Thursday, November 14, 2024

[SOLVED by workaround]: Windows Server 2012 R2 + Add exclusion for Windows Defender (Microsoft Antimalware). Add-MpPreference: The term 'Add-MpPreference' is not recognized as a name of a cmdlet, function, script file, or executable program.

 So I found in EventLogs (Event Viewer -> Windows Logs -> System) following error:

"Microsoft Antimalware has detected malware or other potentially unwanted  software." (Source: Microsoft Antimalware, Event ID: 1116)

Then I decided to add one particular file to the exclusion list of Windows Defender.
Brief googling showed basic approaches how I can do it:

  • Via Domain Group Policies
  • Via Local Group Policies
  • Via Powershell (using Add-MpPreference and/or Set-MpPreference)
  • Via Registry customization 
  • UPDATE: Via Defender for Endpoint package
  • Via System Center Endpoint Protection / SCCM

On Windows Server 2012R2 I was unable to do it:

Add-MpPreference: The term 'Add-MpPreference' is not recognized as a name of a cmdlet, function, script file, or executable program.

And beside that Microsoft claims that Powershell 4.0 (which was my version of Powershell on Windows Server 2012R2) should have this functions working, it turned out that it doesn't. (I've checked it on two different systems).

What I've done - I've used Powershell's Add-MpPreference on Windows Server 2016 (I was able to launch it successfully just on Windows 2016), and then exported settings from HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' from Windows 2016, and then imported reg file into Windows 2012R2, but it did not work (there still was the same unwanted blocking behaviour of some executables).

So my solution was: to move my file (which was blocked by Windows Defender) to Windows Server 2016 and then add exclusion with Powershell by running "Add-MpPreference -ExclusionPath "C:\Program Files\XYZ".
Yes, it's quick and dirty solution, but I did not have enough time for more experiments.

For those who still want too add exclusion to Microsoft Defender exactly on Windows Server 2012R2, I could recommend to explore Group Policy method more thoroughly.
(you can also try to reboot your server after mentioned above registry changes, I was unable to test it on my production server however).

UPDATE (found on microsoft forum) :

"The Defender PowerShell module isn't available in Server 2012, but you can install it and run it in Passive mode.

Is the Defender for Endpoint package installed?"

[https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-server-endpoints?view=o365-worldwide#windows-server-2012-r2-and-windows-server-2016



No comments:

Post a Comment