Not seeing how to modify PUA handling

tefohape · 12 Sep 2022

When I installed my computer, I got a prompt in Windows (Defender? Virus & Threat Protection? :shrug:) for a found PUA to select how to handle it... something like, Quarantine, Remove, Allow, etc. I selected Quarantine.

Now that I'm seeing what it's catching, some things I want to keep and I know they're not problems, so I want to see the options again to see what else I can select. However, I see nothing to click in settings to get back to that menu.

I've found some things online stating how to change it through PowerShell

or Group Policy Editor or the Registry, but a lot of the articles are not accurate, like I'm missing the Windows Defender Antivirus setting from Group Policy Editor... and I can't tell exactly how the PowerShell commands are going to work, and I've had weird bugs from editing Registry in the past.

Is anyone familiar enough with this to know if there's a Settings view showing where I can see the options to change?! I just find it so bizarre that Windows would show me the menu to select the default to begin with then make it impossible to access that menu again. I'm just not 100% clear on what kind of exact behavior the other solutions will cause, and I'm not sure if I'm reading Microsoft's instructions correctly.

Any links and interpretation of them would be helpful.

Brink · 12 Sep 2022

Hello,

You can check the tutorial below to see if it may help.

Enable or Disable Microsoft Defender PUA Protection in Windows 10

In addition, you can add exclusions if needed for Microsoft Defender below.

Add or Remove Exclusions for Microsoft Defender Antivirus in Windows 11 Tutorial | Windows 11 Forum

dalchina · 12 Sep 2022

And in another of Brink's excellent tutorials:
View Protection History of Microsoft Defender Antivirus in Windows 10

...this e.g. seems relevant..

Not seeing how to modify PUA handling-1.jpg

You mention the

Group Policy Editor

-- you haven't said if you have Home or Pro.

That's only available in Pro ( although some sites claim to offer ways to add it to Home, when some features don't work) - there's also Policy Plus (free) - kind of a group policy editor replacement with a Find feature.

Try3 · 12 Sep 2022

tefohape said:

...I got a prompt in Windows (Defender? Virus & Threat Protection? :shrug:) for a found PUA to select how to handle it... something like, Quarantine, Remove, Allow, etc. I selected Quarantine.
Now that I'm seeing what it's catching, some things I want to keep and I know they're not problems, so I want to see the options again to see what else I can select. However, I see nothing to click in settings to get back to that menu.

I agree with the others.
Select an entry in the Protection history list & you be able to click on a dropdown to see what other actions are available to you.

Not seeing how to modify PUA handling-deleting-file-quarantine.png

- Remove means delete
- Restore means move out of quarantine
- After something is restored from Quarantine, you might also see Allow which means add this to WD's Exclusions list [see post #2]

Denis