--- title: Defender DDF file description: View the XML file containing the device description framework (DDF) for the Defender configuration service provider. ms.date: 09/27/2024 --- # Defender DDF file The following XML file contains the device description framework (DDF) for the Defender configuration service provider. ```xml ]> 1.2 Defender ./Device/Vendor/MSFT 10.0.10586 1.0 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; Detections An interior node to group all threats detected by Windows Defender. The ID of a threat that has been detected by Windows Defender. ThreatId Name The name of the specific threat. URL URL link for additional threat information. Severity Threat severity ID. The following list shows the supported values: 0 = Unknown; 1 = Low; 2 = Moderate; 4 = High; 5 = Severe; Category Threat category ID. Supported values: 0-Invalid; 1-Adware; 2-Spyware; 3-Password stealer; 4-Trojan downloader; 5-Worm; 6-Backdoor; 7-Remote access Trojan; 8-Trojan; 9-Email flooder; 10-Keylogger; 11-Dialer; 12-Monitoring software; 13-Browser modifier; 14-Cookie; 15-Browser plugin; 16-AOL exploit; 17-Nuker; 18-Security disabler; 19-Joke program; 20-Hostile ActiveX control; 21-Software bundler; 22-Stealth modifier; 23-Settings modifier; 24-Toolbar; 25-Remote control software; 26-Trojan FTP; 27-Potential unwanted software; 28-ICQ exploit; 29-Trojan telnet; 30-Exploit; 31-File sharing program; 32-Malware creation tool; 33-Remote control software; 34-Tool; 36-Trojan denial of service; 37-Trojan dropper; 38-Trojan mass mailer; 39-Trojan monitoring software; 40-Trojan proxy server; 42-Virus; 43-Known; 44-Unknown; 45-SPP; 46-Behavior; 47-Vulnerability; 48-Policy; 49-EUS (Enterprise Unwanted Software); 50-Ransomware; 51-ASR Rule CurrentStatus Information about the current status of the threat. The following list shows the supported values: 0 = Active; 1 = Action failed; 2 = Manual steps required; 3 = Full scan required; 4 = Reboot required; 5 = Remediated with noncritical failures; 6 = Quarantined; 7 = Removed; 8 = Cleaned; 9 = Allowed; 10 = No Status ( Cleared) ExecutionStatus Information about the execution status of the threat. InitialDetectionTime The first time this particular threat was detected. LastThreatStatusChangeTime The last time this particular threat was changed. NumberOfDetections Number of times this threat has been detected on a particular client. Health An interior node to group information about Windows Defender health status. DeviceControl An interior node to group information about Device Cotrol health status. State 10.0.17763 1.3 ProductStatus 10.0.17763 1.2 ComputerState Provide the current state of the device. The following list shows the supported values: 0 = Clean; 1 = Pending full scan; 2 = Pending reboot; 4 = Pending manual steps (Windows Defender is waiting for the user to take some action, such as restarting the computer or running a full scan); 8 = Pending offline scan; 16 = Pending critical failure (Windows Defender has failed critically and an Administrator needs to investigate and take some action, such as restarting the computer or reinstalling Windows Defender) DefenderEnabled Indicates whether the Windows Defender service is running. RtpEnabled Indicates whether real-time protection is running. NisEnabled Indicates whether network protection is running. QuickScanOverdue Indicates whether a Windows Defender quick scan is overdue for the device. A Quick scan is overdue when a scheduled Quick scan did not complete successfully for 2 weeks and catchup Quick scans are disabled (default). FullScanOverdue Indicates whether a Windows Defender full scan is overdue for the device. A Full scan is overdue when a scheduled Full scan did not complete successfully for 2 weeks and catchup Full scans are disabled (default). SignatureOutOfDate Indicates whether the Windows Defender signature is outdated. RebootRequired Indicates whether a device reboot is needed. FullScanRequired Indicates whether a Windows Defender full scan is required. EngineVersion Version number of the current Windows Defender engine on the device. SignatureVersion Version number of the current Windows Defender signatures on the device. DefenderVersion Version number of Windows Defender on the device. QuickScanTime Time of the last Windows Defender quick scan of the device. FullScanTime Time of the last Windows Defender full scan of the device. QuickScanSigVersion Signature version used for the last quick scan of the device. FullScanSigVersion Signature version used for the last full scan of the device. TamperProtectionEnabled Indicates whether the Windows Defender tamper protection feature is enabled. 