This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(172.8, 84%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
OS: Windows 10 Pro
Using the Set-MpPreference command cannot effectively set the action when Windows Defender detects threats. I don’t know if I need to use any special way to have the setting permitted
https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2019-ps
Has Tamper Protection been enabled?
no. tamper protection has been turned off.
Can you provide any additional context like a command sample or error?
just like "Set-MpPreference -Unknown/Low/Moderate/High/SevereThreatDefaultAction 9".
but when I command this, windows defender still automatically delete the virus sample. it seems that command is not effective
Could it be that the command you are using is incorrect? Would it net be something like this? You can also manage these settings using MEM, GPO or local policy. It can be a way to verify the configuration.
Set-MpPreference -ThreatIDDefaultAction_Actions 9
if convenient, could you tell me how to do in detail?
I tried "-ThreatIDDefaultAction_Ids". it turned out to be an error
so what should I do now?
You can use Get-MpPreference to verify. Once again, I don't think you are using ThreatIDDefaultAction_Ids correctly. Though it appears you are trying to disable response actions?
ThreatIDDefaultAction_Ids: Specifies an array of the actions to take for the IDs specified by using the ThreatIDDefaultAction_Ids parameter.
See this article for reference. https://4sysops.com/archives/configuring-defender-antivirus-exclusions-real-time-protection-scans-and-remediations/