PowerShell Question

Hi, I need to change the time that virus notifications are retained. For a number of reasons I want the virus notifications to be saved (temporarily) for at most 1 day.

With PowerShell (as admin) I thought that this command would do it.

>Set-MpPreference -QuarantinePurgeItemsAfterDelay 1

but no, I get this error:

Set-MpPreference : Operation failed with the following error: 0x%1!x!
At line:1 char:2
+ Set-MpPreference -QuarantinePurgeItemsAfterDelay 1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Set-MpPreference],
CimException
+ FullyQualifiedErrorId : HRESULT 0xc0000142,Set-MpPreference

Can anyone help me with this change?

Version 23H2 (OS Build 22631.2792)

Doug4901 said:

Hi, I need to change the time that virus notifications are retained. For a number of reasons I want the virus notifications to be saved (temporarily) for at most 1 day.

With PowerShell (as admin) I thought that this command would do it.

>Set-MpPreference -QuarantinePurgeItemsAfterDelay 1

but no, I get this error:

Set-MpPreference : Operation failed with the following error: 0x%1!x!
At line:1 char:2
+ Set-MpPreference -QuarantinePurgeItemsAfterDelay 1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Set-MpPreference],
CimException
+ FullyQualifiedErrorId : HRESULT 0xc0000142,Set-MpPreference

Can anyone help me with this change?

Version 23H2 (OS Build 22631.2792)

Click to expand...

The syntax is correct. The command works for me using PowerShell 7.4.
Are you sure Defender isn't running? That is the only thing I can think of.

Try this:

OAT said:

The syntax is correct. The command works for me using PowerShell 7.4.
Are you sure Defender isn't running? That is the only thing I can think of.

Click to expand...

Hi OAT, I am a beginner with Powershell. Regarding the last part of your reply, all I have tried with Defender is to disable real time detection. Is this what you meant?

LesFerch said:

Try this:

ClearDefenderHistory

Clear Windows Defender History Files

lesferch.github.io

Click to expand...

Thanks for the suggestion, but that also failed. I have messaged the owner of that script for further advice
see Clear Windows Security Center (Defender) Protection History - Windows 10 Help Forums

OAT said:

The syntax is correct. The command works for me using PowerShell 7.4.
Are you sure Defender isn't running? That is the only thing I can think of.

Click to expand...

If you're not elevated, that's the exact error that's returned by PS.

Doug4901 said:

Hi, I need to change the time that virus notifications are retained. For a number of reasons I want the virus notifications to be saved (temporarily) for at most 1 day.

With PowerShell (as admin) I thought that this command would do it.

>Set-MpPreference -QuarantinePurgeItemsAfterDelay 1

but no, I get this error:

Set-MpPreference : Operation failed with the following error: 0x%1!x!
At line:1 char:2
+ Set-MpPreference -QuarantinePurgeItemsAfterDelay 1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Set-MpPreference],
CimException
+ FullyQualifiedErrorId : HRESULT 0xc0000142,Set-MpPreference

Can anyone help me with this change?

Version 23H2 (OS Build 22631.2792)

Click to expand...

