windows-itpro-docs/windows/client-management/mdm/defender-csp.md

title, description, author, manager, ms.author, ms.date, ms.localizationpriority, ms.prod, ms.technology, ms.topic

title	description	author	manager	ms.author	ms.date	ms.localizationpriority	ms.prod	ms.technology	ms.topic
Defender CSP	Learn more about the Defender CSP.	vinaypamnani-msft	aaroncz	vinpa	02/17/2023	medium	windows-client	itpro-manage	reference

Defender CSP

The following example shows the Defender configuration service provider in tree format.

./Device/Vendor/MSFT/Defender
--- Configuration
------ AllowDatagramProcessingOnWinServer
------ AllowNetworkProtectionDownLevel
------ AllowNetworkProtectionOnWinServer
------ ASROnlyPerRuleExclusions
------ DataDuplicationDirectory
------ DataDuplicationLocalRetentionPeriod
------ DataDuplicationRemoteLocation
------ DefaultEnforcement
------ DeviceControl
--------- PolicyGroups
------------ {GroupId}
--------------- GroupData
--------- PolicyRules
------------ {RuleId}
--------------- RuleData
------ DeviceControlEnabled
------ DisableCpuThrottleOnIdleScans
------ DisableDnsOverTcpParsing
------ DisableDnsParsing
------ DisableFtpParsing
------ DisableGradualRelease
------ DisableHttpParsing
------ DisableInboundConnectionFiltering
------ DisableLocalAdminMerge
------ DisableNetworkProtectionPerfTelemetry
------ DisableRdpParsing
------ DisableSmtpParsing
------ DisableSshParsing
------ DisableTlsParsing
------ EnableDnsSinkhole
------ EnableFileHashComputation
------ EngineUpdatesChannel
------ HideExclusionsFromLocalAdmins
------ IntelTDTEnabled
------ MeteredConnectionUpdates
------ PassiveRemediation
------ PlatformUpdatesChannel
------ RandomizeScheduleTaskTimes
------ ScanOnlyIfIdleEnabled
------ SchedulerRandomizationTime
------ SecurityIntelligenceUpdatesChannel
------ SupportLogLocation
------ TamperProtection
------ ThrottleForScheduledScanOnly
--- Detections
------ {ThreatId}
--------- Category
--------- CurrentStatus
--------- ExecutionStatus
--------- InitialDetectionTime
--------- LastThreatStatusChangeTime
--------- Name
--------- NumberOfDetections
--------- Severity
--------- URL
--- Health
------ ComputerState
------ DefenderEnabled
------ DefenderVersion
------ EngineVersion
------ FullScanOverdue
------ FullScanRequired
------ FullScanSigVersion
------ FullScanTime
------ IsVirtualMachine
------ NisEnabled
------ ProductStatus
------ QuickScanOverdue
------ QuickScanSigVersion
------ QuickScanTime
------ RebootRequired
------ RtpEnabled
------ SignatureOutOfDate
------ SignatureVersion
------ TamperProtectionEnabled
--- OfflineScan
--- RollbackEngine
--- RollbackPlatform
--- Scan
--- UpdateSignature

Configuration

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1903 [10.0.18362] and later

./Device/Vendor/MSFT/Defender/Configuration

An interior node to group Windows Defender configuration information.

Description framework properties:

Property name	Property value
Format	node
Access Type	Get

Configuration/AllowDatagramProcessingOnWinServer

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/AllowDatagramProcessingOnWinServer

This settings controls whether Network Protection is allowed to enable datagram processing on Windows Server. If false, the value of DisableDatagramProcessing will be ignored and default to disabling Datagram inspection.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	Datagram processing on Windows Server is enabled.
0 (Default)	Datagram processing on Windows Server is disabled.

Configuration/AllowNetworkProtectionDownLevel

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/AllowNetworkProtectionDownLevel

This settings controls whether Network Protection is allowed to be configured into block or audit mode on windows downlevel of RS3. If false, the value of EnableNetworkProtection will be ignored.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	Network protection will be enabled downlevel.
0 (Default)	Network protection will be disabled downlevel.

Configuration/AllowNetworkProtectionOnWinServer

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1709 [10.0.16299] and later

./Device/Vendor/MSFT/Defender/Configuration/AllowNetworkProtectionOnWinServer

This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server. If false, the value of EnableNetworkProtection will be ignored.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
1 (Default)	Allow.
0	Disallow.

