Mirrors/mr-r3b00t-go-darker
1
0
Fork 0
mirror of https://github.com/mr-r3b00t/go_darker synced 2026-08-07 12:43:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
Daniel Card
2026-07-05 05:11:39 +01:00
committed by GitHub
parent 95fc00dff1
commit 346ce56252
3 changed files with 910 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Manage-DefenderAntivirus.ps1
+608
View File
@@ -0,0 +1,608 @@
#Requires -Version 5.1
<#
Manage-DefenderAntivirus.ps1
Purpose : View the health of Microsoft Defender Antivirus and view/toggle
its protection settings, plus run common actions (update
signatures, quick/full scan, view threats and exclusions).
IMPORTANT: This is a SECURITY tool. Unlike the telemetry/privacy scripts,
here "Enabled / On" is the DESIRED (protected) state and
"Off" REDUCES protection. Turning protections off is guarded
and should only be done deliberately (e.g. troubleshooting).
How : Uses the built-in Defender PowerShell module (Get-MpComputerStatus,
Get-MpPreference, Set-MpPreference, Update-MpSignature, Start-MpScan).
Registry is intentionally NOT used - Tamper Protection and policy
layering make direct registry edits to Defender unreliable.
Notes : - Windows PowerShell 5.1 compatible. ASCII-only source.
- Viewing works as a standard user; changing settings and running
scans require Administrator.
- TAMPER PROTECTION: when on (default on Windows 11), Windows
blocks programmatic changes to core protection. Such changes
will fail here by design - turn Tamper Protection off in the
Windows Security app first if you really need to change them.
Usage :
.\Manage-DefenderAntivirus.ps1 # interactive menu
.\Manage-DefenderAntivirus.ps1 -Report # print status and exit
.\Manage-DefenderAntivirus.ps1 -EnableRecommended # set all to protected
.\Manage-DefenderAntivirus.ps1 -DisableAll # turn all protections OFF
.\Manage-DefenderAntivirus.ps1 -Update # update signatures and exit
.\Manage-DefenderAntivirus.ps1 -QuickScan # run a quick scan and exit
.\Manage-DefenderAntivirus.ps1 -Csv .\def.csv # export status and exit
DISCLAIMER: USE AT YOUR OWN RISK. Provided as-is with no warranty. Disabling
antivirus protection exposes the system to malware. Review before use.
#>
[CmdletBinding()]
param(
[switch]$Report,
[switch]$EnableRecommended,
[switch]$DisableAll,
[switch]$Update,
[switch]$QuickScan,
[switch]$FullScan,
[string]$Csv
)
Set-StrictMode -Version 2.0
$ErrorActionPreference = 'Stop'
# ---------------------------------------------------------------------------
# Elevation / availability
# ---------------------------------------------------------------------------
function Test-IsAdmin {
$id = [Security.Principal.WindowsIdentity]::GetCurrent()
$pr = New-Object Security.Principal.WindowsPrincipal($id)
return $pr.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}
$Script:IsAdmin = Test-IsAdmin
if (-not (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) {
Write-Host 'Microsoft Defender PowerShell module not found on this system.' -ForegroundColor Red
Write-Host 'This tool requires the built-in Defender cmdlets (Windows client / Server' -ForegroundColor DarkYellow
Write-Host 'with the Defender feature installed). Nothing to do.' -ForegroundColor DarkYellow
return
}
# ---------------------------------------------------------------------------
# Cached preference / status reads
# ---------------------------------------------------------------------------
$Script:Mp = $null
$Script:Status = $null
function Get-MpPref {
if ($null -eq $Script:Mp) { $Script:Mp = Get-MpPreference }
return $Script:Mp
}
function Get-MpStatus {
if ($null -eq $Script:Status) { $Script:Status = Get-MpComputerStatus }
return $Script:Status
}
function Reset-MpCache {
$Script:Mp = $null
$Script:Status = $null
}
# ---------------------------------------------------------------------------
# Control model
# Pref controls map to a single Set-MpPreference parameter.
# Kind:
# Bool - the parameter is a Disable* boolean; ProtectOn = $false.
# Enum - integer-backed; ProtectOn/ProtectOff are ints, Map gives labels.
# "On" (protected) is always the recommended state.
# ---------------------------------------------------------------------------
function New-PrefControl {
param(
[string]$Name,
[string]$PrefName,
[ValidateSet('Bool','Enum')][string]$Kind,
$ProtectOn, $ProtectOff,
[hashtable]$Map = $null,
[string]$Note = '',
[switch]$PrivacyTradeoff # feature that also sends data to Microsoft
)
[pscustomobject]@{
Type = 'Pref'
Name = $Name
PrefName = $PrefName
Kind = $Kind
ProtectOn = $ProtectOn
ProtectOff = $ProtectOff
Map = $Map
Note = $Note
PrivacyTradeoff = [bool]$PrivacyTradeoff
AdminReq = $true
}
}
function Get-PrefRaw {
param($Ctrl)
$mp = Get-MpPref
try { return $mp.$($Ctrl.PrefName) }
catch { return $null }
}
function Get-ControlState {
param($Ctrl)
$cur = Get-PrefRaw -Ctrl $Ctrl
if ($null -eq $cur) { return 'Unknown' }
if ($Ctrl.Kind -eq 'Bool') {
if ([bool]$cur -eq [bool]$Ctrl.ProtectOn) { return 'On' }
if ([bool]$cur -eq [bool]$Ctrl.ProtectOff) { return 'Off' }
return ('? ({0})' -f $cur)
} else {
$curInt = $null
try { $curInt = [int]$cur } catch { return ('? ({0})' -f $cur) }
$label = $curInt
if ($Ctrl.Map -and $Ctrl.Map.ContainsKey($curInt)) { $label = $Ctrl.Map[$curInt] }
