Windows 10: Windows Defender Antimalware Platform 4.18.2101.4-0 causes problems with group policy and...

Today the Windows Defender Antimalware Platform was updated automatically from version 4.18.2011.6 -> 4.18.2101.4 on my computer.

I didn't notice it at first but since this morning I was experiencing the following problems on my computer:


- LDAP queries to the domain controllers took a long time

- Opening the Active Directory Users & Computers MMC add-in took a very long time and when opening the OUs,

the MMC console stopped responding. Also when choosing to change the domain controllers, the domain controllers were not populated.


- Group policy updates were very slow from 4 seconds on normal computer to more than 2 minutes on my affected computer


I was searching almost the whole day with group policy debugging and LDAP network sniffing because I thought that it was a

problem with the domain controllers. I installed the monthly security updates this weekend on them


When I reviewed my event viewer once more, I saw the information message from this morning that the antimalware platform was updated.

After reverting to the previous version with "%programdata%\microsoft\windows defender\platform\<version>\mpcmdrun.exe" -revertplatform

the problems suddenly disappeared.


Anyone else experiencing problems with this update?

:)

 

Windows Defender Group Policy Disabeled

Hi,

Thank you for contacting Microsoft community.

As you have stated you want to disable the group policy so that you can run windows defender on the computer.

I would like to suggest few troubleshooting steps:

Method 1: Disable group policy from gpedit.msc

• 
  Press Windows key + R.
  
• 
  Type gpedit.msc and click Ok.(it will open Local Group policy editor)
  
• 
  Go to Computer Configuration/Administrative Templates/Windows Components/Windows Defender.
  
• 
  In the right pane of
  Windows Defender in Local Group Policy Editor, double click/tap on the
  Turn off Windows Defender policy to edit it.
  
• 
  Select (dot) Not Configured or
  Disabled, click/tap on OK,
  
• 
  When finished, you can close the Local Group Policy Editor if you like.
  

If the issue still persist you can follow method 2.

Method 2: Disable group policy from registry.

Important: This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow
these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the
article in the Microsoft Knowledge Base:

How to back up and restore the registry in Windows

http://support.microsoft.com/kb/322756

• 
  Press Window Key +R.
  
• 
  Type regedit and click. (it will open registry)
  
• 
  Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
  
• 
  Right Click on Window Defender to create a new Dword.
  
• 
  Click on New and Select Dword.
  
• 
  Type DisableAntiSpyware.
  
• 
  Right click on DisableAntiSpyware and click on modify.
  
• 
  Set the value to 0 instead of 1.
  

Hope this information is helpful. If the issue still persists, you can write back to us and we will be glad to assist you further.

 

New Defender Platform 4.18.2003.4-0 - Items skipped during scan Alert

Thanks for checking your machines.

It appears to be affecting only some users after the 4.18.2003.4-0 Platform update. And for some of them, only one machine but not the other.

For me it was both that choked up this message in the early AM of Tuesday the 10th, 8 hours before .719 was released but right after the Defender 4.18.2003.4-0 Platform update.


This 'Item Exclusion' issue still present after .719, .720 and after Wednesday's re-issue of 4.18.2003.5-0

When I re-imaged back to the day before Tuesday, when it was still running 4.18.2001.10 like you - no problem. Then updated the platform and the problem returned.


The fact mentioned by others, that Window's Catalog hasn't posted either 4.18.2003.4-0 or 4.18.2003.5-0 Platforms yet, only 4.18.2001.10, would suggest there's perhaps some problem.

 

Defender antimalware client update

In Windows 10 version 1709, os build 16299.192, checking for updates shows a new update for the Windows Defender antimalware platform, to version 4.12.17007.18011







Installed without a problem, no restart required. Defender before updating...





After the update...





As with previous antimalware client updates, the update doesn't show in Update History. It can be seen in Reliability History.






Edit: 1st March - another update has been issued, version 4.12.17007.18022. Seems this is to be a regular monthly event.

https://support.microsoft.com/help/4...lware-platform