hkey_local_machine software policies microsoft windows defender

Audit mode records events but won't interfere (read block) potentially unwanted programs.

It is furthermore possible to set the feature to audit mode. Tip: You can disable the protection again at a later point in time by running the command Set- MpPreference -PUAProtection Disabled. Find PUAProtection and make sure it is set to 1 (which means that it is enabled). You can run the command Get-MpPreference to check the status of preferences of Windows Defender Antivirus. Nothing is returned when you run the command. Type Set-MpPreference -PUAProtection Enabled and hit the Return-key.The console that opens should being with 'Administrator'.

Confirm the UAC prompt that is displayed.

If you don't see Windows PowerShell (Admin) listed there do the following instead: open Start, type Windows PowerShell, right-click on the result, and select 'run as administrator'.

Open Windows PowerShell with Windows-X and the selection of Windows PowerShell (Admin) from the context menu.

Note that the following instructions apply to Windows 10 only and that you need elevated rights to make the change. Enable the potentially unwanted programs protection in Windows Defender Users are informed about the identification of PUPs on the system similar to how they are informed about other threats detected by Windows Defender.Īdmins and users can check the Windows Event Viewer for event ID 1160 as potentially unwanted program events are recorded under it. Windows Defender Antivirus places files identified as PUP in the Quarantine.

Hkey_local_machine software policies microsoft windows defender