Defender Policies Registry defaults please

So I just reinstalled windows via MCT due to windows security "Unknown"

It's the same after reinstalling windows.

Could someone post what they have in this registry key?


HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

I have:

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet]
"SpyNetReporting"=dword:00000000
"SubmitSamplesConsent"=dword:00000002

I'd like to compare that with another machine.

22H2 19045.4291

Windows 10 Home x64 Version 22H2 Build 19045.4291

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"PUAProtection"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine]
"MpEnablePus"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager]

And I've no reason to think that any of my entries are abnormal.


Denis

Thanks so it's not where I need to look. No Rep available currently.

Chris,

I've just checked another computer that I have always set up identically but it has only:-

Code:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager]

It is also Windows 10 Home x64 Version 22H2 Build 19045.4291

I have no idea why it is different,
Denis

Callender said:

Thanks so it's not where I need to look. No Rep available currently.

If you're still running: WiseVector StopX, that may be affecting the registry settings.

Wouldn't no keys mean that Defender is disabled?

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager]

Mine has no keys when i am using a third party av.

Ghot said:

If you're still running: WiseVector StopX, that may be affecting the registry settings.

I'm still running it but it doesn't disable defender.

Malneb said:

Wouldn't no keys mean that Defender is disabled?

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager]

Mine has no keys when i am using a third party av.

That was my thinking but comparing those keys with @Ghot's seems to suggest otherwise.

If you remove policies (preferably in safe mode), Windows will reset them to default.

Code:

reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

Callender said:

That was my thinking but comparing those keys with @Ghot's seems to suggest otherwise.

I think you meant mine.

My computers use Defender, including the second one that has no entries in those keys [post #4].


Denis

Try3 said:

I think you meant mine.

Yes that's what I meant.