Windows registry artifactWindows Defender

Windows Defender DisableBlockAtFirstSeen Status, 0 = Enabled (BlockAtFirstSeen On), 1 = Disabled

Windows Defender SpynetReporting Status - Specifies the type of membership in Microsoft Active Protection Service (MAPS), 0 = Disabled (MAPS Off), 1 = Basic Membership, 2 = Advanced Membership

Windows Defender SubmitSamplesConsent Status, 0 = Always prompt, 1 = Send safe samples automatically, 2 = Never send, 3 = Send all samples automatically

Windows Defender SpynetReporting Status - Specifies the type of membership in Microsoft Active Protection Service (MAPS), 0 = Disabled (MAPS Off), 1 = Basic Membership, 2 = Advanced Membership

Windows Defender SubmitSamplesConsent Status, 0 = Always prompt, 1 = Send safe samples automatically, 2 = Never send, 3 = Send all samples automatically

Windows Defender Real-Time Monitoring Status, 0 = Enabled (Real-Time Monitoring On), 1 = Disabled

Windows Defender Real-Time Protection DPA Status, 0 = Enabled (DPA On), 1 = Disabled

Windows Defender Real-Time Protection Behavior Monitoring Status, 0 = Enabled (Behavior Monitoring On), 1 = Disabled

Windows Defender Real-Time Protection Scan all downloaded files and attachments Status, 0 = Enabled (IOAVProtection On), 1 = Disabled

Windows Defender Real-Time Protection Scanning of Scripts during Malware Scans Status, 0 = Enabled (ScriptScanning On), 1 = Disabled

Windows Defender Tamper Protection Status, 4 = Disabled (TamperProtection Off), 5 = Enabled

Windows Defender Privacy Mode Status - Restricts displaying threat history to Administrators only, 0 = Enabled (PrivacyMode On), 1 = Disabled

Windows Defender UI Lockdown Status, 0 = Disabled (UILockdown Off), 1 = Enabled

Windows Defender Update On Startup Without Engine Status - Indicates whether to initiate definition updates even if no antimalware engine is present, 0 = Enabled (Updates On), 1 = Disabled

Windows Defender Archive Scanning Status, 0 = Enabled (Archive Scanning On), 1 = Disabled

Windows Defender Removable Drive Scanning Status, 0 = Enabled (Removable Drive Scanning On), 1 = Disabled

Windows Defender Schedule Day - Specifies the day of the week on which to perform a scheduled scan, 0 = Everyday, 1 = Sunday, 2 = Monday, 3 = Tuesday, 4 = Wednesday, 5 = Thursday, 6 = Friday, 7 = Saturday, 8 = Never

Windows Defender Low Threat Default Action Scanning Status, 1 = Clean, 2 = Quarantine, 3 = Remove, 6 = Allow, 8 = UserDefined, 9 = NoAction, 10 = Block

Windows Defender Moderate Threat Default Action Scanning Status, 1 = Clean, 2 = Quarantine, 3 = Remove, 6 = Allow, 8 = UserDefined, 9 = NoAction, 10 = Block

Windows Defender High Threat Default Action Scanning Status, 1 = Clean, 2 = Quarantine, 3 = Remove, 6 = Allow, 8 = UserDefined, 9 = NoAction, 10 = Block

Windows Defender Severe Threat Default Action Scanning Status, 1 = Clean, 2 = Quarantine, 3 = Remove, 6 = Allow, 8 = UserDefined, 9 = NoAction, 10 = Block

Microsoft Defender Controlled Folder Access Protection Status, 0 = Disabled (ControlledFolderAccess Off), 1 = Enabled, 2 = Audit Mode (Detect and Log Only)

Microsoft Defender Controlled Folder Access Allowed Applications

Microsoft Defender Controlled Folder Access Protected Folders

Windows Defender Real-Time Protection Status, 0 = Enabled, 1 = Disabled

Windows Defender Real-Time Protection Status, 0 = Enabled, 1 = Disabled

Microsoft Defender Potentially Unwanted App (PUA) App Blocking Protection Status, 0 = Disabled, 1 = Enabled, 2 = Audit Mode (Detect and Log Only)

Microsoft Defender Potentially Unwanted App (PUA) App Blocking Protection Status, 0 = Disabled, 1 = Enabled, 2 = Audit Mode (Detect and Log Only)

Microsoft Defender will automatically take action on all detected threats Status, 0 = Enabled (RoutinelyTakingAction On), 1 = Disabled

Microsoft Defender will automatically take action on all detected threats Status, 0 = Enabled (RoutinelyTakingAction On), 1 = Disabled

Windows Defender Exclusions through Group Policies (GPOs)

Windows Defender Exclusions