if ($curInt -eq [int]$Ctrl.ProtectOn) { return ('On ({0})' -f $label) }
if ($curInt -eq [int]$Ctrl.ProtectOff) { return ('Off ({0})' -f $label) }
return ('Other ({0})' -f $label) # e.g. Audit mode
}
}
function Set-ControlValue {
param($Ctrl, [ValidateSet('Enable','Disable')][string]$Action)
$val = if ($Action -eq 'Enable') { $Ctrl.ProtectOn } else { $Ctrl.ProtectOff }
$splat = @{ $Ctrl.PrefName = $val }
Set-MpPreference @splat -ErrorAction Stop
}
# ---------------------------------------------------------------------------
# Control catalog
# ---------------------------------------------------------------------------
function Get-Controls {
$c = New-Object System.Collections.ArrayList
# --- Core real-time engine (Tamper Protection usually guards these) ---
[void]$c.Add( (New-PrefControl -Name 'Real-time Monitoring' -PrefName 'DisableRealtimeMonitoring' `
-Kind Bool -ProtectOn $false -ProtectOff $true `
-Note 'Core on-access scanning. Guarded by Tamper Protection.') )
[void]$c.Add( (New-PrefControl -Name 'Behavior Monitoring' -PrefName 'DisableBehaviorMonitoring' `
-Kind Bool -ProtectOn $false -ProtectOff $true `
-Note 'Detects malicious behaviour patterns at runtime.') )
[void]$c.Add( (New-PrefControl -Name 'Downloads/Attachment Scan (IOAV)' -PrefName 'DisableIOAVProtection' `
-Kind Bool -ProtectOn $false -ProtectOff $true `
-Note 'Scans files downloaded from the internet / email.') )
[void]$c.Add( (New-PrefControl -Name 'Script Scanning' -PrefName 'DisableScriptScanning' `
-Kind Bool -ProtectOn $false -ProtectOff $true `
-Note 'Scans scripts before they run.') )
# --- Scan surface ---
[void]$c.Add( (New-PrefControl -Name 'Archive Scanning' -PrefName 'DisableArchiveScanning' `
-Kind Bool -ProtectOn $false -ProtectOff $true `
-Note 'Scans inside .zip/.rar/etc during scans.') )
[void]$c.Add( (New-PrefControl -Name 'Email Scanning' -PrefName 'DisableEmailScanning' `
-Kind Bool -ProtectOn $false -ProtectOff $true `
-Note 'Parses mailbox/email files during scans.') )
[void]$c.Add( (New-PrefControl -Name 'Removable Drive Scanning' -PrefName 'DisableRemovableDriveScanning' `
-Kind Bool -ProtectOn $false -ProtectOff $true `
-Note 'Includes USB/removable media in full scans.') )
# --- Cloud protection ---
[void]$c.Add( (New-PrefControl -Name 'Cloud-delivered Protection (MAPS)' -PrefName 'MAPSReporting' `
-Kind Enum -ProtectOn 2 -ProtectOff 0 `
-Map @{ 0='Disabled'; 1='Basic'; 2='Advanced' } `
-Note 'Real-time cloud lookups. Recommended: Advanced.') )
[void]$c.Add( (New-PrefControl -Name 'Automatic Sample Submission' -PrefName 'SubmitSamplesConsent' `
-Kind Enum -ProtectOn 1 -ProtectOff 2 `
-Map @{ 0='AlwaysPrompt'; 1='SendSafeSamples'; 2='NeverSend'; 3='SendAllSamples' } `
-PrivacyTradeoff `
-Note 'Needed for full cloud protection; sends files to Microsoft. 2=Never for privacy.') )
[void]$c.Add( (New-PrefControl -Name 'Cloud Block Level' -PrefName 'CloudBlockLevel' `
-Kind Enum -ProtectOn 2 -ProtectOff 0 `
-Map @{ 0='Default'; 1='Moderate'; 2='High'; 4='HighPlus'; 6='ZeroTolerance' } `
-Note 'How aggressively cloud blocks suspicious files. Higher = safer, more false positives.') )
# --- Advanced protections ---
[void]$c.Add( (New-PrefControl -Name 'PUA Protection' -PrefName 'PUAProtection' `
-Kind Enum -ProtectOn 1 -ProtectOff 0 `
-Map @{ 0='Disabled'; 1='Enabled'; 2='AuditMode' } `
-Note 'Blocks potentially unwanted apps (adware, bundleware).') )
[void]$c.Add( (New-PrefControl -Name 'Network Protection' -PrefName 'EnableNetworkProtection' `
-Kind Enum -ProtectOn 1 -ProtectOff 0 `
-Map @{ 0='Disabled'; 1='Enabled'; 2='AuditMode' } `
-Note 'Blocks connections to malicious domains/IPs (SmartScreen for any app).') )
[void]$c.Add( (New-PrefControl -Name 'Controlled Folder Access' -PrefName 'EnableControlledFolderAccess' `
-Kind Enum -ProtectOn 1 -ProtectOff 0 `
-Map @{ 0='Disabled'; 1='Enabled'; 2='AuditMode' } `
-Note 'Anti-ransomware: blocks untrusted apps writing to protected folders. May need app allow-listing.') )
return $c
}
# ---------------------------------------------------------------------------
# Display: health summary
# ---------------------------------------------------------------------------
function Format-Bool {
param([bool]$Value, [bool]$GoodIsTrue = $true)
if ($Value) { return 'Yes' } else { return 'No' }
}
# Safe property read - property names on MpComputerStatus vary by Windows build,
# and Set-StrictMode makes a missing property throw. Try each candidate name.
function Get-Prop {
param($Obj, [string[]]$Names, $Default = $null)
foreach ($n in $Names) {
if ($Obj.PSObject.Properties.Match($n).Count -gt 0) {
$v = $Obj.$n
if ($null -ne $v) { return $v }
}
}
return $Default
}
function Show-Health {
$s = Get-MpStatus
Write-Host ''
Write-Host '==================================================================' -ForegroundColor Cyan
Write-Host ' Microsoft Defender Antivirus - Health' -ForegroundColor Cyan
Write-Host (' Host: {0} Admin: {1} {2}' -f $env:COMPUTERNAME, $Script:IsAdmin, (Get-Date)) -ForegroundColor DarkCyan
Write-Host '==================================================================' -ForegroundColor Cyan
function Line {
param([string]$Label, $Value, [string]$Color = 'Gray')
