VirTool:Win32/DefenderTamperingRestore is triggering / recurring almost everyday on alot of devices

J

Jens Loncke

Hello,We've recently moved from our main AV that we used for years to microsoft defender. So we've uninstalled our main AV on all of our devices, and we pushed / enabled microsoft defender via our RMM platform and on 80% of our devices everything runs / is fine.BUT, on 20% of our devices we are getting a lot of alerts regarding : "AV: Defender VirTool:Win32/DefenderTamperingRestore" this alert has to do with a reg key : hklm\\software\\policies\\microsoft\\windows defender\\\\DisableAntiSpyware , in the alert (see picture) it's not clear to see what is causing this alert, so it's driving us cr

Continue reading...
 
Back
Top Bottom