10.0.18362 1.3 IsVirtualMachine Indicates whether the device is a virtual machine. 10.0.18362 1.3 Configuration An interior node to group Windows Defender configuration information. 10.0.18362 1.3 DeviceControl 10.0.17763 1.3 PolicyGroups GroupId GroupData Follow the instructions provided here: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control?view=o365-worldwide PolicyRules RuleId RuleData Follow the instructions provided here: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control?view=o365-worldwide TamperProtection 0 Tamper protection helps protect important security features from unwanted changes and interference. This includes real-time protection, behavior monitoring, and more. Accepts signed string to turn the feature on or off. Settings are configured with an MDM solution, such as Intune and is available in Windows 10 Enterprise E5 or equivalent subscriptions. Send off blob to device to reset tamper protection state before setting this configuration to "not configured" or "unassigned" in Intune. The data type is a Signed blob. EnableFileHashComputation 0 Enables or disables file hash computation feature. When this feature is enabled Windows defender will compute hashes for files it scans. 0 Disable 1 Enable MeteredConnectionUpdates 0 Allow managed devices to update through metered connections. Default is 0 - not allowed, 1 - allowed 10.0.14393 1 Allowed 0 Not Allowed SupportLogLocation The support log location setting allows the administrator to specify where the Microsoft Defender Antivirus diagnostic data collection tool (MpCmdRun.exe) will save the resulting log files. This setting is configured with an MDM solution, such as Intune, and is available for Windows 10 Enterprise. 10.0.14393 1.3 ExcludedIpAddresses Allows an administrator to explicitly disable network packet inspection made by wdnisdrv on a particular set of IP addresses. 10.0.14393 1.3 ^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}$|^[0-9a-fA-F]{1,4}(?::[0-9a-fA-F]{1,4}){1,6}$|^::1$|^::$ AllowNetworkProtectionOnWinServer 1 This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server. If false, the value of EnableNetworkProtection will be ignored. 10.0.16299 1.3 1 Allow 0 Disallow DisableCpuThrottleOnIdleScans 1 Indicates whether the CPU will be throttled for scheduled scans while the device is idle. This feature is enabled by default and will not throttle the CPU for scheduled scans performed when the device is otherwise idle, regardless of what ScanAvgCPULoadFactor is set to. For all other scheduled scans this flag will have no impact and normal throttling will occur. 10.0.14393 1.3 1 Disable CPU Throttle on idle scans 0 Enable CPU Throttle on idle scans DisableLocalAdminMerge 0 When this value is set to no, it allows a local admin the ability to specify some settings for complex list type that will then merge /override the Preference settings with the Policy settings 10.0.14393 1.3 1 Yes 0 No SchedulerRandomizationTime 4 This setting allows you to configure the scheduler randomization in hours. The randomization interval is [1 - 23] hours. For more information on the randomization effect please check the RandomizeScheduleTaskTimes setting. 10.0.14393 1.3 [1-23] DisableTlsParsing 0 This setting disables TLS Parsing for Network Protection. 10.0.14393 1.3 1 TLS parsing is disabled 0 TLS parsing is enabled DisableFtpParsing 0 This setting disables FTP Parsing for Network Protection. 10.0.14393 1.3 1 FTP parsing is disabled 0 FTP parsing is enabled DisableHttpParsing 0 This setting disables HTTP Parsing for Network Protection. 10.0.14393 1.3 1 HTTP parsing is disabled 0 HTTP parsing is enabled DisableDnsParsing 0 This setting disables DNS Parsing for Network Protection. 10.0.14393 1.3 1 DNS parsing is disabled 0 DNS parsing is enabled DisableDnsOverTcpParsing 0 This setting disables DNS over TCP Parsing for Network Protection. 10.0.14393 1.3 1 DNS over TCP parsing is disabled 0 DNS over TCP parsing is enabled DisableSshParsing 0 This setting disables SSH Parsing for Network Protection. 10.0.14393 1.3 1 SSH parsing is disabled 0 SSH parsing is enabled PlatformUpdatesChannel 0 Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout. 10.0.14393 1.3 0 Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. 