Defender Exclusions stuck in Registry | RealTimeProtection status False | Non-compliant device | Intune

Question

Hello,

Found possible issues using the scenario below:

1.

1. Used Security Baseline to Enable Real-Time Protection, Cloud delivery, etc. all end-user antivirus settings are ON and greyed out

1. Used Endpoint Security -> Antivirus policy -> Set "Disable Local Admin Merge"
   (Under the Configuration settings, select the drop-down next to Disable Local Admin Merge and select Disable Local Admin Merge)
2. After the device receives a policy when running PowerShell to get Real-Time Protection status, it gives the status False:

While all settings if opening Virus Protection settings are still ON and greyed out

1. Because of this behavior, if we push a Compliance Policy were we require Real-Time Protection to be ON, devices become not compliant

Another interesting part is with Exclusions, together with "Disable Local Admin Merge" added some Exclusions, hoping that the Unassing policy would help, which is not, the Exclusions stuck in the settings and not being removed.

The question will be the usual one, why and how to fix it?

Answer 1

In my experience, the security baseline is a minimum set of settings that are recommended to be configured. When dealing with Defender and BitLocker settings I will suggest to disable these in the baseline and configure them using Endpoint Security profiles.

Answer 2

Some more findings, together with the policy were added dummy long character string values of random GUID in the Exclusions sections. With a length of 406 characters, looking like this, the data shown in the print screen below is from the Registry:

Seems this triggers the Real-Time Protection = False

So a quick summary:

Used Antivirus policy from Endpoint Security | Antivirus

Policy deployed 4 parameters:

1. Disable Local Admin Merge
2. "ExcludedExtensions"="406 long char guide value as showed in the print screen above"
3. "ExcludedPaths"="406 long char guide value as showed in the print screen above"
4. "ExcludedProcesses"="406 long char guide value as showed in the print screen above"

When this policy is deployed, if run PowerShell, the result of the command: "Get-MpComputerStatus | Select RealTimeProtectionEnabled" -> False

• Removing this policy from the user/device assignment does not remove the registry entries from:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager

Those entries still present in the container:

"ExcludedExtensions"="406 long char guide value as showed in the print screen above"

"ExcludedPaths"="406 long char guide value as showed in the print screen above"

"ExcludedProcesses"="406 long char guide value as showed in the print screen above"

• Modifying policy by keeping only Disable Local Admin Merge -> doesn't fix the issue, Exclusions are still present
• Deploying policy using Disable Local Admin Merge, but not deploying Exclusions -> don't set RealTimeProtectionEnabled=False (for some devices this policy says "not applicable", any idea why?)

And the solution, where Exclusions are stuck in the Registry, seems the old way PowerShell script via Intune:

$ScriptVersion = "DefenderRealTime_v6";

$checkExcludedExtensions = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" -Name "ExcludedExtensions" -ErrorAction SilentlyContinue

if ($checkExcludedExtensions) {

Write-Host "Defender Real-Time Protection Excluded Extensions found, removing"

Remove-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" -Name "ExcludedExtensions" -Force | Out-Null

}

$checkExcludedPaths = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" -Name "ExcludedPaths" -ErrorAction SilentlyContinue

if ($checkExcludedPaths) {

Write-Host "Defender Real-Time Protection Excluded Paths found, removing"

Remove-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" -Name "ExcludedPaths" -Force | Out-Null

}

$checkExcludedProcesses = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" -Name "ExcludedProcesses" -ErrorAction SilentlyContinue

if ($checkExcludedProcesses) {

Write-Host "Defender Real-Time Protection Excluded Processes found, removing"

Remove-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" -Name "ExcludedProcesses" -Force | Out-Null

}

exit $EXITCODE | Out-Null

Suspecting that need to stop this script after all devices receive it, but, thinking out loud, why not keep it, why users should add anything in the Exclusion when we try to disable it :)

Based on the above, the issue subject of this reported issue must change from "Disable Local Admin Merge | Non-compliant device | Defender" -> "Defender Exclusions stuck in Registry | RealTimeProtection status False | Non-compliant device ".

Found fix I guess, but new question opens "Using Intune, using MS365E3, how to disallow end-users to add Exclusions when end-user do have Administrative rights on the device?"