The SentinelOne team shared a resource to enable and run Defender in parallel.
By design, SentinelOne disables Windows Defender during the SentinelOne agent installation.
There are two possible options to have both SentinelOne and Windows Defender registered as AMSI providers:
- Adding the Windows Defender AMSI provider details manually to the registry
- Enable Windows Defender side by side with SentinelOne agent
For example, running sentinelctl config agent.wscRegistration false -k “passphrase” will bring both SentinelOne and Windows Defender AMSI providers to the registry.