2 Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. 3 Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. 4 Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). 5 Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). 6 Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only. EngineUpdatesChannel 0 Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. 10.0.14393 1.3 0 Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. 2 Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. 3 Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. 4 Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). 5 Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). 6 Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only. SecurityIntelligenceUpdatesChannel 0 Enable this policy to specify when devices receive Microsoft Defender security intelligence updates during the daily gradual rollout. 10.0.14393 1.3 0 Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. 4 Current Channel (Staged): Devices will be offered updates after the release cycle. Suggested to apply to a small, representative part of production population (~10%). 5 Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). DisableGradualRelease 0 Enable this policy to disable gradual rollout of Defender updates. 10.0.14393 1.3 1 Gradual release is disabled 0 Gradual release is enabled AllowNetworkProtectionDownLevel 0 This settings controls whether Network Protection is allowed to be configured into block or audit mode on windows downlevel of RS3. If false, the value of EnableNetworkProtection will be ignored. 10.0.14393 1.3 1 Network protection will be enabled downlevel. 0 Network protection will be disabled downlevel. EnableDnsSinkhole 1 This setting enables the DNS Sinkhole feature for Network Protection, respecting the value of EnableNetworkProtection for block vs audit, does nothing in inspect mode. 10.0.14393 1.3 0 DNS Sinkhole is disabled 1 DNS Sinkhole is enabled DisableInboundConnectionFiltering 0 This setting disables Inbound connection filtering for Network Protection. 10.0.14393 1.3 1 Inbound connection filtering is disabled 0 Inbound connection filtering is enabled DisableRdpParsing 0 This setting disables RDP Parsing for Network Protection. 10.0.14393 1.3 1 RDP Parsing is disabled 0 RDP Parsing is enabled AllowDatagramProcessingOnWinServer 0 This settings controls whether Network Protection is allowed to enable datagram processing on Windows Server. If false, the value of DisableDatagramProcessing will be ignored and default to disabling Datagram inspection. 10.0.14393 1.3 1 Datagram processing on Windows Server is enabled. 0 Datagram processing on Windows Server is disabled. DisableDatagramProcessing 0 Control whether network protection inspects User Datagram Protocol (UDP) traffic 10.0.16299 1.3 1 UDP inspection is off 0 UDP inspection is on EnableConvertWarnToBlock 0 This setting controls whether network protection blocks network traffic instead of displaying a warning 10.0.16299 1.3 1 Warn verdicts are converted to block 0 Warn verdicts are not converted to block DisableNetworkProtectionPerfTelemetry 0 This setting disables the gathering and send of performance telemetry from Network Protection. 10.0.14393 1.3 1 Network protection telemetry is disabled 0 Network protection telemetry is enabled HideExclusionsFromLocalAdmins 0 This policy setting controls whether or not exclusions are visible to local admins. To control local users exlcusions visibility use HideExclusionsFromLocalUsers. If HideExclusionsFromLocalAdmins is set then HideExclusionsFromLocalUsers will be implicitly set. 10.0.17763 1.3 1 If you enable this setting, local admins will no longer be able to see the exclusion list in Windows Security App or via PowerShell. 0 If you disable or do not configure this setting, local admins will be able to see exclusions in the Windows Security App and via PowerShell. HideExclusionsFromLocalUsers 0 This policy setting controls whether or not exclusions are visible to local users. If HideExclusionsFromLocalAdmins is set then this policy will be implicitly set. 10.0.17763 1.3 1 If you enable this setting, local users will no longer be able to see the exclusion list in Windows Security App or via PowerShell. 0 If you disable or do not configure this setting, local users will be able to see exclusions in the Windows Security App and via PowerShell. OobeEnableRtpAndSigUpdate 0 This setting allows you to configure whether real-time protection and Security Intelligence Updates are enabled during OOBE (Out of Box experience). 