Windows 10: Where is Defender setting to Quarantine - in Win 1703

In Windows 1607 Windows Defender had a way to set how to handle detections and I could set two bottom lines to Quarantine rather than Recommended setting, which probably meant delete.
In Windows 1703 - I cannot find where such setting is made. I think I looked through every possible thing (as admin) in the Defender settings and no go.
Also there was a way in the registry to have Defender check for PUPs and I don't recall how that gem was set.
Does anyone know?

:)

 

Windows Defender is missing Restore Button for Quarantined Threats

I need to restore a quarantined threat, but the restore button is no longer showing in Windows Defender. Windows Pro 10 Version 1703 Build 15063.608

 

windows defender quarantine

Where is Windows Defender quarantine location in Windows 10? How do I see which files have been quarantined? How do I un-quarantine a file? How do I tell Windows Defender to consider a file as safe?

 

Hey 91fw,
Far as I know the default is Quarantine. If you using Win10 Pro, I believe you can set WD thru the Group Policy Editor. You can also Open PowerShell as Administrator > Get-MpPreference and Set-MpPreference.
Get-MpPreference
Set-MpPreference

View Current Settings
get-mppreference

Set preference for PUP
set-mppreference PUAProtection 1

Note: I would create a txt file of the current settings first *Smile
get-mppreference > "$($env:userprofile)\Desktop\wd-settings.txt"

 

Microsoft call them PUAs ('Potentionally Unwanted Applications' rather than 'Programs'). There's a tutorial for this.

Enable or Disable Windows Defender PUA Protection in Windows 10

 

Thanks much for this, see below.

 

Thank you both for the neat instructions. Still it's all clear as mud to me. Can't understand why all those 34 possible settings are not in the GUI. I can't send feedback to M$ because I only use a local account.

I could, but did not use gpedit, just wanted to see how it works by other methods.
I did use powershell for the first time ever, and the result of PUAProtection did change from 0 to 1. I used the "-PUAProtection 1" (see -) in the command with this final result:

I did not use the registry, it was and still is:

- So why did the powershell output report PUAProtection as zero before I changed it to 1 when the registry already was set?
- In the powershell .txt output, any idea what is the meaning of zero, and what is 90 - miliseconds, seconds, minutes, hours, days, years, centuries? Is there somewhere a list of the meaning of some settings? Watching scripts might not be a bad idea.
- Are the CMD commands no longer possible? Just powershell with its strange syntax?

 

Not sure on that *Sad

Check this page ... Set-MpPreference

Command Prompt is still available. The get/set mppreference just happens to be a PowerShell command. If you're referring to the win+x menu, check this tutorial ... Show Command Prompt or Windows PowerShell on Win+X menu in Windows 10 Windows 10 Customization Tutorials

 

Thanks for sticking with me.

In my default settings, LowThreatDefaultAction is zero (as are actually all other threat actions).
So I look up what zero might stand for in the M$ page you so kindly provided.

I still don't know what zero stands for. Nor what number might be good for, for example, "Ask me" or "Remove" or "Allow". It was possible to set such things on 1607, but not now on 1703. For some settings they do list corresponding numbers. Curious.
I have a hunch there's no solution to the removed options in GUI, Arrggghhh *Sad other than take a look at gpedit which I haven't yet done.

 

I hadn't looked that close at that particular settings and mine is 0. The couple of things WD has flagged, it quarantined. So I can only assume (dangerous I know) that 0 is default for quarantine. If I were to change it, I would use the accepted value wording and not guess at what number they might be.

 

When WD flagged, did you a get an alert on the screen so you could then look at the exact list?
In previous windows (1607) I did get an alert and then in the GUI I was able to see what they show and what to do. It was ImgBurn with its OpenCandy junk so was a correct detection, and since I knew how OpenCandy works (wants to run out of .tmp file which another program would block for me) I chose to ignore. Is that still possible? I'm just trying to see how it'll work and the total lack of GUI information annoys me *Smile

 

Yea, you get a notification which takes you to the WD Security Center. There you can see details, history, etc. and If I remember correctly it gave me 3 options (clean, quarantine, ignore). If you like the old GUI check this tutorial.
Create Windows Defender Antivirus Shortcut in Windows 10 Windows 10 Security System Tutorials

 

So long as I'll be notified and then can decide, it'll work for me.

Good link for making a shortcut, thanks, but...
I just ran MSASCui.exe, as admin, to look at settings - unfortunately it took me to the very incomplete settings that came with 1703.
Oh, well. I'll mark this thread as solved since I have a hunch we can't do better than your wonderful tips and I feel it's time to stop imposing on your time.
BTW, I was looking in gpedit. Amazing how well M$ describes many, many, settings there with clear description of what happens when you enable or disable or not configured. But without a sandbox, I'm reluctant to mess with it.
THANK YOU for your helps *Smile