I am trying to follow the CIS guidelines and need a group policy under

Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Configure Attack Surface Reduction Rules.

I don't even have a folder called 'Windows Defender Antivirus' just 'Windows Defender'.

Apparently this is included in the 1803 Release Admin Templates called WindowsDefender.adml.

I have added a few adml/admx files with no issues, but I assume I need to replace the old WindowsDefender.adml. Unfortunately I keep getting a 'permission denied error'. I tried to change the permissions, but I get the error 'cannot enumerate permissions'.

My central store is


I have tired to do this both from the DC and on my endpoint. I can add new templates, just not replace any old ones.

  • Did you try to delete the file instead of replacing it ? – Swisstone Jul 5 '19 at 13:35
  • I still get a permissions error. I tired changing the ownership of the file to 'Domain Admins' but I still cannot copy or delete the file – Hawke Jul 5 '19 at 13:48
  • 1
    Apparently fixed - I tired updating the permissions again after being made owner and I still got the enumeration error. However, I can now delete files.... Thanks! – Hawke Jul 5 '19 at 13:53

I used psexec on my DC and opened cmd.exe as system, this allowed me to replace all of my adml and admx files I was having issues with.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.