Enable EDR in block mode
- Policy ID
- Features_PassiveRemediation
- Scope
- Computer Configuration
- Supported on
- At least Windows Server 2012, Windows 8 or Windows RT
- Source
- Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
- Category
- Windows Components › Microsoft Defender Antivirus › Features
Description
This policy setting enables or disables EDR in block mode (also known as "passive remediation"). EDR in block mode is recommended for devices running Microsoft Defender Antivirus in passive mode. Available with platform release: 4.18.2202.X
The data type is integer
Supported values:
1: Turn EDR in block mode on
0: Turn EDR in block mode off
Registry
ComputerHKEY_LOCAL_MACHINE
- PassiveRemediationREG_DWORD