Can I configure windows defender to never quarantine files

It would still allow an infection to continue and spread if malware. The whole idea of quarantine is to not allow a mass infection. It would be like allowing someone with a disease like Small Pox, Measles or Dyptheria to be around others and infect them if they are susceptible to becoming infected.

fester13579 said:

Does the MpCmdRun restore action create some type of exclusion list (white list) of its own that is not part of users exclusions in the defender GUI of which I have none? And if it does is this a temporary cache of exclusions or permanent?

The answer to the first part of you question is 'Yes'. I repeated your steps, with the same results. Then I used this command with the following result:

Code:

C:\WINDOWS\system32>"C:\Program Files\Windows Defender\MpCmdRun.exe" -checkexclusion -path C:\TEMP\eicartest.txt
C:\TEMP\eicartest.txt [\Device\HarddiskVolume2\TEMP\eicartest.txt] is excluded. Exit code is 0.

C:\WINDOWS\system32>

I'm still working on an answer to the second part of your question, starting here...

https://docs.microsoft.com/en-us/win...nder-antivirus



Edit: the exclusions are stored here, but permissions are such that you cannot modify or delete them.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths


...still working on it...


Edit2: Success

It is not just permissions that deny you access, it is also the new 'Tamper protection' feature in Defender for 1903.

Turn off 'Tamper protection' in Defender's 'Virus & threat protection' settings. Take ownership of the TemporaryPaths key and grant Administrators full access. Delete the registry value for the excluded eicar test file. Set the owner back to SYSTEM. Turn 'Tamper protection' back on.

Now a scan won't skip the file and I get this on checking exclusions:

Code:

C:\WINDOWS\system32>"C:\Program Files\Windows Defender\MpCmdRun.exe" -checkexclusion -path C:\TEMP\eicartest.txt
C:\TEMP\eicartest.txt [\Device\HarddiskVolume2\TEMP\eicartest.txt] is not excluded. Exit code is 1.

(still haven't found out if that exclusion was permanent though, from the registry key name, possibly not)

Following up on the "nugget" from post #1. This is all the things mpcmdrun can do:

Code:

"C:\Program Files\Windows Defender\mpcmdrun.exe"  -restore -listall
No quarantined items.

C:\Users\ztruk>"C:\Program Files\Windows Defender\mpcmdrun.exe" /?
Microsoft Antimalware Service Command Line Utility (c) 2006-2018 Microsoft Corp
Use this tool to automate and troubleshoot Microsoft Antimalware Service

Usage:
MpCmdRun.exe [command] [-options]

Command Description
   -? / -h                                    Displays all available options
                                              for this tool
   -Scan [-ScanType #] [-File <path> [-DisableRemediation] [-BootSectorScan]]
         [-Timeout <days>]
         [-Cancel]
                                              Scans for malicious software
   -Trace [-Grouping #] [-Level #]            Starts diagnostic tracing
   -GetFiles                                  Collects support information
   -GetFilesDiagTrack                         Same as Getfiles but outputs to
                                              temporary DiagTrack folder
   -RemoveDefinitions [-All]                  Restores the installed
                                              signature definitions
                                              to a previous backup copy or to
                                              the original default set of
                                              signatures
                      [-Engine]               Restore the installed engine to
                                              the previous version saved
                      [-DynamicSignatures]    Removes only the dynamically
                                              downloaded signatures
   -SignatureUpdate [-UNC | -MMPC]            Checks for new definition updates
   -Restore  [-ListAll | [[-Name <name>] [-All] | [-FilePath <filePath>]] [-Path <path>]]  Restore or list
                                                               quarantined item(s)
   -AddDynamicSignature [-Path]               Loads a dynamic signature
   -ListAllDynamicSignatures                  List the loaded dynamic signatures
   -RemoveDynamicSignature [-SignatureSetID]  Removes a dynamic signature
   -CheckExclusion -path <path>               Checks whether path is excluded

Additional Information:

Support information will be in the following directory:
C:\ProgramData\Microsoft\Windows Defender\Support

   -Scan [-ScanType value]
        0  Default, according to your configuration
        1  Quick scan
        2  Full system scan
        3  File and directory custom scan

           [-File <path>]
                Indicates the file or directory  to be scanned, only valid for custom scan.