Configuration/ASROnlyPerRuleExclusions

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1709 [10.0.16299] and later

./Device/Vendor/MSFT/Defender/Configuration/ASROnlyPerRuleExclusions

Apply ASR only per rule exclusions.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Configuration/DataDuplicationDirectory

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DataDuplicationDirectory

Define data duplication directory for device control.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Configuration/DataDuplicationLocalRetentionPeriod

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DataDuplicationLocalRetentionPeriod

Define the retention period in days of how much time the evidence data will be kept on the client machine should any transfer to the remote locations would occur.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace
Allowed Values	Range: [1-120]
Default Value	60

Configuration/DataDuplicationRemoteLocation

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DataDuplicationRemoteLocation

Define data duplication remote location for device control.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Configuration/DefaultEnforcement

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DefaultEnforcement

Control Device Control default enforcement. This is the enforcement applied if there are no policy rules present or at the end of the policy rules evaluation none were matched.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
1 (Default)	Default Allow Enforcement.
2	Default Deny Enforcement.

Configuration/DeviceControl

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DeviceControl

Description framework properties:

Property name	Property value
Format	node
Access Type	Get

Configuration/DeviceControl/PolicyGroups

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups

Description framework properties:

Property name	Property value
Format	node
Access Type	Get

Configuration/DeviceControl/PolicyGroups/{GroupId}

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/{GroupId}

Description framework properties:

Property name	Property value
Format	node
Access Type	Add, Delete, Get, Replace

Configuration/DeviceControl/PolicyGroups/{GroupId}/GroupData

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/{GroupId}/GroupData

Follow the instructions provided here: https://learn.microsoft.com/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Configuration/DeviceControl/PolicyRules

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules

Description framework properties:

Property name	Property value
Format	node
Access Type	Get

Configuration/DeviceControl/PolicyRules/{RuleId}

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/{RuleId}

Description framework properties:

Property name	Property value
Format	node
Access Type	Add, Delete, Get, Replace

Configuration/DeviceControl/PolicyRules/{RuleId}/RuleData

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/{RuleId}/RuleData

Follow the instructions provided here: https://learn.microsoft.com/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Configuration/DeviceControlEnabled

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/DeviceControlEnabled

Control Device Control feature.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	.
0 (Default)	.

Configuration/DisableCpuThrottleOnIdleScans

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableCpuThrottleOnIdleScans

Indicates whether the CPU will be throttled for scheduled scans while the device is idle. This feature is enabled by default and will not throttle the CPU for scheduled scans performed when the device is otherwise idle, regardless of what ScanAvgCPULoadFactor is set to. For all other scheduled scans this flag will have no impact and normal throttling will occur.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
1 (Default)	Disable CPU Throttle on idle scans.
0	Enable CPU Throttle on idle scans.

Configuration/DisableDnsOverTcpParsing

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableDnsOverTcpParsing

This setting disables DNS over TCP Parsing for Network Protection.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	DNS over TCP parsing is disabled.
0 (Default)	DNS over TCP parsing is enabled.

Configuration/DisableDnsParsing

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableDnsParsing

This setting disables DNS Parsing for Network Protection.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	DNS parsing is disabled.
0 (Default)	DNS parsing is enabled.

Configuration/DisableFtpParsing

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableFtpParsing

This setting disables FTP Parsing for Network Protection.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	FTP parsing is disabled.
0 (Default)	FTP parsing is enabled.

Configuration/DisableGradualRelease

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableGradualRelease

Enable this policy to disable gradual rollout of Defender updates.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	Gradual release is disabled.
0 (Default)	Gradual release is enabled.

Configuration/DisableHttpParsing

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableHttpParsing

This setting disables HTTP Parsing for Network Protection.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	HTTP parsing is disabled.
0 (Default)	HTTP parsing is enabled.

Configuration/DisableInboundConnectionFiltering

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableInboundConnectionFiltering

This setting disables Inbound connection filtering for Network Protection.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	Inbound connection filtering is disabled.
0 (Default)	Inbound connection filtering is enabled.

Configuration/DisableLocalAdminMerge

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableLocalAdminMerge

When this value is set to false, it allows a local admin the ability to specify some settings for complex list type that will then merge /override the Preference settings with the Policy settings.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	Disable Local Admin Merge.
0 (Default)	Enable Local Admin Merge.