Write-Host (' {0,-32}' -f $Label) -NoNewline
Write-Host $Value -ForegroundColor $Color
}
# Running mode (Normal / Passive / EDR Block / etc.)
$mode = Get-Prop $s @('AMRunningMode') 'Unknown'
$modeColor = if ($mode -eq 'Normal') { 'Green' } else { 'Yellow' }
Line 'Running mode' $mode $modeColor
if ($mode -ne 'Normal' -and $mode -ne 'Unknown') {
Write-Host ' (Passive/other mode: another AV may be primary; some settings inactive)' -ForegroundColor DarkYellow
}
Line 'AntiMalware service' (Format-Bool $s.AMServiceEnabled) ($(if ($s.AMServiceEnabled) {'Green'} else {'Red'}))
Line 'Real-time protection' (Format-Bool $s.RealTimeProtectionEnabled) ($(if ($s.RealTimeProtectionEnabled) {'Green'} else {'Red'}))
Line 'Behavior monitor' (Format-Bool $s.BehaviorMonitorEnabled) ($(if ($s.BehaviorMonitorEnabled) {'Green'} else {'Yellow'}))
Line 'On-access (IOAV) protection' (Format-Bool $s.IoavProtectionEnabled) ($(if ($s.IoavProtectionEnabled) {'Green'} else {'Yellow'}))
Line 'Network inspection (NIS)' (Format-Bool $s.NISEnabled) ($(if ($s.NISEnabled) {'Green'} else {'Yellow'}))
Line 'Tamper Protection' (Format-Bool $s.IsTamperProtected) ($(if ($s.IsTamperProtected) {'Green'} else {'Yellow'}))
# Signature freshness
$age = [int](Get-Prop $s @('AntivirusSignatureAge') 0)
$ageColor = if ($age -le 2) { 'Green' } elseif ($age -le 7) { 'Yellow' } else { 'Red' }
Line 'Signature version' (Get-Prop $s @('AntivirusSignatureVersion') 'n/a') 'Gray'
Line 'Signature age (days)' $age $ageColor
Line 'Engine version' (Get-Prop $s @('AMEngineVersion') 'n/a') 'Gray'
# Last scans (property names differ across builds)
$lastQuick = Get-Prop $s @('QuickScanEndTime','LastQuickScanEndTime') 'never'
$lastFull = Get-Prop $s @('FullScanEndTime','LastFullScanEndTime') 'never'
Line 'Last quick scan' $lastQuick 'Gray'
Line 'Last full scan' $lastFull 'Gray'
}
# ---------------------------------------------------------------------------
# Display: configurable protections
# ---------------------------------------------------------------------------
function Get-StateColor {
param([string]$State)
if ($State -like 'On*') { return 'Green' }
if ($State -like 'Off*') { return 'Red' }
if ($State -like 'Other*') { return 'Yellow' } # audit mode etc.
return 'DarkGray'
}
function Show-Controls {
param($Controls)
Write-Host ''
Write-Host ' Configurable protections (On = protected / recommended)' -ForegroundColor White
Write-Host (' {0,-3}{1,-36}{2}' -f '#', 'Protection', 'State') -ForegroundColor White
Write-Host (' {0,-3}{1,-36}{2}' -f '---', '----------', '-----') -ForegroundColor DarkGray
$i = 0
$nOff = 0
foreach ($ctrl in $Controls) {
$i++
$state = Get-ControlState -Ctrl $ctrl
if ($state -like 'Off*') { $nOff++ }
$tag = ''
if ($ctrl.PrivacyTradeoff) { $tag = ' [PRIV]' }
$lock = ''
if ($ctrl.AdminReq -and -not $Script:IsAdmin) { $lock = ' *' }
Write-Host (' {0,-3}{1,-36}' -f $i, ($ctrl.Name + $tag)) -NoNewline
Write-Host ($state + $lock) -ForegroundColor (Get-StateColor $state)
}
Write-Host (' {0,-3}{1,-36}{2}' -f '---', '----------', '-----') -ForegroundColor DarkGray
if ($nOff -gt 0) {
Write-Host (' WARNING: {0} protection(s) are currently OFF (reduced security)' -f $nOff) -ForegroundColor Red
} else {
Write-Host ' All listed protections are ON.' -ForegroundColor Green
}
Write-Host ' [PRIV] = also sends data to Microsoft (privacy tradeoff)' -ForegroundColor DarkCyan
if (-not $Script:IsAdmin) {
Write-Host ' * requires Administrator to change (run elevated)' -ForegroundColor DarkYellow
}
if ((Get-MpStatus).IsTamperProtected) {
Write-Host ' NOTE: Tamper Protection is ON - changes to core items may be blocked.' -ForegroundColor DarkYellow
}
Write-Host ''
}
function Show-Status {
param($Controls)
Show-Health
Show-Controls -Controls $Controls
}
function Export-StatusCsv {
param($Controls, [string]$Path)
$s = Get-MpStatus
$rows = New-Object System.Collections.ArrayList
# Health rows
[void]$rows.Add([pscustomobject]@{ Group='Health'; Name='RealTimeProtection'; State=$s.RealTimeProtectionEnabled; Note='' })
[void]$rows.Add([pscustomobject]@{ Group='Health'; Name='TamperProtection'; State=$s.IsTamperProtected; Note='' })
[void]$rows.Add([pscustomobject]@{ Group='Health'; Name='SignatureAgeDays'; State=[int](Get-Prop $s @('AntivirusSignatureAge') 0); Note=(Get-Prop $s @('AntivirusSignatureVersion') 'n/a') })
# Config rows
foreach ($ctrl in $Controls) {
[void]$rows.Add([pscustomobject]@{
Group = 'Protection'
Name = $ctrl.Name
State = (Get-ControlState -Ctrl $ctrl)
Note = $ctrl.Note
})
}
$rows | Export-Csv -Path $Path -NoTypeInformation -Encoding ASCII
Write-Host ("Status written to {0}" -f $Path) -ForegroundColor Green
}
# ---------------------------------------------------------------------------
# Apply helpers
# ---------------------------------------------------------------------------
function Invoke-ControlAction {
param($Ctrl, [ValidateSet('Enable','Disable')][string]$Action)
if ($Ctrl.AdminReq -and -not $Script:IsAdmin) {
Write-Host (" SKIP {0} (needs Administrator)" -f $Ctrl.Name) -ForegroundColor DarkYellow
return
}
try {
Set-ControlValue -Ctrl $Ctrl -Action $Action
Reset-MpCache
$new = Get-ControlState -Ctrl $Ctrl
Write-Host (" OK {0} -> {1}" -f $Ctrl.Name, $new) -ForegroundColor Green
} catch {
Write-Host (" FAIL {0}: {1}" -f $Ctrl.Name, $_.Exception.Message) -ForegroundColor Red
Write-Host ' (If Tamper Protection is on, this change is blocked by design.)' -ForegroundColor DarkYellow
}
}
function Invoke-EnableRecommended {
param($Controls)
Write-Host ''
Write-Host 'Setting all protections to recommended (ON)...' -ForegroundColor Cyan
foreach ($ctrl in $Controls) {
$state = Get-ControlState -Ctrl $ctrl
if ($state -like 'On*') {
Write-Host (" -- {0} already On" -f $ctrl.Name) -ForegroundColor DarkGray
continue
}
Invoke-ControlAction -Ctrl $ctrl -Action Enable
}
Write-Host ''
}
function Invoke-DisableAll {
param($Controls)
Write-Host ''
Write-Host 'Disabling ALL Defender protections (REDUCES SECURITY)...' -ForegroundColor Red
foreach ($ctrl in $Controls) {
$state = Get-ControlState -Ctrl $ctrl
if ($state -like 'Off*') {
Write-Host (" -- {0} already Off" -f $ctrl.Name) -ForegroundColor DarkGray
continue
}
Invoke-ControlAction -Ctrl $ctrl -Action Disable
}
Write-Host ''
if ((Get-MpStatus).IsTamperProtected) {
Write-Host 'Note: core items stay ON while Tamper Protection is enabled - turn it' -ForegroundColor DarkYellow
Write-Host ' off in the Windows Security app first if you need them off too.' -ForegroundColor DarkYellow
}
Write-Host 'This also stops Defender cloud lookups and sample submission to Microsoft.' -ForegroundColor DarkCyan
Write-Host ''
}
