Solved Issues with Windows Security Defender Antivirus

Hello,



A few days ago, I noticed that the "Cloud-delivered protection" and "Automatic sample submission" options in Defender are greyed out, with the message "This setting is managed by your administrator" displayed in red above them. Incidentally, I *am* the administrator—please see the attached image.



I have two operating systems running Windows 11; the settings are fine on the second one, but not on my primary system, and this is bothering me. I would appreciate help on how to fix this. Resetting the Defender application itself doesn't solve the issue, nor does reinstalling the system via Windows Update. I’ve already tried a few things—including using AI—but without success. It appears to be a setting that is locked in the registry.



Please help.

Are you encountering the "Some settings are managed by your organization" message on your Windows device? This video provides a detailed walk-through to help you fix this common issue.

Thanks for the reply, but this script does not resolve the issue. Please advise on further steps and provide assistance.

Correction

This script does solve the problem, but only until the computer is restarted. I infer from this that something changes upon reboot—so, how can I find out what changes and how, and then remove or modify it?

Did you run the script?

Run the following command from the admin command prompt.


Double-click gpreport.html from your desktop to open it with a web browser and check which policies set to your computer.

There are no policies set. It says N/A everywhere under 'Applied Group Policy Objects'.

If your computer is personal (not work or school), this happens for two reasons: either you used optimization utilities to disable telemetry, or it is the result of hidden malware (viruses) that specifically disables cloud protection functions to avoid detection.
Run PowerShell as an Administrator.
(After completion, a message indicating successful completion should appear.)
Restart the computer.

PS C:\Windows\system32> reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /f; Set-MpPreference -UILockdown 0
ERROR: Access is denied.
PS C:\Windows\system32>

So yes, it was a virus—or rather, a remnant of one; my passwords were stolen several months ago, causing some damage. At the time, Google warned me that my passwords had been compromised and advised me to change them. I lost €80 at a local lottery site, where the culprit used my money to buy instant-win tickets, and they also activated an extra paid package costing €7 on my ISP account; however, they couldn't do anything on accounts where I had 2FA enabled. Since this happened months ago, traces of the virus likely remain in the registry or system, locking my Defender settings upon reboot. I need to track down the culprit responsible for the locking and registry modifications; so far, I’ve discovered several unauthorized exclusions added to Defender, including TEMP, PowerShell.exe, and the entire C:\ drive.

Thanks everyone—any smart advice or insights regarding these symptoms would be appreciated. Thanks.

If one's windows is compromised and one KNOWS he is compromised, I would do no less than an immediate clean install of windows. JMO.
You have no way of knowing how much damage has been done, how much of your information hackers have obtained, or what malware is lurking in your files that might be triggered again. I would also change passwords for all sites that involve my financial data in any way. Banks, credit cards, Paypal, Amazon, any place that has payment info stored.
Did you give someone remote access to your device?

Yes, after a reboot, the entry—which had been successfully deleted from the registry—reappears.

So, we are looking for the culprit that writes it back upon reboot.


A clean install is pretty much out of the question; after all, months have passed since the infection, and nothing was detected during that time—except for this current issue with the registry or Defender. I might consider a clean install eventually, but not right now. Thanks.

@buconova Press Win + R, type gpedit.msc and press Enter
1. Go to: Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → MAPS
2. On the right, you'll see policy settings. Note:
Join Microsoft MAPS (this is Cloud Protection)
Submit sample files if further analysis is required
3. Double-click on each of these parameters, change their state to Not Configured and click OK.
4. Restart your computer or refresh the policies by opening a command prompt and entering gpupdate /force.

buconova said:

A clean install is pretty much out of the question;

Click to expand...

Your choice. You asked for opinions and I gave mine.
You didn't answer my question. Did you give someone remote access to your computer?

glasskuter said:

Your choice. You asked for opinions and I gave mine.
You didn't answer my question. Did you give someone remote access to your computer?

Click to expand...

Yeah, thanks for the input. If I wanted to solve this with a clean install, I would have done so without asking for advice As for remote access—no, I didn't; I probably picked up a Trojan or whatever from some file I downloaded from the internet

You could try an offline scan.

Using Google's AI, we identified what caused the infection, when and how it happened, and what changes were made to the registry to blind Defender; that issue is now resolved. Since no damage was detected between the infection date (June 17) and today, there may not have actually been any. A thorough analysis of the dates revealed that the password theft I mentioned earlier occurred back in January and was unrelated to this incident. So... mission accomplished—and hopefully successfully. On the day of the infection, Defender did flag a program I’d downloaded from GitHub—ScreenToGIF—but apparently from a profile that included a small snippet of JavaScript. While the script itself wasn't dangerous, it linked to Node.exe and two other files: one with an unusually long name and no extension in System32, and another named "KernelSetupUpdate." Everything was connected via a Bulgarian website. However, I had a scan exclusion set in Defender for the entire C: drive the whole time—though I do usually keep most suspicious programs on the D: or E: drives. A cunning virus—or rather, malware, I suppose Consider this matter RESOLVED Thanks and best regards.