Windows 10: Microsoft Defender Update Source change via SCCM Antimalware Policy

Hello, We are currently managing MS Defender via SCCM & currently AV signature update source is SCCM CMG. We would like to change update source to Microsoft Update & fallback as SCCM CMG. We applied separate test policy on few machines, but machines are now not updating at all. We would like to see the logs from which update source systems are trying to update the signatures. Please help to know which log files we can refer to narrow down this and understand real issue.Thanks in Advance!Girish Modak.

:)

 

SCCM Local Policy - BITS

Managing BITS policy for clients can be done several ways - just a few listed here:

1. Group Policy template
2. Local Policy template
3. registry
4. and more...

SCCM client settings for BITS uses local policy to enforce the BITS agent settings.

Consider the following scenario:

SCCM client settings contains BITS settings for max throttle, start and stop times, etc...

SCCM Client settings also have the "Limit the maximum network bandwidth for BITS backgrounds transfers" set to "NO" so, effectively no settings that are configured are actually being enforced.

This is working fine. Here's the issue:

If I fun the following command:

GPResult /scope computer /h file.htm

... the output file will show that this local setting is "enabled" and appears it is enforced.

The setting is not enforced but the reporting mechanism thinks it is. I'm considering this a bug. This burned a customer and cost them several hours of troubleshooting where this setting was coming from because they swore that SCCM was not setting it.

 

Win-10 Update issue and Group Policy

Hello,

Had followed a tutorial on this forum and installed Win-10 and set up Data Partition on D:\.

Did Win-10 update v.1803 some time back and got the following error:
Update for Windows Defender antimalware platform - KB4052623 (Version 4.18.1809.2)
Failed to install on ‎10/‎8/‎2018 - 0x8024001e

Clicking on the above (it was a link) led me to:
https://support.microsoft.com/en-us/...lware-platform

that mentions:
Because of a change in the file path location in the update, many downloads are blocked when AppLocker is enabled. To work around this issue, open Group Policy, and then change the setting to Allow for the following path:%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\*


Any ideas how to do the above? Detailed steps?

Thanks,

 

Windows Defender Group Policy Disabeled

Hi,

Thank you for contacting Microsoft community.

As you have stated you want to disable the group policy so that you can run windows defender on the computer.

I would like to suggest few troubleshooting steps:

Method 1: Disable group policy from gpedit.msc

• 
  Press Windows key + R.
  
• 
  Type gpedit.msc and click Ok.(it will open Local Group policy editor)
  
• 
  Go to Computer Configuration/Administrative Templates/Windows Components/Windows Defender.
  
• 
  In the right pane of
  Windows Defender in Local Group Policy Editor, double click/tap on the
  Turn off Windows Defender policy to edit it.
  
• 
  Select (dot) Not Configured or
  Disabled, click/tap on OK,
  
• 
  When finished, you can close the Local Group Policy Editor if you like.
  

If the issue still persist you can follow method 2.

Method 2: Disable group policy from registry.

Important: This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow
these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the
article in the Microsoft Knowledge Base:

How to back up and restore the registry in Windows

How to back up and restore the registry in Windows

• 
  Press Window Key +R.
  
• 
  Type regedit and click. (it will open registry)
  
• 
  Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
  
• 
  Right Click on Window Defender to create a new Dword.
  
• 
  Click on New and Select Dword.
  
• 
  Type DisableAntiSpyware.
  
• 
  Right click on DisableAntiSpyware and click on modify.
  
• 
  Set the value to 0 instead of 1.
  

Hope this information is helpful. If the issue still persists, you can write back to us and we will be glad to assist you further.