# ---------------------------------------------------------------------------
# Actions: update / scan / threats / exclusions
# ---------------------------------------------------------------------------
function Invoke-Update {
if (-not $Script:IsAdmin) { Write-Host 'Signature update requires Administrator.' -ForegroundColor DarkYellow; return }
Write-Host 'Updating Defender signatures...' -ForegroundColor Cyan
try {
Update-MpSignature -ErrorAction Stop
Reset-MpCache
$s = Get-MpStatus
Write-Host ('Done. Signature version {0} (age {1} day(s)).' -f $s.AntivirusSignatureVersion, [int]$s.AntivirusSignatureAge) -ForegroundColor Green
} catch {
Write-Host ('Update failed: {0}' -f $_.Exception.Message) -ForegroundColor Red
}
}
function Invoke-Scan {
param([ValidateSet('Quick','Full')][string]$Kind)
if (-not $Script:IsAdmin) { Write-Host 'Scanning requires Administrator.' -ForegroundColor DarkYellow; return }
Write-Host ("Starting {0} scan (this may take a while)..." -f $Kind) -ForegroundColor Cyan
try {
Start-MpScan -ScanType ($Kind + 'Scan') -ErrorAction Stop
Reset-MpCache
Write-Host 'Scan complete.' -ForegroundColor Green
} catch {
Write-Host ('Scan failed: {0}' -f $_.Exception.Message) -ForegroundColor Red
}
}
function Show-Threats {
Write-Host ''
Write-Host 'Recent threat detections:' -ForegroundColor White
try {
$threats = @(Get-MpThreatDetection -ErrorAction Stop | Sort-Object InitialDetectionTime -Descending | Select-Object -First 15)
if ($threats.Count -eq 0) {
Write-Host ' None recorded.' -ForegroundColor Green
} else {
foreach ($t in $threats) {
$name = try { (Get-MpThreat -ThreatID $t.ThreatID -ErrorAction SilentlyContinue).ThreatName } catch { $t.ThreatID }
if (-not $name) { $name = $t.ThreatID }
Write-Host (' {0} {1} (action: {2})' -f $t.InitialDetectionTime, $name, $t.ThreatStatusID) -ForegroundColor Yellow
}
}
} catch {
Write-Host (' Could not read threat history: {0}' -f $_.Exception.Message) -ForegroundColor Red
}
Write-Host ''
}
function Show-Exclusions {
$mp = Get-MpPref
Write-Host ''
Write-Host 'Configured exclusions (attack surface - review carefully):' -ForegroundColor White
function Dump {
param([string]$Label, $Items)
$arr = @($Items)
if ($arr.Count -eq 0) { Write-Host (' {0}: none' -f $Label) -ForegroundColor DarkGray; return }
Write-Host (' {0}:' -f $Label) -ForegroundColor Yellow
foreach ($x in $arr) { Write-Host (' {0}' -f $x) -ForegroundColor Gray }
}
Dump 'Paths' $mp.ExclusionPath
Dump 'Extensions' $mp.ExclusionExtension
Dump 'Processes' $mp.ExclusionProcess
Write-Host ''
}
# ---------------------------------------------------------------------------
# Interactive menu
# ---------------------------------------------------------------------------
function Start-Menu {
param($Controls)
while ($true) {
Reset-MpCache
Show-Status -Controls $Controls
Write-Host 'Commands:' -ForegroundColor White
Write-Host ' <n> toggle protection n (On<->Off)'
Write-Host ' e <n> enable (protect) item n'
Write-Host ' d <n> disable item n (REDUCES security)'
Write-Host ' E enable ALL recommended protections'
Write-Host ' D disable ALL protections (reduces security)'
Write-Host ' u update signatures'
Write-Host ' s run quick scan'
Write-Host ' f run full scan'
Write-Host ' t show recent threat detections'
Write-Host ' x show exclusions'
Write-Host ' r refresh view'
Write-Host ' c <path> export status to CSV'
Write-Host ' q quit'
Write-Host ''
$inp = Read-Host 'Select'
if ([string]::IsNullOrWhiteSpace($inp)) { continue }
$inp = $inp.Trim()
switch -Regex -CaseSensitive ($inp) {
'^[Qq]$' { return }
'^[Rr]$' { continue }
'^E$' {
Invoke-EnableRecommended -Controls $Controls
Read-Host 'Press Enter'; continue
}
'^D$' {
Write-Host ''
Write-Host 'WARNING: This disables ALL Defender protections listed above.' -ForegroundColor Red
Write-Host 'The system will be left without Defender antivirus coverage.' -ForegroundColor Red
if ((Read-Host 'Proceed? type DISABLE-ALL') -ceq 'DISABLE-ALL') {
Invoke-DisableAll -Controls $Controls
}
Read-Host 'Press Enter'; continue
}
'^[Uu]$' { Invoke-Update; Read-Host 'Press Enter'; continue }
'^[Ss]$' { Invoke-Scan -Kind Quick; Read-Host 'Press Enter'; continue }
'^[Ff]$' { Invoke-Scan -Kind Full; Read-Host 'Press Enter'; continue }
'^[Tt]$' { Show-Threats; Read-Host 'Press Enter'; continue }
'^[Xx]$' { Show-Exclusions; Read-Host 'Press Enter'; continue }
'^[Cc]\s+(.+)$' {
Export-StatusCsv -Controls $Controls -Path $Matches[1].Trim('"')
Read-Host 'Press Enter'; continue
}
'^[Ee]\s+(\d+)$' {
$n = [int]$Matches[1]
if ($n -ge 1 -and $n -le $Controls.Count) { Invoke-ControlAction -Ctrl $Controls[$n-1] -Action Enable }
else { Write-Host 'Out of range' -ForegroundColor Red }
Read-Host 'Press Enter'; continue
}
'^[Dd]\s+(\d+)$' {
$n = [int]$Matches[1]
if ($n -ge 1 -and $n -le $Controls.Count) {
$ctrl = $Controls[$n-1]
Write-Host ''
Write-Host ('WARNING: Disabling "{0}" reduces protection.' -f $ctrl.Name) -ForegroundColor Red
if ((Read-Host 'Proceed? type YES') -ceq 'YES') {
Invoke-ControlAction -Ctrl $ctrl -Action Disable
}
} else { Write-Host 'Out of range' -ForegroundColor Red }
Read-Host 'Press Enter'; continue
}
'^\d+$' {
$n = [int]$inp
if ($n -ge 1 -and $n -le $Controls.Count) {
$ctrl = $Controls[$n-1]
$state = Get-ControlState -Ctrl $ctrl
if ($state -like 'On*') {
Write-Host ''
Write-Host ('WARNING: Disabling "{0}" reduces protection.' -f $ctrl.Name) -ForegroundColor Red
if ((Read-Host 'Proceed? type YES') -ceq 'YES') {
Invoke-ControlAction -Ctrl $ctrl -Action Disable
}
} else {
Invoke-ControlAction -Ctrl $ctrl -Action Enable
}
} else { Write-Host 'Out of range' -ForegroundColor Red }
Read-Host 'Press Enter'; continue
}
default { Write-Host 'Unknown command' -ForegroundColor Red; Start-Sleep -Milliseconds 600 }
}
}
}
# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------
$controls = Get-Controls
if ($Update) { Invoke-Update; return }
if ($QuickScan) { Invoke-Scan -Kind Quick; return }
if ($FullScan) { Invoke-Scan -Kind Full; return }
if ($EnableRecommended) { Invoke-EnableRecommended -Controls $controls; Show-Status -Controls $controls; if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv }; return }
if ($DisableAll) { Invoke-DisableAll -Controls $controls; Show-Status -Controls $controls; if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv }; return }
if ($Report -or $Csv) {
if ($Report) { Show-Status -Controls $controls }
if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv }
return
}
if (-not $Script:IsAdmin) {
Write-Host ''
Write-Host 'NOTE: Not running as Administrator. You can VIEW status, but changing' -ForegroundColor DarkYellow
Write-Host ' protections, updating signatures and scanning need an elevated' -ForegroundColor DarkYellow
Write-Host ' PowerShell window.' -ForegroundColor DarkYellow
}
Start-Menu -Controls $controls
Manage-WindowsTelemetry.ps1
+92 -3