Configuration/DisableNetworkProtectionPerfTelemetry

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableNetworkProtectionPerfTelemetry

This setting disables the gathering and send of performance telemetry from Network Protection.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	Network protection telemetry is disabled.
0 (Default)	Network protection telemetry is enabled.

Configuration/DisableRdpParsing

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableRdpParsing

This setting disables RDP Parsing for Network Protection.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	RDP Parsing is disabled.
0 (Default)	RDP Parsing is enabled.

Configuration/DisableSmtpParsing

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableSmtpParsing

This setting disables SMTP Parsing for Network Protection.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	SMTP parsing is disabled.
0 (Default)	SMTP parsing is enabled.

Configuration/DisableSshParsing

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableSshParsing

This setting disables SSH Parsing for Network Protection.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	SSH parsing is disabled.
0 (Default)	SSH parsing is enabled.

Configuration/DisableTlsParsing

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/DisableTlsParsing

This setting disables TLS Parsing for Network Protection.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	TLS parsing is disabled.
0 (Default)	TLS parsing is enabled.

Configuration/EnableDnsSinkhole

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/EnableDnsSinkhole

This setting enables the DNS Sinkhole feature for Network Protection, respecting the value of EnableNetworkProtection for block vs audit, does nothing in inspect mode.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
1 (Default)	DNS Sinkhole is disabled.
0	DNS Sinkhole is enabled.

Configuration/EnableFileHashComputation

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1903 [10.0.18362] and later

./Device/Vendor/MSFT/Defender/Configuration/EnableFileHashComputation

Enables or disables file hash computation feature. When this feature is enabled Windows defender will compute hashes for files it scans.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Disable.
1	Enable.

Configuration/EngineUpdatesChannel

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/EngineUpdatesChannel

Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices.
2	Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices.
3	Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments.
4	Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%).
5	Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%).
6	Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only.

Configuration/HideExclusionsFromLocalAdmins

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Configuration/HideExclusionsFromLocalAdmins

This policy setting controls whether or not exclusions are visible to local admins. For end users (that are not local admins) exclusions are not visible, whether or not this setting is enabled.

Note

Applying this setting won't remove exclusions from the device registry, it will only prevent them from being applied/used. This is reflected in Get-MpPreference.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	If you enable this setting, local admins will no longer be able to see the exclusion list in Windows Security App or via PowerShell.
0 (Default)	If you disable or do not configure this setting, local admins will be able to see exclusions in the Windows Security App and via PowerShell.

Configuration/IntelTDTEnabled

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 2004 [10.0.19041] and later

./Device/Vendor/MSFT/Defender/Configuration/IntelTDTEnabled

This policy setting configures the Intel TDT integration level for Intel TDT-capable devices.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	If you do not configure this setting, the default value will be applied. The default value is controlled by Microsoft security intelligence updates. Microsoft will enable Intel TDT if there is a known threat.
2	If you configure this setting to disabled, Intel TDT integration will turn off.

Configuration/MeteredConnectionUpdates

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/MeteredConnectionUpdates

Allow managed devices to update through metered connections. Default is 0 - not allowed, 1 - allowed.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
1	Allowed.
0 (Default)	Not Allowed.

Configuration/PassiveRemediation

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/PassiveRemediation

Setting to control automatic remediation for Sense scans.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Flag	Description
0x1
0x2
0x4

Configuration/PlatformUpdatesChannel

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/PlatformUpdatesChannel

Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices.
2	Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices.
3	Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments.
4	Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%).
5	Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%).
6	Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only.

Configuration/RandomizeScheduleTaskTimes

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/RandomizeScheduleTaskTimes

In Microsoft Defender Antivirus, randomize the start time of the scan to any interval from 0 to 23 hours. This can be useful in virtual machines or VDI deployments.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
1 (Default)	Widen or narrow the randomization period for scheduled scans. Specify a randomization window of between 1 and 23 hours by using the setting SchedulerRandomizationTime.
0	Scheduled tasks will begin at a random time within 4 hours after the time specified in Task Scheduler.

Configuration/ScanOnlyIfIdleEnabled

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/ScanOnlyIfIdleEnabled

In Microsoft Defender Antivirus, this setting will run scheduled scans only if the system is idle.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
1 (Default)	Runs scheduled scans only if the system is idle.
0	Runs scheduled scans regardless of whether the system is idle.

