Can't get around this error message about configuredefender HOT 5 OPEN

I was able to configure this setting using the Local Group Policy Editor (C:\Windows\System32\gpedit.msc):

Local Computer Policy -> Administrative Templates -> Windows Components -> Microsoft Defender Antivirus -> Real-time Protection -> Scan all downloaded files and attachments -> Disabled

I can close and restart gpedit.msc and see the setting is retained. I checked the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection, and DisableIOAVProtection is set to 1.

But when I run ConfigureDefender, it still shows that this setting is "ON".

???

from configuredefender.

I looked into this some more. It appears that ConfigureDefender is trying to change this registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection -> set Dword DisableIOAVProtection to 1

If Windows Defender real time protection is turned on, it disallows writing to this registry key, even if permissions & ownership of the key is set to Administrator. If you disable real time protection, you can then write this value to the key. But if real time protection is re-enabled, the DisableIOAVProtection Dword will be completely erased.

Looks like ConfigureDefender is going to have to instead use the policy key (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection) to set this value... I haven't checked other settings yet.

from configuredefender.

Hi BlohoJo,
Two ConfigureDefender settings are prevented from changes by Windows Defender Tamper Protection:

• Behavior monitoring
• Scan all downloaded files and attachments

When trying to change them you get the alert you posted about.

from configuredefender.

Maybe if runned as Trusted Installer it could work ?

https://winaero.com/execti-run-programs-trustedinstaller/

from configuredefender.

Nothing will help when Tamper Protection is enabled.
Anyway, there is no reason to disable the options that are protected by Tamper Protection.

from configuredefender.