List of exclusions export

Question

Hello,

I would like to get the list of exclusions:

Assets and Compliance > Overview > Endpoint Protection > Antimalware policies > <<Policy name>>
Right Click on the policy > Properties

I want the list of the 3 sets of exclusions for this policy, how to do this?

Thanks,
Dom

Answer 1

Hi, @Duchemin, Dominique

You are right, I did not notice that the command Get-CMAntiMalwarePolicy only works for the "Default Client malware policy".

Export-CMAntiMalwarePolicy works well for all policies. Thanks for your update. This difference may be by design.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

What is wrong with copy and pasting the results?

Answer 3

Hi, @Duchemin, Dominique

Thank you for posting in Microsoft Q&A forum.

We can use the powershell command to get the result to a txt file:

Get-CMAntiMalwarePolicy -Id "xxxxxxxx" | Out-File -FilePath C:\temp\OUTPUT.txt  

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Hello,

PS C:\Windows\system32> Get-ExecutionPolicy -List

    Scope ExecutionPolicy  
    ----- ---------------  

MachinePolicy Undefined
UserPolicy Undefined
Process Undefined
CurrentUser Bypass
LocalMachine RemoteSigned

I got an error:

PS C:\Windows\system32> Get-CMAntimalwarePolicy
Get-CMAntimalwarePolicy : This command cannot be run from the current drive. To run this command you must first connect to a Configuration
Manager drive.
At line:1 char:1

• Get-CMAntimalwarePolicy
• ~~~~~~~~~~~~~~~~~~~~~~~
• CategoryInfo : DeviceError: (Microsoft.Confi...timalwarePolicy:GetAntimalwarePolicy) [Get-CMAntimalwarePolicy], InvalidOpera
  tionException
• FullyQualifiedErrorId : CommandCannotExecuteFromCurrentDrive,Microsoft.ConfigurationManagement.PowerShell.Cmdlets.EP.GetAntimalwarePo
  licy

So I did the connection:

I checked the executionpolicy:

PS C:\Windows\system32> get-executionpolicy
AllSigned

---

PS C:\Windows\system32> Set-ExecutionPolicy RemoteSigned
Set-ExecutionPolicy : Access to the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell' is
denied. To change the execution policy for the default (LocalMachine) scope, start Windows PowerShell with the "Run as administrator"
option. To change the execution policy for the current user, run "Set-ExecutionPolicy -Scope CurrentUser".
At line:1 char:1

• Set-ExecutionPolicy RemoteSigned
• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
• CategoryInfo : PermissionDenied: (:) [Set-ExecutionPolicy], UnauthorizedAccessException
• FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetExecutionPolicyCommand

How do I get the "Run As Administrator" in the CM Console?

Thanks,
Dom

Answer 5

Hello,

I found a way to get the command working
Open PowerShell ISE > Run As Administrator (in Windows)
Copy the ISEConnect file from the console
Run it
Pass the command...

Get-CMAntiMalwarePolicy -Id "xxxxxxxx" | Out-File -FilePath C:\temp\OUTPUT.txt
but now where do I find the ID of the Malware Policy?

Thanks,
Dom