Windows Defender DisableScriptScanning

Question

Hi there

We currently have Defender controlled by ConfigMgr 2006. Running Get-MpPreference on a Win 10 client shows DisableScriptScanning set to True.

I then try Set-MpPreference -DisableScriptScanning $false but while the command completes without any feedback this seems to have no effect. I cannot see anywhere in the Antimalware Policies in ConfigMgr to control this nor in client settings.

There also seem to be controls for this in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Real-Time Protection but setting the keys DisableScriptScanning on its own or with LocalSettingOverrideDisableScriptScanning doesn't seem to help.

It looks like it used to be a thing in the EndPoint protection policies GUI of ConfigMgr 2012 so I'm not sure why it was removed.

Has anyone managed to change this setting?

Answer 1

Hi,
This policy setting allows you to configure script scanning.
You may change this setting via GPO:
https://getadmx.com/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablescriptscanning
Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

Hope above information can help you.

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi there,

Sorry for the delay, real life got in the way.

Before running anything I've run a gpresult and it shows these settings are configured by Local Group Policy. Does this mean it was set to 'Off' when we have SCCM 2012 and now it is not an option available in the GUI of ConfigMgr CB?

I've had a look in Group Policy and we don't have System Center Endpoint Protection available under computer configuration. I see Forefront Endpoint Protection 2010 and also Windows Defender Anti virus but neither of these have a ScriptScanning option. Are there admx templates I need to import as I can see some are available but not for Windows 10 https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-protection-group-policies

I'll try setting the registry key with a GPO and report how that goes.

Answer 3

Hi there,

I've set the registry key in a GPO, restarted and as per the screenshot it shows it is set to 0. But if I run Get-MpPreference it still thinks it is set to true (see at the bottom of the screen shot) and if I run gpresult it is still set to 1 as per my previous update screenshot.