           [-DisableRemediation]
                This option is valid only for custom scan.
                When specified:
                  - File exclusions are ignored.
                  - Archive files are scanned.
                  - Actions are not applied after detection.
                  - Event log entries are not written after detection.
                  - Detections from the custom scan are not displayed in the user interface.
                  - The console output will show the list of detections from the custom scan.

           [-BootSectorScan]
                Enables boot sector scanning; only valid for custom scan.

           [-Timeout <days>]
                Timeout in days; maximum value is 30.
                If this parameter is not specified, default value is 7 days for full scan and 1 day for all other scans.

           [-Cancel]
                Try to cancel any ongoing quick or full scan.

      Return code is
      0    if no malware is found or malware is successfully remediated and no additional user action is required
      2    if malware is found and not remediated or additional user action is required to complete remediation or there is error in scanning.  Please check History for more information.

   -Trace [-Grouping value] [-Level value]
        Begins tracing Microsoft Antimalware Service's actions.
        You can specify the components for which tracing is enabled and
        how much information is recorded.
        If no component is specified, all the components will be logged.
        If no level is specified, the Error, Warning and Informational levels
        will be logged. The data will be stored in the support directory
        as a file having the current timestamp in its name and bearing
        the extension BIN.

        [-Grouping]
        0x1    Service
        0x2    Malware Protection Engine
        0x4    User Interface
        0x8    Real-Time Protection
        0x10   Scheduled actions
        0x20   WMI
        0x40   NIS/GAPA
        0x80   Windows Security Center

        [-Level]
        0x1    Errors
        0x2    Warnings
        0x4    Informational messages
        0x8    Function calls
        0x10   Verbose
        0x20   Performance

   -CaptureNetworkTrace -path <path>
       Captures all the network input into the Network Protection service and
       saves it to a file at <path>. Supply an empty path to stop tracing
       Note: The specified path must be writable by LocalService
       ex: C:\Users\Public\Downloads

   -GetFiles
        Gathers the following log files and packages them together in a
        compressed file in the support directory

        - Any trace files from Microsoft Antimalware Service
        - The Windows Update history log
        - All Microsoft Antimalware Service events from the System event log
        - All relevant Microsoft Antimalware Service registry locations
        - The log file of this tool
        - The log file of the signature update helper tool

   -GetFilesDiagTrack
        Same as GetFiles, but outputs the CAB file to the temp DiagTrack
        directory

   -RemoveDefinitions
        Restores the last set of signature definitions

        [-Engine]
        Restores the last saved engine
        Use this option to restore the previous engine.

        [-All]
        Removes any installed signature and engine files. Use this
        option if you have difficulties trying to update signatures.

        [-DynamicSignatures]
        Removes all Dynamic Signatures.

   -SignatureUpdate
        Checks for new definition updates

        [-UNC [-Path <path>]]
        Performs update directly from UNC file share specified in <path>
        If -Path is not specified, update will be performed directly from the
             preconfigured UNC location

        [-MMPC]
        Performs update directly from Microsoft Malware Protection Center

   -Restore
        [-ListAll]
        List all items that were quarantined

        [-Name <name>]
        Restores the most recently quarantined item based on threat name
        One Threat can map to more than one file

        [-All]
        Restores all the quarantined items based on name

        [-FilePath <filePath>]
        Restores quarantined item based on file path

        [-Path]
        Specify the path where the quarantined items will be restored.
        If not specified, the item will be restored to the original path.
   -AddDynamicSignature -Path <path>
        Adds a Dynamic Signature specified by <path>

   -ListAllDynamicSignatures
        Lists SignatureSet ID's of all Dynamic Signatures added to the client
        via MAPS and MPCMDRUN -AddDynamicSignature

   -RemoveDynamicSignature -SignatureSetID <SignatureSetID>
        Removes a Dynamic Signature specified by <SignatureSetID>

   -CheckExclusion -path <path>
        Checks whether <path> is excluded. It can be either a path, or a file.