10.0.14393 1.3 1 If you enable this setting, real-time protection and Security Intelligence Updates are enabled during OOBE. 0 If you either disable or do not configure this setting, real-time protection and Security Intelligence Updates during OOBE is not enabled. PerformanceModeStatus 0 This setting allows IT admins to configure performance mode in either enabled or disabled mode for managed devices. 10.0.22000 1.3 0 Performance mode is enabled (default). 1 Performance mode is disabled. QuickScanIncludeExclusions 0 This setting allows you to scan excluded files and directories during quick scans. 10.0.14393 1.3 0 If you set this setting to 0 or do not configure it, exclusions are not scanned during quick scans. 1 If you set this setting to 1, all files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan. SecurityIntelligenceLocationUpdateAtScheduledTimeOnly 0 This setting allows you to configure security intelligence updates according to the scheduler for VDI-configured computers. It is used together with the shared security intelligence location (SecurityIntelligenceLocation). 10.0.18362 1.3 1 If you enable this setting and configure SecurityIntelligenceLocation, updates from the configured location occur only at the previously configured scheduled update time. 0 If you either disable or do not configure this setting, updates occur whenever a new security intelligence update is detected at the location that is specified by SecurityIntelligenceLocation. ScheduleSecurityIntelligenceUpdateTime 105 This setting allows you to specify the time of day at which to check for security intelligence updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 is equivalent to 02:00 AM. By default, this setting is configured to check for security intelligence updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring. 10.0.14393 1.3 [0-1439] ScheduleSecurityIntelligenceUpdateDay 8 This setting allows you to specify the day of the week on which to check for security intelligence updates. By default, this setting is configured to never check for security intelligence updates. 10.0.14393 1.3 0 Daily 1 Sunday 2 Monday 3 Tuesday 4 Wednesday 5 Thursday 6 Friday 7 Saturday 8 Never ThrottleForScheduledScanOnly 1 A CPU usage limit can be applied to scheduled scans only, or to scheduled and custom scans. The default value applies a CPU usage limit to scheduled scans only. 10.0.14393 1.3 1 If you enable this setting, CPU throttling will apply only to scheduled scans. 0 If you disable this setting, CPU throttling will apply to scheduled and custom scans. DaysUntilAggressiveCatchupQuickScan 30 Configure how many days can pass before an aggressive quick scan is triggered. The valid interval is [7-60] days. If not configured, aggressive quick scans will be disabled. By default, the value is set to 30 days when enabled. 10.0.14393 1.3 [7-60] ASROnlyPerRuleExclusions Apply ASR only per rule exclusions. 10.0.16299 1.3 DataDuplicationDirectory Define data duplication directory for device control. 10.0.17763 1.3 DataDuplicationRemoteLocation Define data duplication remote location for Device Control. When configuring this setting, ensure that Device Control is Enabled and that the provided path is a remote path the user can access. 10.0.17763 1.3 SecuredDevicesConfiguration Defines which device's primary ids should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all supported devices will be secured. Currently supported primary ids are: RemovableMediaDevices, CdRomDevices, WpdDevices, PrinterDevices. 10.0.17763 1.3 RemovableMediaDevices RemovableMediaDevices CdRomDevices CdRomDevices WpdDevices WpdDevices PrinterDevices PrinterDevices DataDuplicationMaximumQuota 500 Defines the maximum data duplication quota in MB that can be collected. When the quota is reached the filter will stop duplicating any data until the service manages to dispatch the existing collected data, thus decreasing the quota again below the maximum. The valid interval is [5-5000] MB. By default, the maximum quota will be 500 MB. 10.0.17763 1.3 [5-5000] DataDuplicationLocalRetentionPeriod 60 Define the retention period in days of how much time the evidence data will be kept on the client machine should any transfer to the remote locations would occur. 10.0.17763 1.3 [1-120] DeviceControlEnabled 0 Control Device Control feature. 