I'm stuck with Windows Defender security settings even if I'm PC admin

Question

To help my IT admin, I joined a lot of my Windows machines to Azure AD where my company set its domain.

To help my IT admin, I joined a lot of my Windows machines to Azure AD where my company set its domain.

When the test finished, I removed the join with the same Windows Work and school tool and a bad surprise came out: the MS Defender settings now belonged to my company, precisely to my company administrator.

I'm speaking of Real-time protection, Cloud-delivered protection, Automatic sample submission, and Tamper protection. Plus I can't add folder exceptions to Defender scan, I can ignore reported files...

In other word a mess...

After some attempts I successfully solved the problem of Real-time protection and Cloud-delivered protection that now are again under my control.

To regain control I used Edit group policy this way:

• for Cloud-delivered protection, go to "Computer configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\MAPS" and Enable "Configure local setting override for reporting to Microsoft MAPS"
• for Real-time protection, go to "Computer configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Real-time protection" and Enable all the entries starting with "Configure local..."

Anyway now the situation is this:

I want to recover control on "Automatic sample submission" and "Tamper protection" and, possibly, I want to reset the entire authorization set for Windows Security but the Reset/Repair button available for this purpose does nothing.

Is there someone who know how it could be done beside a complete Windows installation?

My system is Windows 11 22h2 (build 22621.1848) and I am (hypothetically) the administrator of this machine.

Answer 1

I think you could use the windows 11 media upgrade, the one that for example updates you from windows 7 to windows 10 but instead it reinstalls windows 11 with all of your stuff. Just the system files get reinstalled.