Failed to retrieve Microsoft Defender status

[apeteri]

Similar past issues:

• When I lauche Eclipse I get error :"Failed to retrieve Windows Defender status" (I don't hava Defender, but another antivirus) .github#192
• "Failed to retrieve Windows Defender status." at startup of Eclipse #1758
• Failed to retrieve Microsoft Defender status: Process terminated with unexpected result: Not running #2447

On my machine (Windows 11 24H2 26100.8457) Defender for Endpoint is installed alongside a third-party AV scanner. The unrecognized AmRunningMode value is Passive Audit Mode in this case, for which I can't find any documentation on MS sites but it does appear when queried directly with the PowerShell command:

PS C:\> Get-MpComputerStatus | Select-Object AMRunningMode

AMRunningMode
-------------
Passive Audit Mode

On another note, it might easier to check properties AntivirusEnabled and/or RealTimeProtectionEnabled on the same object as these are boolean values and reflect the "on" status of Defender more accurately: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/defender/msft-mpcomputerstatus#syntax:~:text=boolean%20%20AntivirusEnabled

[merks]

What version of eclipse are you using. Which jdk version is running eclipse?

[apeteri]

Eclipse Committers 2026-03 (4.39.0 20260305-0817) and it uses the JustJ runtime it came with (21.0.11 v20260515-1531).

[apeteri]

This is the current set of recognized values in WindowsDefenderConfigurator:

eclipse.platform.ui/bundles/org.eclipse.ui.workbench/eclipseui/org/eclipse/ui/internal/WindowsDefenderConfigurator.java

Lines 324 to 331 in b7e7e0a

	return switch (onlyLine.toLowerCase(Locale.ENGLISH).strip()) {
	// Known values as listed in
	// https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows#use-powershell-to-check-the-status-of-microsoft-defender-antivirus
	// "not running" status appears to be undocumented (https://github.com/eclipse-platform/eclipse.platform.ui/issues/2447)
	case "sxs passive mode", "passive mode", "not running", "" -> false; //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$ //$NON-NLS-4$
	case "normal", "edr block mode" -> true; //$NON-NLS-1$//$NON-NLS-2$
	default -> throw new IOException("Process terminated with unexpected result:\n" + String.join("\n", lines)); //$NON-NLS-1$//$NON-NLS-2$
	};

[merks]

I know there were changes to run on Java 21 during the 4.40 cycle.

Maybe you want to contribute a PR?

[apeteri]

I had a long think about this, but it doesn't seem to be very straightforward. This setup is mandated by policy so the remediating PowerShell command still won't be able to run; I have to turn the feature off using the checkbox either way.

Second, the code treats passive mode as if Defender is not affecting performance, which is only true for some use cases. It's true that regular scans are no longer scheduled but if it is combined with other MS security products like Endpoint DLP, on-access scanning is still taking place. EDR block mode is identified correctly as a potential source of slow-to-respond installations. This is described here (Note 1): https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility#notes-about-protection-states

Edited to add: it just occurred to me that the small difference in the mode's name (passive audit vs. passive) might suggest putting it in the normal and edr block mode bucket, but I couldn't find too much information on this either.