Configuration/SchedulerRandomizationTime

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/SchedulerRandomizationTime

This setting allows you to configure the scheduler randomization in hours. The randomization interval is [1 - 23] hours. For more information on the randomization effect please check the RandomizeScheduleTaskTimes setting.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Allowed Values	Range: [1-23]
Default Value	4

Configuration/SecurityIntelligenceUpdatesChannel

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/SecurityIntelligenceUpdatesChannel

Enable this policy to specify when devices receive Microsoft Defender security intelligence updates during the daily gradual rollout.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices.
4	Current Channel (Staged): Devices will be offered updates after the release cycle. Suggested to apply to a small, representative part of production population (~10%).
5	Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%).

Configuration/SupportLogLocation

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/SupportLogLocation

The support log location setting allows the administrator to specify where the Microsoft Defender Antivirus diagnostic data collection tool (MpCmdRun.exe) will save the resulting log files. This setting is configured with an MDM solution, such as Intune, and is available for Windows 10 Enterprise.

Intune Support Log Location setting UI supports three states:

• Not configured (default) - Doesn't have any impact on the default state of the device.
• 1 - Enabled. Enables the Support log location feature. Requires admin to set custom file path.
• 0 - Disabled. Turns off the Support log location feature.

When enabled or disabled exists on the client and admin moves the setting to not configured, it won't have any impact on the device state. To change the state to either enabled or disabled would require to be set explicitly.

More details:

• Microsoft Defender Antivirus diagnostic data
• Collect investigation package from devices

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Configuration/TamperProtection

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1903 [10.0.18362] and later

./Device/Vendor/MSFT/Defender/Configuration/TamperProtection

Tamper protection helps protect important security features from unwanted changes and interference. This includes real-time protection, behavior monitoring, and more. Accepts signed string to turn the feature on or off. Settings are configured with an MDM solution, such as Intune and is available in Windows 10 Enterprise E5 or equivalent subscriptions. Send off blob to device to reset tamper protection state before setting this configuration to "not configured" or "unassigned" in Intune. The data type is a Signed blob.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace
Default Value	0

Configuration/ThrottleForScheduledScanOnly

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/Defender/Configuration/ThrottleForScheduledScanOnly

A CPU usage limit can be applied to scheduled scans only, or to scheduled and custom scans. The default value applies a CPU usage limit to scheduled scans only.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
1 (Default)	If you enable this setting, CPU throttling will apply only to scheduled scans.
0	If you disable this setting, CPU throttling will apply to scheduled and custom scans.

Detections

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Detections

An interior node to group all threats detected by Windows Defender.

Description framework properties:

Property name	Property value
Format	node
Access Type	Get

Detections/{ThreatId}

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Detections/{ThreatId}

The ID of a threat that has been detected by Windows Defender.

Description framework properties:

Property name	Property value
Format	node
Access Type	Get
Dynamic Node Naming	ClientInventory

Detections/{ThreatId}/Category

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/Category

Threat category ID. Supported values:

Value	Description
0	Invalid
1	Adware
2	Spyware
3	Password stealer
4	Trojan downloader
5	Worm
6	Backdoor
7	Remote access Trojan
8	Trojan
9	Email flooder
10	Keylogger
11	Dialer
12	Monitoring software
13	Browser modifier
14	Cookie
15	Browser plugin
16	AOL exploit
17	Nuker
18	Security disabler
19	Joke program
20	Hostile ActiveX control
21	Software bundler
22	Stealth modifier
23	Settings modifier
24	Toolbar
25	Remote control software
26	Trojan FTP
27	Potential unwanted software
28	ICQ exploit
29	Trojan telnet
30	Exploit
31	File sharing program
32	Malware creation tool
33	Remote control software
34	Tool
36	Trojan denial of service
37	Trojan dropper
38	Trojan mass mailer
39	Trojan monitoring software
40	Trojan proxy server
42	Virus
43	Known
44	Unknown
45	SPP
46	Behavior
47	Vulnerability
48	Policy
49	EUS (Enterprise Unwanted Software)
50	Ransomware
51	ASR Rule

Description framework properties:

Property name	Property value
Format	int
Access Type	Get

Detections/{ThreatId}/CurrentStatus

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/CurrentStatus

Information about the current status of the threat. The following list shows the supported values:

Value	Description
0	Active
1	Action failed
2	Manual steps required
3	Full scan required
4	Reboot required
5	Remediated with noncritical failures
6	Quarantined
7	Removed
8	Cleaned
9	Allowed
10	No Status ( Cleared)

Description framework properties:

Property name	Property value
Format	int
Access Type	Get

Detections/{ThreatId}/ExecutionStatus

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/ExecutionStatus

Information about the execution status of the threat.

