Detections
Analytics
WNDF-AV-000100 - Microsoft Defender AV must control whether exclusions are visible to Local Admins.
Information
Disabled (Default): If this setting is not configured or disabled, local admins can see exclusions in the Windows Security App or via PowerShell.Enabled: If this setting is enabled, local admins no longer see the exclusion list in Windows Security App or via PowerShell.
Note: Applying this setting will not remove exclusions, it only prevents them from being visible to local admins. This is reflected in Get-MpPreference.
Solution
Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Control whether exclusions are visible to Local Admins to 'Enabled'.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Defender_Antivirus_V2R9_STIG.zip
Item Details
Audit Name: DISA Microsoft Defender Antivirus STIG v2r9
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-18(4), CAT|II, CCI|CCI-001170, Rule-ID|SV-278658r1207388_rule, STIG-ID|WNDF-AV-000100, Vuln-ID|V-278658
Plugin: Windows
Control ID: e6f0d5a155cc419f4c1c9550e2d9536cd22af08a1a420238d2e7a0a0c6dca482