--- title: Deploy Exploit protection mitigations across your organization keywords: Exploit protection, mitigations, troubleshoot, import, export, configure, emet, convert, conversion, deploy, install description: Remove unwanted Exploit protection mitigations. search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security localizationpriority: medium author: andreabichsel ms.author: v-anbic ms.date: 04/30/2018 --- # Troubleshoot Exploit protection mitigations **Applies to:** - Windows 10, version 1709 and later **Audience** - Enterprise security administrators **Manageability available with** - Windows Defender Security Center app - PowerShell When you create a set of Exploit protection mitigations (known as a configuration), you might find that the configuration export and import process does not remove all unwanted mitigations. You can manually remove unwanted mitigations in Windows Defender Security Center, or you can use the following process to remove all mitigations and then import a baseline configuration file instead. 1. Remove all process mitigations with this PowerShell script: ```PowerShell # Check if Admin-Privileges are available function Test-IsAdmin { ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator") } # Delete ExploitGuard ProcessMitigations for a given key in the registry. If no other settings exist under the specified key, # the key is deleted as well function Remove-ProcessMitigations([Object] $Key, [string] $Name) { Try { if ($Key.GetValue("MitigationOptions")) { Write-Host "Removing MitigationOptions for: " $Name Remove-ItemProperty -Path $Key.PSPath -Name "MitigationOptions" -ErrorAction Stop; } if ($Key.GetValue("MitigationAuditOptions")) { Write-Host "Removing MitigationAuditOptions for: " $Name Remove-ItemProperty -Path $Key.PSPath -Name "MitigationAuditOptions" -ErrorAction Stop; } # Remove the FilterFullPath value if there is nothing else if (($Key.SubKeyCount -eq 0) -and ($Key.ValueCount -eq 1) -and ($Key.GetValue("FilterFullPath"))) { Remove-ItemProperty -Path $Key.PSPath -Name "FilterFullPath" -ErrorAction Stop; } # If the key is empty now, delete it if (($Key.SubKeyCount -eq 0) -and ($Key.ValueCount -eq 0)) { Write-Host "Removing empty Entry: " $Name Remove-Item -Path $Key.PSPath -ErrorAction Stop } } Catch { Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)" } } # Delete all ExploitGuard ProcessMitigations function Remove-All-ProcessMitigations { if (!(Test-IsAdmin)) { throw "ERROR: No Administrator-Privileges detected!"; return } Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" | ForEach-Object { $MitigationItem = $_; $MitigationItemName = $MitigationItem.PSChildName Try { Remove-ProcessMitigations $MitigationItem $MitigationItemName # "UseFilter" indicate full path filters may be present if ($MitigationItem.GetValue("UseFilter")) { Get-ChildItem -Path $MitigationItem.PSPath | ForEach-Object { $FullPathItem = $_ if ($FullPathItem.GetValue("FilterFullPath")) { $Name = $MitigationItemName + "-" + $FullPathItem.GetValue("FilterFullPath") Write-Host "Removing FullPathEntry: " $Name Remove-ProcessMitigations $FullPathItem $Name } # If there are no subkeys now, we can delete the "UseFilter" value if ($MitigationItem.SubKeyCount -eq 0) { Remove-ItemProperty -Path $MitigationItem.PSPath -Name "UseFilter" -ErrorAction Stop } } } if (($MitigationItem.SubKeyCount -eq 0) -and ($MitigationItem.ValueCount -eq 0)) { Write-Host "Removing empty Entry: " $MitigationItemName Remove-Item -Path $MitigationItem.PSPath -ErrorAction Stop } } Catch { Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)" } } } # Delete all ExploitGuard System-wide Mitigations function Remove-All-SystemMitigations { if (!(Test-IsAdmin)) { throw "ERROR: No Administrator-Privileges detected!"; return } $Kernel = Get-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" Try { if ($Kernel.GetValue("MitigationOptions")) { Write-Host "Removing System MitigationOptions" Remove-ItemProperty -Path $Kernel.PSPath -Name "MitigationOptions" -ErrorAction Stop; } if ($Kernel.GetValue("MitigationAuditOptions")) { Write-Host "Removing System MitigationAuditOptions" Remove-ItemProperty -Path $Kernel.PSPath -Name "MitigationAuditOptions" -ErrorAction Stop; } } Catch { Write-Host "ERROR:" $_.Exception.Message "- System" } } Remove-All-ProcessMitigations Remove-All-SystemMitigations ``` 2. Create and import an XML configuration file with the following default mitigations, as described in Import, export, and deploy Exploit Protection configurations: ```xml ``` If you haven’t already, it's a good idea to download and use the [Windows Security Baselines](https://docs.microsoft.com/en-us/windows/device-security/windows-security-baselines) to complete your Exploit protection customization. ## Related topics - [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md) - [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) - [Evaluate Exploit protection](evaluate-exploit-protection.md) - [Enable Exploit protection](enable-exploit-protection.md) - [Configure and audit Exploit protection mitigations](customize-exploit-protection.md) - [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md)