View File
@@ -14,9 +14,12 @@
appraiser, Cloud Content / Tailored Experiences, Activity appraiser, Cloud Content / Tailored Experiences, Activity
History, Advertising ID, Feedback (SIUF), inking/typing and History, Advertising ID, Feedback (SIUF), inking/typing and
speech data, search suggestions, DiagTrack + related services, speech data, search suggestions, DiagTrack + related services,
telemetry scheduled tasks, and Windows SmartScreen ([SEC]: telemetry scheduled tasks, Cortana/cloud search, cloud clipboard
apps-and-files check, Store app URL check, Enhanced Phishing and settings sync, suggestions/ads (Content Delivery Manager),
Protection - excluded from bulk disable unless requested). location, Find My Device, Copilot/Recall, Delivery Optimization,
and Windows SmartScreen ([SEC]: apps-and-files check, Store app
URL check, Enhanced Phishing Protection - excluded from bulk
disable unless requested).
Notes : - Windows PowerShell 5.1 compatible. ASCII-only source. Notes : - Windows PowerShell 5.1 compatible. ASCII-only source.
- Registry (HKLM) and service changes require Administrator. - Registry (HKLM) and service changes require Administrator.
@@ -382,6 +385,92 @@ function Get-Controls {
-ValueName 'BingSearchEnabled' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable ` -ValueName 'BingSearchEnabled' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
-Note 'Win10-era value; largely ignored on Win11') ) -Note 'Win10-era value; largely ignored on Win11') )
# --- Search / Cortana cloud ---
[void]$c.Add( (New-RegControl -Name 'Cortana' -Category 'Search/Cortana' `
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' `
-ValueName 'AllowCortana' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable) )
[void]$c.Add( (New-RegControl -Name 'Search Web Results (Cloud)' -Category 'Search/Cortana' `
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' `
-ValueName 'ConnectedSearchUseWeb' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
-Note 'Bing web results in Start/Search') )
[void]$c.Add( (New-RegControl -Name 'Cloud Content Search' -Category 'Search/Cortana' `
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' `
-ValueName 'AllowCloudSearch' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
-Note 'Search of OneDrive/Outlook/SharePoint content') )
[void]$c.Add( (New-RegControl -Name 'Search Uses Location' -Category 'Search/Cortana' `
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' `
-ValueName 'AllowSearchToUseLocation' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable) )
# --- Cloud sync (clipboard / settings) ---
[void]$c.Add( (New-RegControl -Name 'Clipboard History' -Category 'Cloud Sync' `
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\System' `
-ValueName 'AllowClipboardHistory' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
-Note 'Local clipboard history (Win+V)') )
[void]$c.Add( (New-RegControl -Name 'Cross-Device Clipboard (Cloud)' -Category 'Cloud Sync' `
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\System' `
-ValueName 'AllowCrossDeviceClipboard' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
-Note 'Syncs clipboard contents to Microsoft cloud') )
[void]$c.Add( (New-RegControl -Name 'Settings Sync' -Category 'Cloud Sync' `
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\SettingSync' `
-ValueName 'DisableSettingSync' -OnValue 0 -OffValue 2 -Default On -RemoveOnEnable `
-Note 'Syncs Windows settings across devices via MS account') )
# --- Suggestions / ads (Content Delivery Manager, per-user) ---
[void]$c.Add( (New-RegControl -Name 'Auto-install Suggested Apps' -Category 'Suggestions/Ads' `
-Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' `
-ValueName 'SilentInstalledAppsEnabled' -OnValue 1 -OffValue 0 -Default On) )
[void]$c.Add( (New-RegControl -Name 'Start Menu Suggestions' -Category 'Suggestions/Ads' `
-Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' `
-ValueName 'SystemPaneSuggestionsEnabled' -OnValue 1 -OffValue 0 -Default On) )
[void]$c.Add( (New-RegControl -Name 'Settings App Suggestions' -Category 'Suggestions/Ads' `
-Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' `
-ValueName 'SubscribedContent-338393Enabled' -OnValue 1 -OffValue 0 -Default On) )
[void]$c.Add( (New-RegControl -Name 'Tips and Notifications' -Category 'Suggestions/Ads' `
-Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' `
-ValueName 'SubscribedContent-338389Enabled' -OnValue 1 -OffValue 0 -Default On `
-Note 'Windows tips/suggestion notifications') )
[void]$c.Add( (New-RegControl -Name 'Lock Screen Spotlight' -Category 'Suggestions/Ads' `
-Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' `
-ValueName 'RotatingLockScreenOverlayEnabled' -OnValue 1 -OffValue 0 -Default On `
-Note 'Spotlight ads/facts on the lock screen') )
# --- Location ---
[void]$c.Add( (New-RegControl -Name 'Location Platform' -Category 'Location' `
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors' `
-ValueName 'DisableLocation' -OnValue 0 -OffValue 1 -Default On -RemoveOnEnable `
-Note 'System-wide location services') )
# --- Find My Device ---
[void]$c.Add( (New-RegControl -Name 'Find My Device' -Category 'Find My Device' `
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\FindMyDevice' `
-ValueName 'AllowFindMyDevice' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
-Note 'Periodic location reporting to your MS account') )
# --- AI features (Copilot / Recall) ---
[void]$c.Add( (New-RegControl -Name 'Windows Copilot' -Category 'AI' `
-Hive HKCU -Path 'SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot' `
-ValueName 'TurnOffWindowsCopilot' -OnValue 0 -OffValue 1 -Default On -RemoveOnEnable) )
[void]$c.Add( (New-RegControl -Name 'Recall (AI Data Analysis)' -Category 'AI' `
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\WindowsAI' `
-ValueName 'DisableAIDataAnalysis' -OnValue 0 -OffValue 1 -Default On -RemoveOnEnable `
-Note 'Recall screen snapshots (Copilot+ PCs)') )
# --- Delivery Optimization (update peer sharing) ---
[void]$c.Add( (New-RegControl -Name 'Delivery Optimization P2P' -Category 'Network' `
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization' `
-ValueName 'DODownloadMode' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
-Note '0=HTTP only (no peers) 1=LAN 3=Internet peers') )
# --- Windows SmartScreen: OS-level URL/file reputation (SECURITY) --- # --- Windows SmartScreen: OS-level URL/file reputation (SECURITY) ---
# These check apps, files and URLs against Microsoft's cloud reputation # These check apps, files and URLs against Microsoft's cloud reputation
# service. Disabling them REDUCES protection against malware/phishing. # service. Disabling them REDUCES protection against malware/phishing.