Description framework properties:

Property name	Property value
Format	int
Access Type	Get

Detections/{ThreatId}/InitialDetectionTime

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/InitialDetectionTime

The first time this particular threat was detected.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Get

Detections/{ThreatId}/LastThreatStatusChangeTime

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/LastThreatStatusChangeTime

The last time this particular threat was changed.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Get

Detections/{ThreatId}/Name

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/Name

The name of the specific threat.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Get

Detections/{ThreatId}/NumberOfDetections

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/NumberOfDetections

Number of times this threat has been detected on a particular client.

Description framework properties:

Property name	Property value
Format	int
Access Type	Get

Detections/{ThreatId}/Severity

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/Severity

Threat severity ID. The following list shows the supported values:

Value	Description
0	Unknown
1	Low
2	Moderate
4	High
5	Severe

Description framework properties:

Property name	Property value
Format	int
Access Type	Get

Detections/{ThreatId}/URL

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/URL

URL link for additional threat information.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Get

Health

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health

An interior node to group information about Windows Defender health status.

Description framework properties:

Property name	Property value
Format	node
Access Type	Get

Health/ComputerState

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/ComputerState

Provide the current state of the device. The following list shows the supported values:

Value	Description
0	Clean
1	Pending full scan
2	Pending reboot
4	Pending manual steps (Windows Defender is waiting for the user to take some action, such as restarting the computer or running a full scan)
8	Pending offline scan
16	Pending critical failure (Windows Defender has failed critically and an Administrator needs to investigate and take some action, such as restarting the computer or reinstalling Windows Defender)

Description framework properties:

Property name	Property value
Format	int
Access Type	Get

Health/DefenderEnabled

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/DefenderEnabled

Indicates whether the Windows Defender service is running.

Description framework properties:

Property name	Property value
Format	bool
Access Type	Get

Health/DefenderVersion

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/DefenderVersion

Version number of Windows Defender on the device.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Get

Health/EngineVersion

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/EngineVersion

Version number of the current Windows Defender engine on the device.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Get

Health/FullScanOverdue

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/FullScanOverdue

Indicates whether a Windows Defender full scan is overdue for the device. A Full scan is overdue when a scheduled Full scan did not complete successfully for 2 weeks and catchup Full scans are disabled (default).

Description framework properties:

Property name	Property value
Format	bool
Access Type	Get

Health/FullScanRequired

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/FullScanRequired

Indicates whether a Windows Defender full scan is required.

Description framework properties:

Property name	Property value
Format	bool
Access Type	Get

Health/FullScanSigVersion

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/FullScanSigVersion

Signature version used for the last full scan of the device.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Get

Health/FullScanTime

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/FullScanTime

Time of the last Windows Defender full scan of the device.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Get

Health/IsVirtualMachine

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1903 [10.0.18362] and later

./Device/Vendor/MSFT/Defender/Health/IsVirtualMachine

Indicates whether the device is a virtual machine.

Description framework properties:

Property name	Property value
Format	bool
Access Type	Get

Health/NisEnabled

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/NisEnabled

Indicates whether network protection is running.

Description framework properties:

Property name	Property value
Format	bool
Access Type	Get

Health/ProductStatus

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/Defender/Health/ProductStatus

Provide the current state of the product. This is a bitmask flag value that can represent one or multiple product states from below list. Supported product status values:

Value	Description
0	No status
1 (1 << 0)	Service not running
2 (1 << 1)	Service started without any malware protection engine
4 (1 << 2)	Pending full scan due to threat action
8 (1 << 3)	Pending reboot due to threat action
16 (1 << 4)	ending manual steps due to threat action
32 (1 << 5)	AV signatures out of date
64 (1 << 6)	AS signatures out of date
128 (1 << 7)	No quick scan has happened for a specified period
256 (1 << 8)	No full scan has happened for a specified period
512 (1 << 9)	System initiated scan in progress
1024 (1 << 10)	System initiated clean in progress
2048 (1 << 11)	There are samples pending submission
4096 (1 << 12)	Product running in evaluation mode
8192 (1 << 13)	Product running in non-genuine Windows mode
16384 (1 << 14)	Product expired
32768 (1 << 15)	Off-line scan required
65536 (1 << 16)	Service is shutting down as part of system shutdown
131072 (1 << 17)	Threat remediation failed critically
262144 (1 << 18)	Threat remediation failed non-critically
524288 (1 << 19)	No status flags set (well initialized state)
1048576 (1 << 20)	Platform is out of date
2097152 (1 << 21)	Platform update is in progress
4194304 (1 << 22)	Platform is about to be outdated
8388608 (1 << 23)	Signature or platform end of life is past or is impending
16777216 (1 << 24)	Windows SMode signatures still in use on non-Win10S install

Description framework properties:

Property name	Property value
Format	int
Access Type	Get

Example:

<SyncML xmlns="SYNCML:SYNCML1.1">
  <SyncBody>
    <Get>
      <CmdID>1</CmdID>
        <Item>
          <Target>
            <LocURI>./Vendor/MSFT/Defender/Health/ProductStatus</LocURI>
          </Target>
        </Item>
    </Get>
    <Final/>
  </SyncBody>
</SyncML>

Health/QuickScanOverdue

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/QuickScanOverdue

Indicates whether a Windows Defender quick scan is overdue for the device. A Quick scan is overdue when a scheduled Quick scan did not complete successfully for 2 weeks and catchup Quick scans are disabled (default).

Description framework properties:

Property name	Property value
Format	bool
Access Type	Get

Health/QuickScanSigVersion

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/QuickScanSigVersion

Signature version used for the last quick scan of the device.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Get

Health/QuickScanTime

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/QuickScanTime

Time of the last Windows Defender quick scan of the device.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Get

Health/RebootRequired

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/RebootRequired

Indicates whether a device reboot is needed.

Description framework properties:

Property name	Property value
Format	bool
Access Type	Get

Health/RtpEnabled

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/RtpEnabled

Indicates whether real-time protection is running.

Description framework properties:

Property name	Property value
Format	bool
Access Type	Get

Health/SignatureOutOfDate

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/SignatureOutOfDate

Indicates whether the Windows Defender signature is outdated.

Description framework properties:

Property name	Property value
Format	bool
Access Type	Get

Health/SignatureVersion

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Health/SignatureVersion

Version number of the current Windows Defender signatures on the device.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Get

Health/TamperProtectionEnabled

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1903 [10.0.18362] and later

./Device/Vendor/MSFT/Defender/Health/TamperProtectionEnabled

Indicates whether the Windows Defender tamper protection feature is enabled.

Description framework properties:

Property name	Property value
Format	bool
Access Type	Get

OfflineScan

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1803 [10.0.17134] and later

./Device/Vendor/MSFT/Defender/OfflineScan

OfflineScan action starts a Microsoft Defender Offline scan on the computer where you run the command. After the next OS reboot, the device will start in Microsoft Defender Offline mode to begin the scan.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Exec, Get
Reboot Behavior	ServerInitiated

RollbackEngine

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1803 [10.0.17134] and later

./Device/Vendor/MSFT/Defender/RollbackEngine

RollbackEngine action rolls back Microsoft Defender engine to it's last known good saved version on the computer where you run the command.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Exec, Get
Reboot Behavior	ServerInitiated

RollbackPlatform

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1803 [10.0.17134] and later

./Device/Vendor/MSFT/Defender/RollbackPlatform

RollbackPlatform action rolls back Microsoft Defender to it's last known good installation location on the computer where you run the command.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Exec, Get
Reboot Behavior	ServerInitiated

Scan

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/Scan

Node that can be used to start a Windows Defender scan on a device.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Exec, Get

Allowed values:

Value	Description
1	Quick scan.
2	Full scan.

UpdateSignature

Scope	Editions	Applicable OS
✔️ Device ❌ User	❌ Home ✔️ Pro ✔️ Enterprise ✔️ Education ✔️ Windows SE	✔️ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/Defender/UpdateSignature

Node that can be used to perform signature updates for Windows Defender.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Exec, Get

Related articles

Configuration service provider reference