Set-MpPreference
[-AllowDatagramProcessingOnWinServer <Boolean>]
[-AllowNetworkProtectionDownLevel <Boolean>]
[-AllowNetworkProtectionOnWinServer <Boolean>]
[-AllowSwitchToAsyncInspection <Boolean>]
[-AsJob]
[-AttackSurfaceReductionOnlyExclusions <String[]>]
[-AttackSurfaceReductionRules_Actions <ASRRuleActionType[]>]
[-AttackSurfaceReductionRules_Ids <String[]>]
[-CheckForSignaturesBeforeRunningScan <Boolean>]
[-CimSession <CimSession[]>]
[-CloudBlockLevel <CloudBlockLevelType>]
[-CloudExtendedTimeout <UInt32>]
[-ControlledFolderAccessAllowedApplications <String[]>]
[-ControlledFolderAccessProtectedFolders <String[]>]
[-DefinitionUpdatesChannel <UpdatesChannelType>]
[-DisableArchiveScanning <Boolean>]
[-DisableAutoExclusions <Boolean>]
[-DisableBehaviorMonitoring <Boolean>]
[-DisableBlockAtFirstSeen <Boolean>]
[-DisableCacheMaintenance <UInt32>]
[-DisableCatchupFullScan <Boolean>]
[-DisableCatchupQuickScan <Boolean>]
[-DisableCpuThrottleOnIdleScans <Boolean>]
[-DisableDatagramProcessing <Boolean>]
[-DisableDnsOverTcpParsing <Boolean>]
[-DisableDnsParsing <Boolean>]
[-DisableEmailScanning <Boolean>]
[-DisableFtpParsing <Boolean>]
[-DisableGradualRelease <Boolean>]
[-DisableHttpParsing <Boolean>]
[-DisableIOAVProtection <Boolean>]
[-DisableInboundConnectionFiltering <Boolean>]
[-DisableNetworkProtectionPerfTelemetry <Boolean>]
[-DisablePrivacyMode <Boolean>]
[-DisableRdpParsing <Boolean>]
[-DisableRealtimeMonitoring <Boolean>]
[-DisableRemovableDriveScanning <Boolean>]
[-DisableRestorePoint <Boolean>]
[-DisableScanningMappedNetworkDrivesForFullScan <Boolean>]
[-DisableScanningNetworkFiles <Boolean>]
[-DisableScriptScanning <Boolean>]
[-DisableSmtpParsing <Boolean>]
[-DisableSshParsing <Boolean>]
[-DisableTlsParsing <Boolean>]
[-EnableControlledFolderAccess <ControlledFolderAccessType>]
[-EnableDnsSinkhole <Boolean>]
[-EnableFileHashComputation <Boolean>]
[-EnableFullScanOnBatteryPower <Boolean>]
[-EnableLowCpuPriority <Boolean>]
[-EnableNetworkProtection <ASRRuleActionType>]
[-EngineUpdatesChannel <UpdatesChannelType>]
[-ExclusionExtension <String[]>]
[-ExclusionIpAddress <String[]>]
[-ExclusionPath <String[]>]
[-ExclusionProcess <String[]>]
[-ForceUseProxyOnly <Boolean>]
[-Force]
[-HighThreatDefaultAction <ThreatAction>]
[-IntelTDTEnabled <UInt32>]
[-LowThreatDefaultAction <ThreatAction>]
[-MAPSReporting <MAPSReportingType>]
[-MeteredConnectionUpdates <Boolean>]
[-ModerateThreatDefaultAction <ThreatAction>]
[-OobeEnableRtpAndSigUpdate <Boolean>]
[-PUAProtection <PUAProtectionType>]
[-PlatformUpdatesChannel <UpdatesChannelType>]
[-ProxyBypass <String[]>]
[-ProxyPacUrl <String>]
[-ProxyServer <String>]
[-QuarantinePurgeItemsAfterDelay <UInt32>]
[-RandomizeScheduleTaskTimes <Boolean>]
[-RealTimeScanDirection <ScanDirection>]
[-RemediationScheduleDay <Day>]
[-RemediationScheduleTime <DateTime>]
[-ReportingAdditionalActionTimeOut <UInt32>]
[-ReportingCriticalFailureTimeOut <UInt32>]
[-ReportingNonCriticalTimeOut <UInt32>]
[-ScanAvgCPULoadFactor <Byte>]
[-ScanOnlyIfIdleEnabled <Boolean>]
[-ScanParameters <ScanType>]
[-ScanPurgeItemsAfterDelay <UInt32>]
[-ScanScheduleDay <Day>]
[-ScanScheduleOffset <UInt32>]
[-ScanScheduleQuickScanTime <DateTime>]
[-ScanScheduleTime <HH:MM:SS>]
[-SchedulerRandomizationTime <UInt32>]
[-ServiceHealthReportInterval <UInt32>]
[-SevereThreatDefaultAction <ThreatAction>]
[-SharedSignaturesPath <String>]
[-SignatureAuGracePeriod <UInt32>]
[-SignatureBlobFileSharesSources <String>]
[-SignatureBlobUpdateInterval <UInt32>]
[-SignatureDefinitionUpdateFileSharesSources <String>]
[-SignatureDisableUpdateOnStartupWithoutEngine <Boolean>]
[-SignatureFallbackOrder <String>]
[-SignatureFirstAuGracePeriod <UInt32>]
[-SignatureScheduleDay <Day>]
[-SignatureScheduleTime <DateTime>]
[-SignatureUpdateCatchupInterval <UInt32>]
[-SignatureUpdateInterval <UInt32>]
[-SignaturesUpdatesChannel <UpdatesChannelType>]
[-SubmitSamplesConsent <SubmitSamplesConsentType>]
[-ThreatIDDefaultAction_Actions <ThreatAction[]>]
[-ThreatIDDefaultAction_Ids <Int64[]>]
[-ThrottleLimit <Int32>]
[-UILockdown <Boolean>]
[-UnknownThreatDefaultAction <ThreatAction>]
[<CommonParameters>]






Set-MpPreference -ExclusionPath C:\vpostest
echo "Exclusion Success"
Read-Host -Prompt "Press Enter to exit"

Get-MpComputerStatus

You need to use code tags when you post code. If I am correct, I can see about 10 errors in your powershell commands

[] -> [ ]

SHIELD44 said:

[-AttackSurfaceReductionOnlyExclusions <String[]>]
[-AttackSurfaceReductionRules_Actions <ASRRuleActionType[]>]
[-AttackSurfaceReductionRules_Ids <String[]>]

Click to expand...

SHIELD44 said:

[-ExclusionExtension <String[]>]

[-ExclusionIpAddress <String[]>]
[-ExclusionPath <String[]>]
[-ExclusionProcess <String[]>]

Click to expand...

SHIELD44 said:

[-ProxyBypass <String[]>]

Click to expand...

SHIELD44 said:

[-ThreatIDDefaultAction_Actions <ThreatAction[]>]
[-ThreatIDDefaultAction_Ids <Int64[]>]

Click to expand...