README.md
+210 -7
View File
@@ -6,11 +6,23 @@ Two single-file, dependency-free PowerShell 5.1 scripts:
|---|---| |---|---|
| `Manage-WindowsTelemetry.ps1` | Windows 11 telemetry / diagnostic-data settings, services and scheduled tasks | | `Manage-WindowsTelemetry.ps1` | Windows 11 telemetry / diagnostic-data settings, services and scheduled tasks |
| `Manage-BrowserPrivacy.ps1` | Privacy / telemetry policies for Edge, Chrome, Firefox and Brave | | `Manage-BrowserPrivacy.ps1` | Privacy / telemetry policies for Edge, Chrome, Firefox and Brave |
| `Manage-DefenderAntivirus.ps1` | Microsoft Defender Antivirus health, protection settings, scans and updates |
Both share the same UX: a color-coded status view (**Enabled** = collecting, All three share the same UX: a color-coded status view, interactive per-item
**Disabled** = hardened), interactive per-item toggling, one-shot toggling, `-Report`, and CSV export. They are ASCII-only, BOM-free, and run
`-DisableAll` / `-EnableAll`, `-Report`, and CSV export. Both are ASCII-only, in stock `powershell.exe` on Windows 11.
BOM-free, module-free, and run in stock `powershell.exe` on Windows 11.
**Intended audience:** this is a privacy-enabling / telemetry-disabling
toolkit for **advanced users and administrators** who understand the
tradeoffs. It is **not** aimed at general users and it deliberately exposes
switches that reduce data sharing *and* switches that reduce security
protection. Know what each item does before you flip it.
**Important difference in orientation:** in the telemetry and browser tools,
**Disabled = hardened** (you turn data collection *off*). In the Defender
tool the polarity is **reversed** - **On/Enabled = protected/recommended**,
and turning a protection *off* reduces security. Each tool's status view is
labelled accordingly.
> **Disclaimer - USE AT YOUR OWN RISK.** These scripts modify registry > **Disclaimer - USE AT YOUR OWN RISK.** These scripts modify registry
> values, service startup types and scheduled tasks. They are provided as-is, > values, service startup types and scheduled tasks. They are provided as-is,
@@ -26,11 +38,11 @@ Read this before running either script with `-DisableAll` or the menu
| Risk | Detail | Mitigation | | Risk | Detail | Mitigation |
|---|---|---| |---|---|---|
| **Reduced malware/phishing protection** | Disabling the `[SEC]` items (Windows SmartScreen, Edge SmartScreen, Chrome/Brave Safe Browsing) removes URL, download and app reputation warnings. This is a genuine security downgrade. | `[SEC]` items are excluded from bulk disable by default; only disable them deliberately, and only if other filtering (DNS/proxy/EDR) covers the gap. | | **Reduced malware/phishing protection** | Disabling the `[SEC]` items (Windows SmartScreen, Edge SmartScreen, Chrome/Brave Safe Browsing) removes URL, download and app reputation warnings. Likewise the **Defender** tool's `-DisableAll` / menu `D` turns off real-time monitoring, cloud protection, network protection and controlled folder access - a direct antivirus downgrade that leaves the machine without Defender coverage. | Browser `[SEC]` items are excluded from bulk disable by default; the Defender bulk disable requires an explicit switch/confirmation. Only disable deliberately, and only if other controls (DNS/proxy/EDR) cover the gap. |
| **Managed / corporate machines** | On a domain-joined or Intune/MDM-managed device, these settings may be owned by your organisation. Changing them can conflict with GPO/MDM (which will usually re-apply), break compliance posture, or violate your IT policy. | Only run on machines you own or are authorised to change. Expect GPO/MDM to win any conflict. | | **Managed / corporate machines** | On a domain-joined or Intune/MDM-managed device, these settings may be owned by your organisation. Changing them can conflict with GPO/MDM (which will usually re-apply), break compliance posture, or violate your IT policy. | Only run on machines you own or are authorised to change. Expect GPO/MDM to win any conflict. |
| **MDM / provisioning breakage** | Disabling `dmwappushservice` can break provisioning-package installation (`Add-ProvisioningPackage`) and some MDM enrolment flows. | Skip that item (or re-enable it) on devices that will be enrolled. | | **MDM / provisioning breakage** | Disabling `dmwappushservice` can break provisioning-package installation (`Add-ProvisioningPackage`) and some MDM enrolment flows. | Skip that item (or re-enable it) on devices that will be enrolled. |
| **Lost crash reporting** | Disabling Windows Error Reporting stops crash reports to Microsoft, and WER-based *local* workflows too (e.g. LocalDumps collection for debugging). | Re-enable WER while troubleshooting crashes. | | **Lost crash reporting** | Disabling Windows Error Reporting stops crash reports to Microsoft, and WER-based *local* workflows too (e.g. LocalDumps collection for debugging). | Re-enable WER while troubleshooting crashes. |
| **Feature loss** | Some features depend on the data flows being disabled: Find My Device, Windows Insider Program (requires Optional diagnostic data), inking/typing personalisation, cross-device Timeline/resume, cloud speech recognition, live search suggestions. | Review the per-setting tables below and keep the items you use enabled. | | **Feature loss** | Some features depend on the data flows being disabled: Find My Device, Windows Insider Program (requires Optional diagnostic data), inking/typing personalisation, cross-device Timeline/resume, cloud speech recognition, live search suggestions, Cortana, cross-device clipboard paste, settings sync across devices, location-aware apps (maps/weather/timezone), Windows Copilot and Recall. | Review the per-setting tables below and keep the items you use enabled. |
| **"Managed by your organization" notices** | While hardened, Windows Settings and browser settings pages show a managed/policy notice. This is expected policy behaviour, not malware - but it can alarm users and support desks. | `-EnableAll` removes all values written by the tools and clears the notice. | | **"Managed by your organization" notices** | While hardened, Windows Settings and browser settings pages show a managed/policy notice. This is expected policy behaviour, not malware - but it can alarm users and support desks. | `-EnableAll` removes all values written by the tools and clears the notice. |
