Defender - prevent users from switching off protection

Question

Hello, seems like on some of our servers the Virus & threat protection and App & browser control were switched off. I didn't find eventid 1121 in security eventlog because it's too short unfortunately, so I have no clue if someone clicked in Windows Security and switched it off or how it happened.

I have seen it off only on w2k22 servers but I didn't check all yet.

I was asked to see if there is a way to prevent this from happening so these controls remain ON.

Seems like there is no such settings in GPO. Is there another way?

Answer 1

Yes, there is policy, if you navigate to:

Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus

And then select Turn off Microsoft Defender Antivirus and set it as Disabled and this disable the turn off option which mean it will be forced to be on and user couldn't turn it off.

Have a look at:

https://learn.microsoft.com/en-us/mem/intune/user-help/turn-on-defender-windows