Ensure 'Specify threat alert levels at which default action should not be taken when detected' is set to 'Enabled: Medium: 2 or 3'

Açıklama

This policy setting configures which automatic remediation action Microsoft Defender Antivirus will take for each threat alert level detection. Valid threat alert levels are: - 1 = Low - 2 = Medium - 4 = High - 5 = Severe Valid remediation action values are: - 2 = Quarantine - 3 = Remove - 6 = Ignore Threat alert levels are added under "options" for this setting. Each entry must be listed as a name value pair. Rationale: By default, Defender uses the action embedded in each threat’s malware signature (clean, quarantine, remove, etc.). Configuring this setting ensures the same action is always taken, regardless of how Microsoft classifies a specific threat. Audit reads the Group Policy registry value and prints 'compliant', 'unset' (policy not configured, reported as FAIL) or the non-compliant value. Registry value: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction:2 (REG_SZ); compliant when it is 2 or 3. Remediation writes 2 locally; in a domain set it through the ADMX so Group Policy does not revert it.

Özellikler

İşletim sistemleri

Herhangi biri

Etiketler

defenderantiviruscis-l1

Referans

CIS Microsoft Defender Antivirus Benchmark v1.0.0 - 1.15.2 Ensure 'Specify threat alert levels at which default action should not be taken when detected' is set to 'Enabled: Medium: 2 or 3'