Questions[windows-defender](server)

Config Manager and client alerts We like to change the wording in the notifications for Windows Defender for Antivirus. Not sure this is possible. First area - Client, Change the wording on the local machine pop-up notification for Virus & Threat protection - Threat found notification. Can this be done?

Second Area - ConfigManager, Change the wording in the alert Subject line. Currently it has the following for example: "Configuration Manager Malware Detected Alert: Office Malware detection" The "Office Malware Detection" is the Name of the alert but I like to customize it more. Also add additional info in the body of the alert.

Is any of this possible or Microsoft decided there information is good enough?

Thank you to anyone that has any thoughts on this.

I am working with an application that processes a table and for each row it is creating a very simply visual basic script and executing it before other processes are executed. The Vbs script is just an If - Else statement with some simple logic that returns true or false.

It turns out that the application process time has doubled when moving from Windows Server 2012 to Windows Server 2016 because of the AMSI checks done on Windows 2016 but not on Windows 2012 by Windows Defender.

Is there some way to reduce this impact without having to disable the AMSI checks in the server?

One thing I would like to know is if the AMSI calls are done when the script is created? Maybe there is the optoin to create the script as a function and register it so thatthe AMSI check needs to be called only when the function is registered. I do not know if this is possible since I have not been able to find much information about when Windows Defender calls this interface.

I want to remark that the use of VBscripts is something already implemented and changing it is not seen as an option.

Thank you, Sergio

There is a feature in Exchange Online which blocks users from being able to send email when they send too many emails in a time period. It usually triggers either when a user sends a load of emails via Mail Merge or when their account gets compromised and it's used to send a load of spam.

You can view which accounts have been blocked from sending either by going to the Restricted Users page in the Defender Security Portal or by running the Get-BlockedSenderAddress cmdlet in the Exchange Online EXO PowerShell Module.

The trouble is, these only show the users who are currently blocked. I have been asked by my employer to produce a report on who has been blocked in the last n days. I've looked at the reports in the Defender portal and there isn't one that does exactly that. I'm wondering if this kind of data is kept and if so, how I can extract it?

Thanks in advanced for any help.

Using MMC, I'm attempting to remotely manage the Windows Defender Firewall on our Hyper-V Server 2019 instance (no GUI, CLI only). The NetBIOS name is SERVER1.

The Windows Defender Firewall Remote Management rules are enabled:

Name                  : RemoteFwAdmin-In-TCP
DisplayName           : Windows Defender Firewall Remote Management (RPC)
Description           : Inbound rule for the Windows Defender Firewall to be remotely managed via RPC/TCP.
DisplayGroup          : Windows Defender Firewall Remote Management
Group                 : @FirewallAPI.dll,-30002
Enabled               : True
Profile               : Any
Platform              : {}
Direction             : Inbound
Action                : Allow
EdgeTraversalPolicy   : Block
LooseSourceMapping    : False
LocalOnlyMapping      : False
Owner                 : 
PrimaryStatus         : OK
Status                : The rule was parsed successfully from the store. (65536)
EnforcementStatus     : NotApplicable
PolicyStoreSource     : PersistentStore
PolicyStoreSourceType : Local

Name                  : RemoteFwAdmin-RPCSS-In-TCP
DisplayName           : Windows Defender Firewall Remote Management (RPC-EPMAP)
Description           : Inbound rule for the RPCSS service to allow RPC/TCP traffic for the Windows Defender Firewall.
DisplayGroup          : Windows Defender Firewall Remote Management
Group                 : @FirewallAPI.dll,-30002
Enabled               : True
Profile               : Any
Platform              : {}
Direction             : Inbound
Action                : Allow
EdgeTraversalPolicy   : Block
LooseSourceMapping    : False
LocalOnlyMapping      : False
Owner                 : 
PrimaryStatus         : OK
Status                : The rule was parsed successfully from the store. (65536)
EnforcementStatus     : NotApplicable
PolicyStoreSource     : PersistentStore
PolicyStoreSourceType : Local

However, when I click the Inbound Rules node, MMC crashes:

Not that it helps much, but here's the stack trace info:

FX:{b05566ac-fe9c-4368-be02-7a4cbb7cbe11}
Object reference not set to an instance of an object.
System.NullReferenceException
   at Microsoft.WindowsFirewall.SnapIn.Wrappers.FirewallRules.Reload(String[] ruleIdFilter)
   at Microsoft.WindowsFirewall.SnapIn.ExceptionsListView.Refresh()
   at Microsoft.WindowsFirewall.SnapIn.NativeMethods.EnhancedMmcListView`1.ForceRefresh()
   at Microsoft.WindowsFirewall.SnapIn.NativeMethods.EnhancedMmcListView`1.OnShow()
   at Microsoft.ManagementConsole.View.ProcessNotification(Notification notification)
   at Microsoft.ManagementConsole.ViewMessageClient.ProcessNotification(Notification notification)
   at Microsoft.ManagementConsole.Internal.IMessageClient.ProcessNotification(Notification notification)
   at Microsoft.ManagementConsole.Executive.SnapInNotificationOperation.ProcessNotification()
   at Microsoft.ManagementConsole.Executive.Operation.OnThreadTransfer(SimpleOperationCallback callback)

...and here's the Application event log entry:

As expected, the Security and Maintenance control panel is useless for this.

When I try this from another machine on the network, MMC doesn't crash—but the Inbound/Outbound rule lists stay empty. No relevant event log entries are produced there.

How can I track this down and fix it so I can remotely manage the server's firewall?

--UPDATE--

I just now got the MMC crash on the other machine.

I've spent a few months rolling out Group Policy for Windows Defender on a small business domain (about 25 workstations), and gathering the results with Event Viewer. (We are not running SCCM) I have it set to run a quick scan everyday, and a full scan once weekly. The group policy is enforced, and the GPResult output shows it's being processed on the workstations. They randomly scan, without rhyme or reason, very infrequently and never when I specified, like once a week for either scan if lucky. The scan's ALWAYS quit early. Full scans quit EXACTLY one hour after start, and the quick scans quit after 9 or 10 minutes.

In an attempt to wrangle in these machines, I'm trying to create a scheduled task to run the quick and full scans explicitly. When the task is created (user is SYSTEM), it will NEVER run. It quits the job instantly with return code 2147942402. I've seen people solve this issue on home machines by running the task as the users account, and saving the credentials. This is obviously a workaround that will not scale to corporate setting.

At this point I've exhausted searching the web, and I'm curious with these awful results, how anyone uses Defender in a business. It doesn't respond to GPO and it won't run as non-user account. Does anyone have any insight as to how to deploy Defender in a small business domain?

There is no way we're buying into the cloud management services from MS just to get this inept AV scanner to run, I'd rather go third party if this is a losing scenario. Please speak up if you've successfully used Defender in a business environment, I can't find anyone on the web with similar issues. Is everyone using third party AV?

GPO Settings:
Windows Defender Antivirus:
    Turn Off Windows Defender Antivirus             Disabled
    Randomize scheduled task times                  Disabled
MAPS:
    Join Microsoft MAPS                             Disabled
    Configure local setting override for reporting to Microsoft Disabled
Real-time Protection:
    Turn off real-time protection                   Disabled
    Turn on behavior monitoring                     Enabled
    Scan all downloaded files and attachments       Enabled
Scan:
    Check for the latest virus and spyware defs before run… Enabled
    Scan removable drives                                   Disabled
    Run full scan on mapped network drives                  Disabled
    Scan network files                                      Disabled
    Specify the interval to run quick scans per day         Enabled (24)
    Specify the scan type to use for a scheduled scan       Enabled (Full system scan)
    Specify the day of the week to run a scheduled scan*    Enabled (Wed)
    *This value did not show once saved, had to update ADMXtemplates to 1809  
    Specify the time for a daily quick scan                 Enabled (360)(6AM)
    Specify the time of day to run a scheduled scan         Enabled (1320)(10PM)
    Configure local setting override for the scan type to use for…  Disabled
    Configure local setting override for schedule scan day          Disabled
    Configure local setting override for scheduled quick scan ti…   Disabled
    Configure local setting override for scheduled scan time        Disabled