WindowsDefender settings are no longer detected

[alecorgit]

Hello, after updating WindowsDefender.admx, WindowsDefender related settings are no longer detected.

Working admx:
WindowsDefender.admx - ‎Monday, ‎March ‎18, ‎2019

NOT working admx:
WindowsDefender.admx - ‎May ‎11, ‎2024
Windows 11 May 2024 Update V2 (23H2)

The command used is: Invoke-GPOZaurr -Type GPOAnalysis

Thanks for your work and kind regards

[PrzemyslawKlys]

That is not possible as we dont care/read admx files at all. We read what gpresult provides. There must be something else in play.

[alecorgit]

Hoping it can help, the GPOs that are not detected in the WindowsDefender tab, I find them in RegistrySettings with the only key SOFTWARE\Microsoft\Windows Defender\MpEngine\MpFolderScanThreadCount.
I cannot find for example the settings present in _Computer\Administrative Templates\Windows Components/Microsoft Defender Antivirus/Exclusions\Software\Policies\Microsoft\Windows Defender\Exclusions_

[PrzemyslawKlys]

They changed the place where they store it.

    WindowsDefender                                 = @{
        Types      = @(
            @{
                Category = 'RegistrySettings'
                Settings = 'Policy'
            }
        )
        GPOPath    = 'Policies -> Administrative Templates -> Windows Components/Windows Defender'
        Code       = {
            ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*'
        }
        CodeSingle = {
            ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*' -SingleObject
        }
    }
    WindowsDefenderExploitGuard                     = @{
        # this needs improvements because of DropDownList
        Types      = @(
            @{
                Category = 'RegistrySettings'
                Settings = 'Policy'
            }
        )
        GPOPath    = 'Policies -> Administrative Templates -> Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard'
        Code       = {
            ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard*'
        }
        CodeSingle = {
            ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard*' -SingleObject
        }
    }

Is current definition. So I guess not everything is in the same place still

[alecorgit]

Thank you for your answer, it makes sense, using Invoke-GPOZaurrContent I found where it works:

Name : Policies
Key : Policies
PolicyCategory=Windows Components/Microsoft Defender Antivirus

Where it doesn't work:

Name : Policies
Key : Policies
PolicyCategory=Windows Components/Microsoft Defender Antivirus

and

Name : RegistrySettings
Key : RegistrySettings
Key=SOFTWARE\Microsoft\Windows Defender\MpEngine\MpFolderScanThreadCount