Recently moved AV for a server to another AV and needed to change the machine to Passive

Disable Tamperprotection

Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" -Name "ForceDefenderPassiveMode" -Value 1 -Type DWord

Confrim

Get-MpComputerStatus | Select AMRunningMode

You don’t need to reboot , can take a few minutes to update