Microsoft Defender Status Discovery

A local user may inspect Microsoft Defender Antivirus status, such as whether the antimalware service is enabled and whether Defender is active, passive, or in EDR block mode. This reports Microsoft Defender state only; it is not an inventory of third-party EDR products or a complete view of the endpoint's security controls.