2

I'm looking at a default Defender configuration in Server 2016. I'm not sure how to discover what these '0' mean for the ThreatDefaultAction:

HighThreatDefaultAction                       : 0
LowThreatDefaultAction                        : 0
MAPSReporting                                 : 2
ModerateThreatDefaultAction                   : 0

I would think from the Set-MpPreference documentation that it's Quarantine, but that same bit of text references a Parameter set that starts with 'Clean', not 'Quarantine'. This explanation of ThreatIdDefaultActions doesn't even have a 0 in it's list: Add-MpPreference

1

Definitely looks like the documentation is lacking there. If you look at the example for SignatureScheduleDay it documents the mapping a lot better, which lines up exactly as the Parameter Set lists them.

Best bet would be that they map according to the "Parameter Sets." Which also maps the same as the Syntax part of the help file:

                             0   |      1     |   2    |   3   |      4      |     5    |   6   
[-HighThreatDefaultAction {Clean | Quarantine | Remove | Allow | UserDefined | NoAction | Block}]

I checked to see if an issue for this was listed in github and didn't find one. You could definitely inquire more there: https://github.com/MicrosoftDocs/windows-powershell-docs/blob/master/docset/windows/defender/set-mppreference.md

3
  • Only problem with assuming 0 means 'Clean' is that Clean is not in their list of possible options (Quarantine, Remove, Ignore)....github.com/MicrosoftDocs/windows-powershell-docs/blob/master/… Opened an Issue on Github. github.com/MicrosoftDocs/windows-powershell-docs/issues/380
    – Bob
    Oct 1 '18 at 19:29
  • @Bob look at the "Parameter Sets". Clean is definitely listed.
    – Nixphoe
    Oct 1 '18 at 20:01
  • I think you're not getting my point. I see that Clean is in the parameter set. However, the only integer map we can find for the parameter set shows that Clean is '1', not '0'. Secondly, Only Quarantine, Remove, and Ignore are listed as possible options for these ThreatDefaultAction parameters, so Clean doesnt make much sense.
    – Bob
    Oct 2 '18 at 17:12
1

All HighThreatDefaultAction, LowThreatDefaultAction, ModerateThreatDefaultAction, SevereThreatDefaultAction and UnknownThreatDefaultAction are properties of [ThreatAction] enum type. Their value specifies which automatic remediation action to take for a given level threat.

Zero value of any above property should be considered undefined as successfully performed Remove-MpPreference cmdlet sets their value to zero. Demonstration in the following example:

PS C:\WINDOWS\system32> Import-Module Defender

PS C:\WINDOWS\system32> Get-MpPreference | Select-Object -Property *DefaultAction


HighThreatDefaultAction     : 2
LowThreatDefaultAction      : 0
ModerateThreatDefaultAction : 0
SevereThreatDefaultAction   : 2
UnknownThreatDefaultAction  : 0


PS C:\WINDOWS\system32> Remove-MpPreference -Force -HighThreatDefaultAction

PS C:\WINDOWS\system32> Get-MpPreference | Select-Object -Property *DefaultAction


HighThreatDefaultAction     : 0
LowThreatDefaultAction      : 0
ModerateThreatDefaultAction : 0
SevereThreatDefaultAction   : 0
UnknownThreatDefaultAction  : 0

However, there is another vagueness in the Set-MpPreference documentation; for instance:

-HighThreatDefaultAction

Specifies which automatic remediation action to take for a high level threat. The acceptable values for this parameter are:

Quarantine
Remove
Ignore

but an attempt of Set-MpPreference -HighThreatDefaultAction Ignore leads to InvalidData error as the [ThreatAction] type enumeration does not contain name of Ignore:

PS > Import-Module Defender
PS > [Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.ThreatAction] |
    Get-EnumValue

Name                           Value
----                           -----
Clean                          1
Quarantine                     2
Remove                         3
Allow                          6
UserDefined                    8
NoAction                       9
Block                          10

Note the Get-EnumValue function comes from this my answer at CodeReview.

2
  • Interesting, since all the ThreatDefaultAction values are set at Zero, what option does that denote?
    – Nixphoe
    Oct 3 '18 at 19:22
  • This the big question! I'm going to work w/ Microsoft and try to get an answer on this. It smells like a bug in the reported state of those default actions if this many people can look at this and not determine what Defender is doing. Thanks!
    – Bob
    Oct 9 '18 at 13:39
1

Ok, got the answer from Microsoft support. 0 is the same as NULL (example of the docs here), which means to follow the default that Microsoft applies to each threat. In other words, every virus/malware/etc. has a severity and threat action (i.e. mitigation) attached. A '0' in GetMpPreference means to use that mitigation and not whatever value you might have specified here to override that universally for each severity level. Hope that helps any future travelers.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.