# Elastic Defend Windows Defender question **URL:** \ **Category:** Endpoint Security\ **Created:** [November 2, 2025, 7:23am UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157 "2025-11-02T07:23:34Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![YousefNein](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yousefnein/32/145549_2.png) [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Post date:** [November 2, 2025, 7:23am UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157/1 "2025-11-02T07:23:34Z")
From the attached pic, I don’t understand this warning restriction. I also need some clarification with: > Enable to register Elastic as an official Antivirus solution for Windows OS. This will also **disable Windows Defender**. By disabling Windows Defender, does that mean WD won’t be able to prevent its usual attacks that Elastic Defend won’t prevent against due to license limitations? Thank you. ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d5b908688c2d91f12bc88a6ac615f8f475f381f7.png) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 2, 2025, 12:40pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157/2 "2025-11-02T12:40:52Z")
> [@YousefNein](#): > > By disabling Windows Defender, does that mean WD won’t be able to prevent its usual attacks that Elastic Defend won’t prevent against due to license limitations? If you disable Windows Defender, then it will not run, any dection will be made by Elastic Defend. ---
**Author:** ![YousefNein](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yousefnein/32/145549_2.png) [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Post date:** [November 2, 2025, 1:39pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157/3 "2025-11-02T13:39:49Z")
That is excluding the perventions, correct? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 2, 2025, 1:57pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157/4 "2025-11-02T13:57:05Z")
> [@YousefNein](#): > > That is excluding the perventions, correct? Not sure if I understand, if you disable Windows Defender and use Elastic Defend, only Elastic Defend will detect and prevent anything, what will be prevented will depends on your license level, some preventions require a platinum or enterprise license. By disabling Windows Defender it will not run, so it cannot detect nor prevent anything, you will need to rely on Elastic Defend. ---
**Author:** ![YousefNein](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yousefnein/32/145549_2.png) [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Post date:** [November 3, 2025, 11:03am UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157/5 "2025-11-03T11:03:58Z")
I understand. So if I don’t have the platinum license, it won’t be able to prevent a ransomware attack. But also it disabled Windows Defender that could have prevented it. Isn’t that right? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 3, 2025, 12:31pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157/6 "2025-11-03T12:31:03Z")
> [@YousefNein](#): > > I understand. So if I don’t have the platinum license, it won’t be able to prevent a ransomware attack. But also it disabled Windows Defender that could have prevented it. Isn’t that right? Yes, this is what I said on the previous posts. ---
**Author:** ![YousefNein](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yousefnein/32/145549_2.png) [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Post date:** [November 3, 2025, 12:45pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157/7 "2025-11-03T12:45:50Z")
Are there any benefits of having Elastic Defend as the official antivirus if I don’t have a Plat license? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 3, 2025, 12:54pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157/8 "2025-11-03T12:54:44Z")
It really depends on your use case. For some people it may make sense to use Elasticv Defend, for others not. ---
**Author:** ![NickFritts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickfritts/32/47189_2.png) [@NickFritts](https://discuss.elastic.co/u/NickFritts)\ **Post date:** [November 3, 2025, 1:32pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157/9 "2025-11-03T13:32:54Z")
It gets complicated. When you check that box, Endpoint registers as an “official” antivirus with Windows. Elastic doesn’t touch or change anything about Defender. However, Defender monitors the antivirus registrations on the system and if there is a non-Microsoft product registered, then Defender does less than it normally would to avoid conflicts. At the following link Microsoft is partially talking about this in the context of their EDR product, but the parts where they talk specifically about `Microsoft Defender Antivirus` should still be accurate. `Microsoft Defender for Endpoint` is essentially their version of Elastic Defend. > **[Microsoft Defender Antivirus compatibility with other security products -...](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility#passive-mode-or-edr-in-block-mode)** > > Learn about Microsoft Defender Antivirus with other security products and the operating systems. What “passive mode” in this context means depends on the version and license of Windows that you’re running. Sometimes this means it does absolutely nothing. Sometimes it means that it does almost nothing but still scans the file system for malware occasionally. But overall, if you do not check that box and are running Defender, it means that for every action on the system, Defender and Elastic Endpoint are going to analyze it and this has a risk of conflicts and other performance problems if both products are not configured to ignore the activity of the other. If you check the box, only one of them will analyze it. ---
**Author:** ![YousefNein](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yousefnein/32/145549_2.png) [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Post date:** [November 3, 2025, 1:44pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157/10 "2025-11-03T13:44:45Z")
Thank you for the clarification. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 1, 2025, 1:45pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157/11 "2025-12-01T13:45:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.