding this registry value to disable the Windows Defender, which is supposed to be disabled in favor of McAfee ENS, has resolved the recurring issue that the customer has been experiencing. Does McAfee ENS generate the registry value upon installation? How does McAfee ENS disable Windows Defender and does it disable all features of Windows Defender?

[chealey]

Hi @User58495780 

This KB should clarify all scenarios: https://kc.mcafee.com/corporate/index?page=content&id=KB88214

[tshamim]

Hello,

McAfee will uninstall Defender. I would request you to follow : https://kc.mcafee.com/corporate/index?page=content&id=KB88214&_ga=2.79930449.774973739.1588568569-11...

ENS uninstalls Windows Defender per Microsoft guidelines: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windo.... You must reboot the server to fully uninstall Windows Defender. On ENS uninstall, Windows Defender is reinstalled.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[User58495780]

We have seen that McAfee ENS is the defacto virus and threat prevention product in the Windows Security settings. However, even after weeks or months of reboots, we still have some level of interaction with Windows Defender as evidenced by Windows Event logs which refer to a block from Outlook (see images below).  This occurred shortly after upgrading Windows 10 from v1709 to 1809 last month.  Does the Windows Upgrade somehow reset Windows Defender allowing it to override McAfee policies?  Our imaging team informed me that they placed the registry value to disable Windows Defender in the image but it does not appear on several of the systems that we checked after the Windows 10 v1809 Upgrade in Place (UiP).

[chealey]

Hi @User58495780 

Not that I'm aware of however this would be something you'd need to ask Microsoft. Not us 🙂

We do not actively check for running Windows Defender and terminate it once the installation has been completed.