> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/stoik-mdr/edr-setup-overview/do-i-need-to-uninstall-the-antivirus-before-the-edr-setup.md).

# Do I need to uninstall the antivirus before the EDR setup?

Yes, Stoïk strongly recommends uninstalling any existing antivirus or other EDR solution before installing CrowdStrike EDR, in order to prevent any conflicts that could compromise the proper functioning of the solution.

The Stoïk teams have implemented a gradual three-phase deployment to limit the risk of blockages and the impact on user workstations, with phase 1 allowing you to install the EDR while keeping your antivirus or EDR in place. It is therefore essential to uninstall your previous antivirus or EDR solution before moving on to phase 2.

{% hint style="warning" %}
If you do not uninstall it before moving on to phase 2, a "blue screen" may appear when the workstation is restarted.
{% endhint %}

However, some antivirus or EDR solutions, whether single-use or multi-use, may cause blockages as early as phase 1 of the deployment. These solutions are listed later in this document.

## Single-use antivirus

These programs have only one function: antivirus protection.

* **Bitdefender**: must be uninstalled during phase 1 of deployment. If you do not uninstall it, a blue screen may occur when you restart your computer.
* **Trend Micro**: must be uninstalled starting from deployment phase 2, otherwise error messages may appear.
* **macOS**: No known conflicts, no action required.

## Multi-purpose solutions

These software programs offer several security functions in a single tool: antivirus, firewall, USB device control, integrated EDR, etc. Common examples include **WithSecure**, **ESET**, and **Kaspersky**. In this case, simply disable the antivirus functionality only (no need to uninstall the entire software).

For **Windows Defender**, there is no need to uninstall it; it is fully compatible with the Stoïk EDR. It will remain active in phase 1, but the antivirus engine will be automatically disabled when CrowdStrike moves to phase 2.

{% hint style="info" %}
Beware of side effects on Windows:

If you completely disable the multi-purpose solution, and it previously managed your firewall, then:

* The [Windows Firewall](https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/) will automatically take over.
* However, it will apply its own default, very restrictive rules.
* This can completely block your network connections.

The solution is to reconfigure your local Windows firewall with the necessary rules and exclusions to restore the expected connections.
{% endhint %}

Example of an error message:

<figure><img src="https://25674881.fs1.hubspotusercontent-eu1.net/hubfs/25674881/signed-url-redirect%20(1).png" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.stoik.io/stoik-mdr/edr-setup-overview/do-i-need-to-uninstall-the-antivirus-before-the-edr-setup.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.