Ensure 'Turn on process scanning whenever real-time protection is enabled' is set to 'Enabled'

СреднийУровень 1Автоматическаяintune-defender

Описание

This policy setting configures process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off. The recommended state for this setting is: Enabled. Audit: reads the registry value(s) behind this Defender policy (HKLM\SOFTWARE\Policies\Microsoft\Windows Defender) and prints compliant only when each satisfies the benchmark value. Policy delivered by Intune only appears here once it has been applied to the device.

Как проверяется

Метод проверки: Реестр Windows

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-TimeProtection' -Name 'DisableScanOnRealtimeEnable' -ErrorAction SilentlyContinue).'DisableScanOnRealtimeEnable'; if (-not ($null -ne $v -and @(0) -contains [int64]$v)) { $bad += 'DisableScanOnRealtimeEnable=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Enabled: Administrative Templates\Microsoft Defender Antivirus\Real-Time Protection\Turn on process scanning whenever real-time protection is enabled

Свойства

Операционные системы: Любая
Теги: intune-defenderintuneregistry
Источник: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 1.8.1 Ensure 'Turn on process scanning whenever real-time protection is enabled' is set to 'Enabled'

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target intune-defender