search

amidaware / community-scripts

A curated list of powershell, python, and batch scripts for use in TacticalRMM or anywhere!
MIT License
114 stars 80 forks source link

Win_Defender_Revert script does not reset Defender to defaults #253

Open bbrendon opened 1 week ago

bbrendon commented 1 week ago

https://github.com/amidaware/community-scripts/blob/00fe75f0fe81e40ac5a992708cecfca0e339ad24/scripts/Win_Defender_Revert.ps1#L5

The script appears to be taken from huntress which only reverts huntress settings.

silversword411 commented 1 week ago

I'm guessing you're trying to reset options/preferences back to what windows does OOBE? Of course there's a bunch of HKCU sessions, and some that are HKLM settings....and you're probably not referring to just the Security panel? https://www.thewindowsclub.com/reset-windows-security-app-in-windows-10 Get-AppxPackage *Microsoft.Windows.SecHealthUI* | Reset-AppxPackage

Based on some searches I don't think Microsoft has a Defender reset script, let me know if you find one though.

I'm thinking you'd have to query every setting from a virgin install home...and manually make them the same. Then profile for pro. Then OS detect, and rewrite each setting appropriately... Then because notifications are custom HKCU reset all those values for notifications...

Whadda PITA.

bbrendon commented 1 week ago

I'm not trying to do anything. I was looking at some huntress scripts and thought to my self... "this script seems familiar!!" Searched here and one look at the script screamed "BS" :)

Off the top of my head, I think it would be very difficult to reset defender to factory defaults. I haven't tried or needed to yet.