Help undoing these commands entered at command prompt

ysXeon · 11 Oct 2019

Hello everyone.

I was talking with PC Matic tech support who were trying to troubleshoot a problem I was having. They had me run some commands that totally crippled Windows Defender. It did not fix the problem and now they are not being helpful in assisting me to undo these things they had me do to my system.

These are the commands they had me enter:

REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f



REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f



REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f



REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f



REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v enableSmartScreen /t REG_DWORD /d 0 /f



REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v EnabledV9 /t REG_DWORD /d 0 /f



REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AppHost" /v EnableWebContentEvaluation /t REG_DWORD /d 0 /f



REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AppHost" /v PreventOverride /t REG_DWORD /d 0 /f

Now, I don't know much about these commands but just from looking at them I have to wonder if I could reverse these changes by entering the same commands again but replacing the '0's with '1's and the '1's with '0's. I don't want to mess things up further so I am seeking your assistance here.

AndreTen · 11 Oct 2019

Most of the Windows defender settings are easy configurable by commands in powershell
Start powershell by clicking on Start and type powershell, click on it to run
type

Get-MpPreference

You'll get a list like the one below. You can change any of it by typing (example for PUAprotection:

Set-MpPreference -PUAProtection enabled

Check my list and set it to fix your changes (names in reg entries are the same)
Another option is to download app named ConfigureDefender which has Defaults to restore

Help undoing these commands entered at command prompt-image.png

ysXeon · 11 Oct 2019

Thank you AndreTen that was very useful.

FreeBooter · 11 Oct 2019

Open the Command Prompt as a administrator and execute GPRESULT /H %UserProfile%\Desktop\GPReport.html command and attached the GPReport.html file located at Desktop to your next post.

AndreTen · 11 Oct 2019

ysXeon said:

Thank you AndreTen that was very useful.

You're welcome. Did you use Powershell or app?

Try3 · 11 Oct 2019

FreeBooter said:

Open the Command Prompt as a administrator and execute GPRESULT /H %UserProfile%\Desktop\GPReport.html command and attached the GPReport.html file located at Desktop to your next post.

Freebooter,

The Windows 10 version of GPResult does not have a /H switch or anything similar.

Denis

Ztruker · 11 Oct 2019

Try3 said:

Freebooter,

The Windows 10 version of GPResult does not have a /H switch or anything similar.

Denis

>GPResult /?

GPRESULT [/S system [/U username [/P [password]]]] [/SCOPE scope]
[/USER targetusername] [/R | /V | /Z] [(/X | /H) <filename> [/F]]

Description:
This command line tool displays the Resultant Set of Policy (RSoP)
information for a target user and computer.

Parameter List:
/S system Specifies the remote system to connect to.

/U [domain\]user Specifies the user context under which the
command should run.
Can not be used with /X, /H.

/P [password] Specifies the password for the given user
context. Prompts for input if omitted.
Cannot be used with /X, /H.

/SCOPE scope Specifies whether the user or the
computer settings need to be displayed.
Valid values: "USER", "COMPUTER".

/USER [domain\]user Specifies the user name for which the
RSoP data is to be displayed.

/X <filename> Saves the report in XML format at the
location and with the file name specified
by the <filename> parameter. (valid in Windows
Vista SP1 and later and Windows Server 2008 and later)

/H <filename> Saves the report in HTML format at the
location and with the file name specified by
the <filename> parameter. (valid in Windows
at least Vista SP1 and at least Windows Server 2008)

Bree · 11 Oct 2019

Interesting, you are all correct.

Windows 10 Home does not have as many options as there are in Pro. In particular /H is only available in Pro.

Help undoing these commands entered at command prompt-gpresult-home.png

Help undoing these commands entered at command prompt-gpresult-pro.png

Ztruker · 11 Oct 2019

Ah, I have Pro.

Ztruker · 11 Oct 2019

Tried to run GPRESULT /H %UserProfile%\Desktop\GPReport.html and got a file not found. Seems my Desktop got moved to OneDrive. Moved it back where it belongs and the command runs and completes as it should. Download folder got moved as well so moved that back where it belongs too.