Windows Defender management pack false alerts

Question

Hello all,

I'm using the Windows Defender MP
https://systemcenter.wiki/?Get-ManagementPack=Microsoft.WindowsDefender&Version=7.1.10128.1

We often get these alerts about Defender that RTP is turned off.

However when I check it out, seems like RTP is on. The monitor doesn't work actually...
Anyone else have this problem or know how to fix?

Thank you,

Sam

Answer 1

Hi Sam (TommyZhou-9058),

this is soemthing that comes up from time to time and I think the reply from CyrAz here will give you more details:

Management Pack for Windows Defender generates false alerts
https://social.technet.microsoft.com/Forums/lync/en-US/671424d8-a8e7-4564-b7fc-02db13dc7acf/management-pack-for-windows-defender-generates-false-alerts?forum=operationsmanagermgmtpacks

Can you please check if the mntioned conditions (events and WMI data, gathered through PowerShell) are also met in your case and post a short update here?

Thanks in advance!

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)
Regards
Stoyan Chalakov

Answer 2

I think it has to do with the PowerShell script. I have to take a look at it later, when I see a false positive again.