| **Updates can revert changes** | Windows feature updates, cumulative updates and browser updates can re-enable items or re-create scheduled tasks. | Re-run `-Report` after major updates; re-apply as needed. | | **Updates can revert changes** | Windows feature updates, cumulative updates and browser updates can re-enable items or re-create scheduled tasks. | Re-run `-Report` after major updates; re-apply as needed. |
| **Upgrade readiness data** | Disabling the Compatibility Appraiser stops the inventory Microsoft uses to assess upgrade compatibility for your device. | Low impact for most; re-enable before a major feature upgrade if you want Microsoft's compatibility safeguards. | | **Upgrade readiness data** | Disabling the Compatibility Appraiser stops the inventory Microsoft uses to assess upgrade compatibility for your device. | Low impact for most; re-enable before a major feature upgrade if you want Microsoft's compatibility safeguards. |
@@ -205,6 +217,64 @@ Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\System`
| `HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer` -> `DisableSearchBoxSuggestions` | `1` | Removes Bing web search/suggestions from the Start menu and taskbar Search on Windows 11 - queries stay local. | | `HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer` -> `DisableSearchBoxSuggestions` | `1` | Removes Bing web search/suggestions from the Start menu and taskbar Search on Windows 11 - queries stay local. |
| `HKCU\...\CurrentVersion\Search` -> `BingSearchEnabled` | `0` | The Windows 10-era equivalent of the above; largely ignored by Windows 11 but kept for completeness. | | `HKCU\...\CurrentVersion\Search` -> `BingSearchEnabled` | `0` | The Windows 10-era equivalent of the above; largely ignored by Windows 11 but kept for completeness. |
#### Search / Cortana cloud
Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search`
| Value | Hardened | Explanation |
|---|---|---|
| `AllowCortana` | `0` | Disables Cortana, which sends voice/text queries and context to Microsoft. |
| `ConnectedSearchUseWeb` | `0` | Stops Start/Search sending typed queries to Bing for web results. |
| `AllowCloudSearch` | `0` | Disables searching your OneDrive/Outlook/SharePoint content from the local search box (each query hits Microsoft cloud). |
| `AllowSearchToUseLocation` | `0` | Stops the search/Cortana stack using your device location. |
#### Cloud sync (clipboard / settings)
Keys: `HKLM\SOFTWARE\Policies\Microsoft\Windows\System` and `...\SettingSync`
| Value | Hardened | Explanation |
|---|---|---|
| `AllowClipboardHistory` | `0` | Disables local clipboard history (Win+V). Local only, but a data-retention surface. |
| `AllowCrossDeviceClipboard` | `0` | Disables syncing clipboard **contents** to the Microsoft cloud for cross-device paste - potentially very sensitive data. |
| `DisableSettingSync` (SettingSync key) | `2` | Stops Windows settings/credentials/preferences syncing across devices via your Microsoft account. |
#### Suggestions / ads (Content Delivery Manager - per-user, HKCU)
Key: `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager`
| Value | Hardened | Explanation |
|---|---|---|
| `SilentInstalledAppsEnabled` | `0` | Stops Windows silently installing sponsored/suggested apps. |
| `SystemPaneSuggestionsEnabled` | `0` | Removes app/content suggestions in the Start menu. |
| `SubscribedContent-338393Enabled` | `0` | Removes suggested content in the Settings app. |
| `SubscribedContent-338389Enabled` | `0` | Disables Windows tips/suggestion notifications. |
| `RotatingLockScreenOverlayEnabled` | `0` | Disables Spotlight ads/"fun facts" overlaid on the lock screen. |
#### Location
Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors`
| Value | Hardened | Explanation |
|---|---|---|
| `DisableLocation` | `1` | Turns off the system-wide location platform for all apps and services. |
#### Find My Device
Key: `HKLM\SOFTWARE\Policies\Microsoft\FindMyDevice`
| Value | Hardened | Explanation |
|---|---|---|
| `AllowFindMyDevice` | `0` | Stops Windows periodically reporting device location to your Microsoft account. |
#### AI features (Copilot / Recall)
| Key / Value | Hardened | Explanation |
|---|---|---|
| `HKCU\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot` -> `TurnOffWindowsCopilot` | `1` | Disables the Windows Copilot assistant (prompts and context leave the device to Microsoft/OpenAI services). |
| `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI` -> `DisableAIDataAnalysis` | `1` | Disables **Recall** screen-snapshot capture and analysis. Local-first, but a large capture surface; only present on Copilot+ PCs (24H2+). |
#### Network
Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization`
| Value | Hardened | Explanation |
|---|---|---|
| `DODownloadMode` | `0` | Delivery Optimization peer sharing: `0` = HTTP only (no peers), `1` = LAN peers, `3` = internet peers. Hardened = your PC neither pulls from nor advertises update chunks to other machines. |
#### Windows SmartScreen `[SEC]` - reputation checks #### Windows SmartScreen `[SEC]` - reputation checks
| Key / Value | Hardened | Explanation | | Key / Value | Hardened | Explanation |
@@ -423,13 +493,146 @@ such in the `Name` column).
--- ---
# 3. Manage-DefenderAntivirus.ps1
Views the **health of Microsoft Defender Antivirus** and lets you view/toggle
its protection settings, plus run common actions (update signatures,
quick/full scan, view threats and exclusions).
Unlike the other two tools this is a **security** tool, so the polarity is
reversed: **On = protected (good, green)**, **Off = reduced protection (red)**.
It uses the built-in Defender PowerShell module (`Get-MpComputerStatus`,
`Get-MpPreference`, `Set-MpPreference`, `Update-MpSignature`, `Start-MpScan`)
- **not** the registry, because Tamper Protection and policy layering make
direct registry edits to Defender unreliable.