10.0.17763 1.3 1 Device Control is enabled 0 Device Control is disabled DefaultEnforcement 1 Control Device Control default enforcement. This is the enforcement applied if there are no policy rules present or at the end of the policy rules evaluation none were matched. 10.0.17763 1.3 1 Default Allow Enforcement 2 Default Deny Enforcement PassiveRemediation 0x0 Setting to control automatic remediation for Sense scans. 10.0.14393 1.3 0x0 Passive Remediation is turned off (default) 0x1 PASSIVE_REMEDIATION_FLAG_SENSE_AUTO_REMEDIATION: Passive Remediation Sense AutoRemediation 0x2 PASSIVE_REMEDIATION_FLAG_RTP_AUDIT: Passive Remediation Realtime Protection Audit 0x4 PASSIVE_REMEDIATION_FLAG_RTP_REMEDIATION: Passive Remediation Realtime Protection Remediation DisableCoreServiceECSIntegration 0x0 Turn off ECS integration for Defender core service 10.0.14393 1.3 0x0 The Defender core service will use the Experimentation and Configuration Service (ECS) to rapidly deliver critical, org-specific fixes. 0x1 The Defender core service stops using the Experimentation and Configuration Service (ECS). Fixes will continue to be delivered through security intelligence updates. DisableCoreServiceTelemetry 0x0 Turn off OneDsCollector telemetry for Defender core service 10.0.14393 1.3 0x0 The Defender core service will use the OneDsCollector framework to rapidly collect telemetry. 0x1 The Defender core service stops using the OneDsCollector framework to rapidly collect telemetry, impacting Microsoft's ability to quickly recognize and address poor performance, false positives, and other problems. IntelTDTEnabled 0 This policy setting configures the Intel TDT integration level for Intel TDT-capable devices. 10.0.19041 1.3 0 If you do not configure this setting, the default value will be applied. The default value is controlled by Microsoft security intelligence updates. Microsoft will enable Intel TDT if there is a known threat. 1 If you configure this setting to enabled, Intel TDT integration will turn on. 2 If you configure this setting to disabled, Intel TDT integration will turn off. DisableSmtpParsing 0 This setting disables SMTP Parsing for Network Protection. 10.0.14393 1.3 1 SMTP parsing is disabled 0 SMTP parsing is enabled DisableQuicParsing 0 This setting disables QUIC Parsing for Network Protection. 10.0.14393 1.3 1 QUIC parsing is disabled 0 QUIC parsing is enabled NetworkProtectionReputationMode 0 This sets the reputation mode engine for Network Protection. 10.0.14393 1.3 0 Use standard reputation engine 1 Use ESP reputation engine EnableUdpSegmentationOffload 0 This setting enables Udp Segmentation Offload Network Protection. 10.0.14393 1.3 0 Udp Segmentation Offload is disabled 1 Udp Segmentation Offload is enabled EnableUdpReceiveOffload 0 This setting enables Udp Receive Offload Network Protection. 10.0.14393 1.3 0 Udp Receive Offload is disabled 1 Udp Receive Offload is enabled AllowSwitchToAsyncInspection 0 Control whether network protection can improve performance by switching from real-time inspection to asynchronous inspection 10.0.16299 1.3 1 Allow switching to asynchronous inspection 0 Don’t allow asynchronous inspection RandomizeScheduleTaskTimes 1 In Microsoft Defender Antivirus, randomize the start time of the scan to any interval from 0 to 23 hours. This can be useful in virtual machines or VDI deployments. 10.0.14393 1.3 1 Widen or narrow the randomization period for scheduled scans. Specify a randomization window of between 1 and 23 hours by using the setting SchedulerRandomizationTime. 0 Scheduled tasks will not be randomized. ArchiveMaxSize 0 Specify the maximum size, in KB, of archive files to be extracted and scanned. If this configuration is off or not set, the default value (0) is applied, and all archives are extracted and scanned regardless of size. 10.0.14393 1.3 [0-4294967295] ArchiveMaxDepth 0 Specify the maximum folder depth to extract from archive files for scanning. If this configuration is off or not set, the default value (0) is applied, and all archives are extracted up to the deepest folder for scanning. 