In short
An EDR deployment works best in stages: inventory every device and check OS support, plan how the old antivirus is removed or made passive, pilot in detect-only mode, tune exclusions, switch on prevention and tamper protection, agree who receives alerts and what is automatic, roll out in waves with servers last, then measure coverage against your inventory.
Want help with EDR deployment?
We can plan it with you or do it for you. Tell us where you are up to.
Before you start
An EDR rollout touches every device you own, so it pays to agree a few things up front: who owns the project, how users will be told, how you will roll back if something breaks, and how you will know when you are finished. Most platforms we supply deploy from a cloud console with no on-premises server, using tools you already have such as Microsoft Intune, group policy, a remote monitoring and management tool or a manual installer.
If you have not chosen a platform yet, start with best EDR solutions. The steps below apply to whichever you choose; your vendor's own documentation has the product-specific detail.
EDR deployment plan: step by step
- Inventory and check coverage. List every laptop, desktop, server and virtual machine, with operating system and version, from your device management tool, directory and network scans. Check each against the vendor's supported platforms. Note anything unsupported, such as old servers, and decide how to protect or isolate it.
- Plan what happens to the existing antivirus. Two active security agents on one device can conflict. Decide whether you uninstall the old product before, during or after the new agent goes on. On Windows 10 and 11 devices not onboarded to Defender for Endpoint, Microsoft states that Defender Antivirus moves to disabled mode automatically when another antivirus product is installed; onboarded devices can run it in passive mode. On Windows Server it does not change automatically and has to be set manually.
- Choose a pilot group. Pick devices that represent your estate: IT staff, a few typical users, someone running your most awkward line-of-business software, and a non-critical server.
- Start in detect-only mode. Most platforms let you run a policy that detects and reports without blocking. Use it for the pilot so you can see what would have been blocked without disrupting anyone.
- Tune exclusions carefully. Add exclusions only for specific, verified conflicts (for example a database or backup process), scoped as narrowly as possible. Every exclusion is a place an attacker could hide, so record why each one exists.
- Switch on prevention and tamper protection. Move the pilot to the protect policy. Turn on tamper protection or an uninstall password so a user or attacker cannot simply switch the agent off.
- Agree the response policy. Decide who receives alerts and how, which actions are automatic (such as isolating a device on ransomware behaviour), which need a person, and what happens out of hours. If you are adding a vendor's managed service, agree pre-approved actions and escalation contacts with them.
- Roll out in waves. Extend to groups of devices in stages, checking the console and helpdesk after each. Laptops that are rarely in the office may need a deployment method that works over the internet.
- Do servers last, and carefully. Servers often run software that needs specific exclusions and less aggressive automatic response. Agree maintenance windows, test on a non-critical server first and involve the application owners.
- Measure coverage and keep measuring. Compare the console's device list with your inventory. Investigate devices that are missing or have stopped reporting, and add EDR to your new-device build so coverage does not drift.
EDR requirements and evaluation checklist
Use this when you write requirements, compare products or check a deployment is complete.
| Area | What to check | Why it matters |
|---|---|---|
| Platform coverage | Every Windows, macOS and Linux version you run, plus servers, virtual desktops and any mobile requirement | EDR only sees devices running the agent |
| Deployment method | Works with Microsoft Intune, group policy, your RMM tool or a manual installer; handles remote laptops | Fewer missed devices |
| Coexistence | How it handles the existing antivirus during migration | Avoids conflicts and gaps |
| Policy modes | Detect-only and protect modes; separate policies for servers and workstations | Safe pilots and appropriate server settings |
| Tamper protection | Uninstall protection and alerting if the agent stops reporting | Stops attackers switching it off |
| Detection quality | Clear, explained detections mapped to MITRE ATT&CK | Your team can act on alerts |
| Response actions | Isolation, kill process, quarantine, rollback, remote shell | Containment without a site visit |
| Telemetry retention | How long searchable history is kept, and options to extend | Investigations and insurer expectations |
| Alerting | Email, app or ticketing integration; who receives what | Alerts reach a person |
| Managed service | Whether the vendor offers MDR or threat hunting on the same agent | Out-of-hours cover |
| Integrations | SIEM, identity, firewall, email security, Microsoft 365 | A joined-up view; see XDR |
| Reporting | Coverage, protection status and incident reports | Evidence for Cyber Essentials, insurers and auditors |
Not sure which plan applies to you? Ask us
Tell us about your organisation and we will point you to the right plan.
Common pitfalls
- Leaving devices behind. Machines that are switched off, rarely online or built from an old image are the usual gaps. Check coverage after every wave.
- Over-broad exclusions. Excluding a whole folder or drive to fix one conflict creates a blind spot. Keep exclusions specific and reviewed.
- Alerts to a shared mailbox nobody reads. Name the people, and their deputies, who receive alerts.
- Staying in detect-only mode. The pilot setting is easy to forget. Schedule the switch to protect mode.
- Aggressive automatic response on servers. Isolating a critical server automatically can cause its own outage. Agree server rules with the application owners.
- Forgetting the leavers and joiners. Add the agent to your new-device process and remove licences for retired devices.
After go-live
A deployment is finished when every device is covered, alerts reach a person and the response policy is written down. After that, review alerts and exclusions regularly, test that isolation and alerting still work, and revisit the response policy when people or systems change.
It is also worth writing EDR into your endpoint security policy and incident response plan. The NCSC's incident management guidance is a good starting point for the plan. Console reports showing coverage and protection status are useful evidence for endpoint security compliance, including Cyber Essentials.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
How we help
We can help plan and run the rollout: building the inventory, choosing pilot devices, setting up detect-only and protect policies, agreeing exclusions, removing the old product, and setting up alerting and, where you choose one, the vendor's managed service. Scope and timing are agreed with you and confirmed at quote.
Contact us to plan your EDR deployment.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
How long does an EDR deployment take?
It depends on the number of devices, how well they are managed and how many awkward applications you run. A small, well-managed estate can move quickly; larger or mixed estates need a longer pilot and more waves. We agree a realistic plan with you at the start.
Should we uninstall our old antivirus before installing EDR?
Usually you remove or deactivate it as the new agent goes on, device by device, so there is no gap and no conflict. Some vendors support running alongside an existing product for a short period. We plan the order for your estate.
What is detect-only mode?
A policy setting in which the EDR detects and reports suspicious activity without blocking it. It is used in pilots so you can see what would be blocked, tune exclusions and avoid disrupting users before switching on prevention.
Do servers need different EDR settings?
Often, yes. Servers run databases and line-of-business applications that may need specific exclusions, and automatic isolation of a critical server can cause an outage. Most platforms let you apply a separate server policy.
How do we know every device is covered?
Compare the EDR console's device list with your inventory from device management, your directory and network scans, and investigate anything missing or not reporting. Repeat this regularly and add the agent to your new-device process.
Still have a question about EDR deployment?
Ask us and a member of our team will reply by email.