## Quick start
```powershell
# View health + protection status (read-only, works as standard user)
.\Manage-DefenderAntivirus.ps1 -Report
# Interactive menu (run ELEVATED to change settings, scan or update)
.\Manage-DefenderAntivirus.ps1
# Set every protection to its recommended (ON) state
.\Manage-DefenderAntivirus.ps1 -EnableRecommended
# Turn ALL protections OFF (reduces security; also stops Defender cloud
# lookups and sample submission to Microsoft)
.\Manage-DefenderAntivirus.ps1 -DisableAll
# Update signatures / run a scan and exit
.\Manage-DefenderAntivirus.ps1 -Update
.\Manage-DefenderAntivirus.ps1 -QuickScan
.\Manage-DefenderAntivirus.ps1 -FullScan
# Export health + config to CSV
.\Manage-DefenderAntivirus.ps1 -Csv .\defender-status.csv
```
## Tamper Protection
On Windows 11, **Tamper Protection** is on by default and deliberately
**blocks programmatic changes** to core protection (real-time monitoring,
etc.). When it is on, `Set-MpPreference` calls for those items will fail -
the tool detects this, shows a NOTE, and reports the failure clearly rather
than pretending the change succeeded. To change guarded items you must first
turn Tamper Protection off in the **Windows Security app** (Virus & threat
protection -> Manage settings) or via Intune. The tool intentionally cannot
disable Tamper Protection for you - that is by design.
## Health summary (read-only)
From `Get-MpComputerStatus`: running mode (Normal / Passive / EDR Block -
passive means another AV is primary and Defender settings are inactive),
AntiMalware service, real-time protection, behaviour monitor, on-access
(IOAV), network inspection (NIS), Tamper Protection state, signature version
and **age in days** (green <=2, yellow <=7, red older), engine version, and
last quick/full scan times.
## Configurable protections
Each maps to one `Set-MpPreference` parameter. "Recommended" is always **On**.
| Protection | Preference | Recommended | Explanation |
|---|---|---|---|
| Real-time Monitoring | `DisableRealtimeMonitoring` | On (`$false`) | Core on-access scanning. Guarded by Tamper Protection. |
| Behavior Monitoring | `DisableBehaviorMonitoring` | On (`$false`) | Detects malicious behaviour patterns at runtime. |
| Downloads/Attachment Scan | `DisableIOAVProtection` | On (`$false`) | Scans files downloaded from internet/email. |
| Script Scanning | `DisableScriptScanning` | On (`$false`) | Scans scripts before they execute. |
| Archive Scanning | `DisableArchiveScanning` | On (`$false`) | Scans inside .zip/.rar/etc. |
| Email Scanning | `DisableEmailScanning` | On (`$false`) | Parses mailbox/email files during scans. |
| Removable Drive Scanning | `DisableRemovableDriveScanning` | On (`$false`) | Includes USB media in full scans. |
| Cloud-delivered Protection | `MAPSReporting` | Advanced (`2`) | Real-time cloud lookups (`0` off, `1` basic, `2` advanced). |
| Automatic Sample Submission `[PRIV]` | `SubmitSamplesConsent` | SendSafeSamples (`1`) | Needed for full cloud protection; **sends files to Microsoft**. `2` = Never (privacy). |
| Cloud Block Level | `CloudBlockLevel` | High (`2`) | Aggressiveness of cloud blocking; higher = safer but more false positives. |
| PUA Protection | `PUAProtection` | Enabled (`1`) | Blocks potentially unwanted apps (adware/bundleware); `2` = audit. |
| Network Protection | `EnableNetworkProtection` | Enabled (`1`) | Blocks connections to malicious domains/IPs; `2` = audit. |
| Controlled Folder Access | `EnableControlledFolderAccess` | Enabled (`1`) | Anti-ransomware; blocks untrusted apps writing to protected folders. May need app allow-listing. |
`[PRIV]` marks the one setting that improves protection but also sends data
to Microsoft, so you can make an informed choice. **Audit mode** (for PUA /
Network Protection / Controlled Folder Access) shows as `Other (AuditMode)` -
it logs but does not block, useful for testing before enforcing.
## Menu commands
| Command | Action |
|---|---|
| `<n>` | Toggle protection *n* (disabling asks for `YES` confirmation) |
| `e <n>` / `d <n>` | Enable / disable item *n* (`d` warns and confirms) |
| `E` | Enable **all** recommended protections |
| `D` | Disable **all** protections (requires typing `DISABLE-ALL`) |
| `u` | Update signatures (`Update-MpSignature`) |
| `s` / `f` | Run quick / full scan (`Start-MpScan`) |
| `t` | Show recent threat detections |
| `x` | Show configured exclusions (paths/extensions/processes) |
| `r` / `c <path>` / `q` | Refresh / export CSV / quit |
### Bulk disable
This is a privacy/telemetry-hardening toolkit for advanced users, so a bulk
disable is provided to match the other scripts:
- **CLI:** `-DisableAll` runs immediately (scriptable), then reprints status.
- **Menu:** `D` requires typing `DISABLE-ALL` to confirm.
Disabling here doubles as privacy hardening: it sets `MAPSReporting` to
Disabled and `SubmitSamplesConsent` to Never, which **stops Defender's cloud
lookups and file/sample uploads to Microsoft**. Note that with **Tamper
Protection on**, core items (real-time monitoring, etc.) stay ON regardless -
turn Tamper Protection off in the Windows Security app first if you need
those off too. Individual protections can still be re-enabled with `e <n>`
or restored wholesale with `E` / `-EnableRecommended`.
## Requirements and caveats
- Needs the built-in **Defender module**; the tool exits cleanly if the
cmdlets are absent (e.g. Defender removed, or a Server SKU without the
feature).
- Viewing works as a standard user; **changing settings, scanning and
updating require Administrator**.
- If a **third-party AV** is installed, Defender runs in **passive mode** and
most of these settings will not take effect until Defender is primary
again. The running-mode line makes this visible.
- Exclusions are shown (`x`) but not edited here - review them, as each
exclusion is a gap in coverage that malware can hide behind.
## CSV output columns
`Group (Health/Protection), Name, State, Note`
---
# Files # Files
| File | Purpose | | File | Purpose |
|---|---| |---|---|
| `Manage-WindowsTelemetry.ps1` | Windows telemetry view + control | | `Manage-WindowsTelemetry.ps1` | Windows telemetry view + control |
| `Manage-BrowserPrivacy.ps1` | Browser privacy view + hardening | | `Manage-BrowserPrivacy.ps1` | Browser privacy view + hardening |
| `Manage-DefenderAntivirus.ps1` | Defender health + protection management |
| `README.md` | This file | | `README.md` | This file |
Both CSV exports are useful for fleet auditing: run with `-Csv` on multiple All CSV exports are useful for fleet auditing: run with `-Csv` on multiple
machines and diff or aggregate the results. machines and diff or aggregate the results.