Skip to content

Commit

Permalink
Fix disabling/enabling Defender on Windows #104
Browse files Browse the repository at this point in the history
Change behavior of registry reverting from adding default value to
removing value that overrides. It then leaves the system in cleaner
state, removes "managed by your organization" warning, and makes the
scripts more future-proof providing compatibility with Microsoft patches
updating the defaults. This is implemented by using `reg delete` over
`reg add` and `Remove-MpPreference` over `Set-MpPreference`.

> Disable Windows Defender Scheduled Scan task
Surpress the error when reverting the script as the task may not exist
in some Windows versions.

> Limit catch-up security intelligence (signature) updates
Change to "Disable" instead of "Limit", and bring back its revert code.

Fix reverting of following scripts setting non-default values:
  > Turn off Windows Defender SpyNet reporting
  > Disable checking for signatures before scan
  > Limit CPU usage during idle scans to minumum
  > Disable scanning when not idle
  > Disable scanning on mapped network drives on full-scan

Fix following scripts setting unexpected behavior:
  > Disable running scheduled auto-remediation
  > Limit CPU usage during idle scans to minumum
  > Disable randomizing scheduled task times
  > Disable creating system restore point on a daily basis

Add more documentation for MpPreference module:
  - Add more reference URLs
  - Add status query as documentation
  - Add information regarding default values
  - Describe meaning of enumeration values
  - Document commands not doing expected in Windows 11
  • Loading branch information
undergroundwires committed Nov 11, 2021
1 parent 2f90cac commit 56745f1
Showing 1 changed file with 361 additions and 149 deletions.
Loading

0 comments on commit 56745f1

Please sign in to comment.