10.0.14393 1.3 [0-4294967295] ScanOnlyIfIdleEnabled 1 In Microsoft Defender Antivirus, this setting will run scheduled scans only if the system is idle. 10.0.14393 1.3 1 Runs scheduled scans only if the system is idle. 0 Runs scheduled scans regardless of whether the system is idle. DisableCacheMaintenance 0 Defines whether the cache maintenance idle task will perform the cache maintenance or not. 10.0.17763 1.3 1 Cache maintenance is disabled 0 Cache maintenance is enabled (default) BehavioralNetworkBlocks 10.0.14393 1.3 RemoteEncryptionProtection RemoteEncryptionProtectionConfiguredState 0 Remote Encryption Protection in Microsoft Defender Antivirus detects and blocks attempts to replace local files with encrypted versions from another device. 10.0.14393 1.3 0 Not configured: Apply defaults set for the antivirus engine and platform 1 Block: Prevent suspicious and malicious behaviors 2 Audit: Generate EDR detections without blocking 4 Off: Feature is off with no performance impact RemoteEncryptionProtectionMaxBlockTime 0 Set the maximum time an IP address is blocked by Remote Encryption Protection. After this time, blocked IP addresses will be able to reinitiate connections. If set to 0, internal feature logic will determine blocking time. 10.0.14393 1.3 [0-4294967295] RemoteEncryptionProtectionAggressiveness 0 Set the criteria for when Remote Encryption Protection blocks IP addresses. 10.0.14393 1.3 0 Low: Block only when confidence level is 100% (Default) 1 Medium: Use cloud aggregation and block when confidence level is above 99% 2 High: Use cloud intel and context, and block when confidence level is above 90% RemoteEncryptionProtectionExclusions 0 Specify IP addresses, subnets, or workstation names to exclude from being blocked by Remote Encryption Protection. Note that attackers can spoof excluded addresses and names to bypass protection. 10.0.14393 1.3 BruteForceProtection BruteForceProtectionConfiguredState 0 Brute-Force Protection in Microsoft Defender Antivirus detects and blocks attempts to forcibly sign in and initiate sessions. 10.0.14393 1.3 0 Not configured: Apply defaults set by the antivirus engine and platform 1 Block: Prevent suspicious and malicious behaviors 2 Audit: Generate EDR detections without blocking 4 Off: Feature is disabled with no performance impact BruteForceProtectionMaxBlockTime 0 Set the maximum time an IP address is blocked by Brute-Force Protection. After this time, blocked IP addresses will be able to sign-in and initiate sessions. If set to 0, internal feature logic will determine blocking time. 10.0.14393 1.3 [0-4294967295] BruteForceProtectionAggressiveness 0 Set the criteria for when Brute-Force Protection blocks IP addresses. 10.0.14393 1.3 0 Low: Only IP addresses that are 100% confidence malicious (default) 1 Medium: Use cloud aggregation to block IP addresses that are over 99% likely malicious 2 High: Block IP addresses identified using client intelligence and context to block IP addresses that are over 90% likely malicious BruteForceProtectionPlugins BruteForceProtectionLocalNetworkBlocking 0 Extend brute-force protection coverage in Microsoft Defender Antivirus to block local network addresses. 10.0.16299 1.3 0 Brute-force protection will not block local network addresses 1 Brute-force protection will block local network addresses BruteForceProtectionSkipLearningPeriod 0 Skip the 2-week initial learning period, so brute-force protection in Microsoft Defender Antivirus can start blocking immediately. 10.0.16299 1.3 0 Brute-force protection blocks threats only after completing a 2-week learning period 1 Brute-force protection starts blocking threats immediately BruteForceProtectionExclusions Specify IP addresses, subnets, or workstation names to exclude from being blocked by Brute-Force Protection. Note that attackers can spoof excluded addresses and names to bypass protection. 10.0.14393 1.3 Scan Node that can be used to start a Windows Defender scan on a device. 1 quick scan 2 full scan UpdateSignature Node that can be used to perform signature updates for Windows Defender. OfflineScan OfflineScan action starts a Microsoft Defender Offline scan on the computer where you run the command. After the next OS reboot, the device will start in Microsoft Defender Offline mode to begin the scan. 10.0.17134 1.1 ServerInitiated RollbackPlatform RollbackPlatform action rolls back Microsoft Defender to it's last known good installation location on the computer where you run the command. 10.0.17134 1.1 ServerInitiated RollbackEngine RollbackEngine action rolls back Microsoft Defender engine to it's last known good saved version on the computer where you run the command. 10.0.17134 1.1 ServerInitiated ``` ## Related articles [Defender configuration service provider reference](defender-csp.md)