Skip to main content
Go to Red Canary Documentation
Red Canary Support

Running SentinelOne and Windows Defender in parallel

  • Updated .

Issue

The SentinelOne team shared a resource to enable and run Defender in parallel.

By design, SentinelOne disables Windows Defender during the SentinelOne agent installation.

Environment

Windows

Resolution

Informational: Windows Defender Disablement and AMSI Provider  
There are two possible options to have both SentinelOne and Windows Defender registered as AMSI providers:
  1. Adding the Windows Defender AMSI provider details manually to the registry
  2. Enable Windows Defender side by side with SentinelOne agent

For example, running sentinelctl config agent.wscRegistration false -k “passphrase” will bring both SentinelOne and Windows Defender AMSI providers to the registry.

More details on how to have both SentinelOne and Windows Defender running in parallel can be found here: https://help.redcanary.com/hc/en-us/articles/14140591347991-SentinelOne-User-Guide

Comments

0 comments

Please sign in to leave a comment.