why is HideExclusionsFromLocalUsers : True

Question

Hi , I used the powershell command to check the defender status but I realized that

''HideExclusionsFromLocalUsers'' is turned on , Is it ok? and could you please check these information? Thank you.

PS C:\WINDOWS\system32> Get-Mppreference

AllowDatagramProcessingOnWinServer : False

AllowNetworkProtectionDownLevel : False

AllowNetworkProtectionOnWinServer : False

AllowSwitchToAsyncInspection : False

ApplyDisableNetworkScanningToIOAV : False

AttackSurfaceReductionOnlyExclusions :

AttackSurfaceReductionRules_Actions : {1, 1, 1, 1...}

AttackSurfaceReductionRules_Ids : {01443614-CD74-433A-B99E-2ECDC07BFC25, 26190899-1602-49E8-8B27-EB1D0A1CE869, 3B576869-A4EC-4529-8536-B80A7769E899,

                                                    5BEB7EFE-FD9A-4556-801D-275E5FFC04CC...} 

AttackSurfaceReductionRules_RuleSpecificExclusions :

AttackSurfaceReductionRules_RuleSpecificExclusions_Id :

BruteForceProtectionAggressiveness : 0

BruteForceProtectionConfiguredState : 0

BruteForceProtectionExclusions :

BruteForceProtectionLocalNetworkBlocking : False

BruteForceProtectionMaxBlockTime : 0

BruteForceProtectionSkipLearningPeriod : False

CheckForSignaturesBeforeRunningScan : False

CloudBlockLevel : 0

CloudExtendedTimeout : 0

ComputerID : EE9E2A24-2807-346F-6183-9B9A8EE91747

ControlledFolderAccessAllowedApplications : {C:\Windows\System32\SrTasks.exe, C:\Windows\System32\svchost.exe, C:\Windows\System32\WinSAT.exe}

ControlledFolderAccessProtectedFolders : {C:\Users\ASUS\Downloads\microsoft.microsoftskydrive_8wekyb3d8bbwe!App, C:\Users\ASUS\Downloads\Telegram Desktop, D:, E:\jalasat_moradi...}

DefinitionUpdatesChannel : 0

DisableArchiveScanning : False

DisableAutoExclusions : False

DisableBehaviorMonitoring : False

DisableBlockAtFirstSeen : False

DisableCacheMaintenance : False

DisableCatchupFullScan : True

DisableCatchupQuickScan : True

DisableCoreServiceECSIntegration : False

DisableCoreServiceTelemetry : False

DisableCpuThrottleOnIdleScans : True

DisableDatagramProcessing : False

DisableDnsOverTcpParsing : False

DisableDnsParsing : False

DisableEmailScanning : False

DisableFtpParsing : False

DisableGradualRelease : False

DisableHttpParsing : False

DisableInboundConnectionFiltering : False

DisableIOAVProtection : False

DisableNetworkProtectionPerfTelemetry : False

DisablePrivacyMode : False

DisableQuicParsing : False

DisableRdpParsing : False

DisableRealtimeMonitoring : False

DisableRemovableDriveScanning : False

DisableRestorePoint : True

DisableScanningMappedNetworkDrivesForFullScan : True

DisableScanningNetworkFiles : False

DisableScriptScanning : False

DisableSmtpParsing : False

DisableSshParsing : False

DisableTamperProtection : False

DisableTlsParsing : False

EnableControlledFolderAccess : 1

EnableConvertWarnToBlock : False

EnableDnsSinkhole : True

EnableEcsConfiguration : False

EnableFileHashComputation : False

EnableFullScanOnBatteryPower : False

EnableLowCpuPriority : False

EnableNetworkProtection : 1

EnableUdpReceiveOffload : False

EnableUdpSegmentationOffload : False

EngineUpdatesChannel : 0

ExclusionExtension :

ExclusionIpAddress :

ExclusionPath :

ExclusionProcess :

ForceUseProxyOnly : False

HideExclusionsFromLocalUsers : True

HighThreatDefaultAction : 0

IntelTDTEnabled :

LowThreatDefaultAction : 0

MAPSReporting : 2

MeteredConnectionUpdates : False

ModerateThreatDefaultAction : 0

NetworkProtectionReputationMode : 0

OobeEnableRtpAndSigUpdate : False

PerformanceModeStatus : 1

PlatformUpdatesChannel : 0

ProxyBypass :

ProxyPacUrl :

ProxyServer :

PUAProtection : 1

QuarantinePurgeItemsAfterDelay : 90

QuickScanIncludeExclusions : 0

RandomizeScheduleTaskTimes : True

RealTimeScanDirection : 0

RemediationScheduleDay : 0

RemediationScheduleTime : 02:00:00

RemoteEncryptionProtectionAggressiveness : 0

RemoteEncryptionProtectionConfiguredState : 0

RemoteEncryptionProtectionExclusions :

RemoteEncryptionProtectionMaxBlockTime : 0

RemoveScanningThreadPoolCap : False

ReportDynamicSignatureDroppedEvent : False

ReportingAdditionalActionTimeOut : 10080

ReportingCriticalFailureTimeOut : 10080

ReportingNonCriticalTimeOut : 1440

ScanAvgCPULoadFactor : 50

ScanOnlyIfIdleEnabled : True

ScanParameters : 1

ScanPurgeItemsAfterDelay : 15

ScanScheduleDay : 0

ScanScheduleOffset : 120

ScanScheduleQuickScanTime : 00:00:00

ScanScheduleTime : 02:00:00

SchedulerRandomizationTime : 4

ServiceHealthReportInterval : 60

SevereThreatDefaultAction : 0

SharedSignaturesPath :

SharedSignaturesPathUpdateAtScheduledTimeOnly : False

SignatureAuGracePeriod : 0

SignatureBlobFileSharesSources :

SignatureBlobUpdateInterval : 60

SignatureDefinitionUpdateFileSharesSources :

SignatureDisableUpdateOnStartupWithoutEngine : False

SignatureFallbackOrder : MicrosoftUpdateServer|MMPC

SignatureFirstAuGracePeriod : 120

SignatureScheduleDay : 8

SignatureScheduleTime : 01:45:00

SignatureUpdateCatchupInterval : 1

SignatureUpdateInterval : 0

SubmitSamplesConsent : 1

ThreatIDDefaultAction_Actions :

ThreatIDDefaultAction_Ids :

ThrottleForScheduledScanOnly : True

TrustLabelProtectionStatus : 0

UILockdown : False

UnknownThreatDefaultAction : 0

PSComputerName :

Answer 1

All of your settings are fine. The default setting for HideExclusionsFromLocalUsers is true. All it means is that someone with a non-admin local user account won't be able to see what exclusions are set in the Windows Security app or via Powershell.

Answer 2

No problem, happy to help. :)

Answer 3

Thank you very much.