Yellow triangle in Windows Security (Defender)

maurice naggar · Jul 21, 2021

The goal is to review the preferences setting on MS Defender antivirus & specifically to look at setting for MapsReporting.
Did you manage to get a long display on your powershell window ?
If so, can you copy & paste ?

Josey Wales · Jul 21, 2021

Mine has been working ever since I posted that it was,

Wynona · Jul 21, 2021

maurice naggar said:
The goal is to review the preferences setting on MS Defender antivirus & specifically to look at setting for MapsReporting.
Did you manage to get a long display on your powershell window ?
If so, can you copy & paste ?

Yeah, I figured it out, and had the list in the reply area, but deleted it until I know what I'm signing on for. :scream:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! Migrating from Windows PowerShell 5.1 to PowerShell 7 - PowerShell

PS C:\WINDOWS\system32> get-mppreference

AllowDatagramProcessingOnWinServer : False
AllowNetworkProtectionDownLevel : False
AllowNetworkProtectionOnWinServer : False
AttackSurfaceReductionOnlyExclusions :
AttackSurfaceReductionRules_Actions :
AttackSurfaceReductionRules_Ids :
CheckForSignaturesBeforeRunningScan : False
CloudBlockLevel : 1
CloudExtendedTimeout : 1
ComputerID : 8DB9679D-E7F1-4D48-AEF2-5CA558B81DE9
ControlledFolderAccessAllowedApplications :
ControlledFolderAccessProtectedFolders :
DisableArchiveScanning : False
DisableAutoExclusions : False
DisableBehaviorMonitoring : False
DisableBlockAtFirstSeen : False
DisableCatchupFullScan : True
DisableCatchupQuickScan : True
DisableCpuThrottleOnIdleScans : True
DisableDatagramProcessing : False
DisableDnsOverTcpParsing : False
DisableDnsParsing : False
DisableEmailScanning : True
DisableGradualRelease : False
DisableHttpParsing : False
DisableInboundConnectionFiltering : False
DisableIntrusionPreventionSystem :
DisableIOAVProtection : False
DisableNetworkProtectionPerfTelemetry : False
DisablePrivacyMode : False
DisableRdpParsing : False
DisableRealtimeMonitoring : False
DisableRemovableDriveScanning : True
DisableRestorePoint : True
DisableScanningMappedNetworkDrivesForFullScan : True
DisableScanningNetworkFiles : False
DisableScriptScanning : False
DisableSshParsing : False
DisableTlsParsing : False
EnableControlledFolderAccess : 0
EnableDnsSinkhole : False
EnableFileHashComputation : False
EnableFullScanOnBatteryPower : False
EnableLowCpuPriority : False
EnableNetworkProtection : 0
EngineUpdatesChannel : 0
ExclusionExtension :
ExclusionIpAddress :
ExclusionPath :
ExclusionProcess : {C:\Program Files\FreeFileSync\Bin\*}
ForceUseProxyOnly : False
HighThreatDefaultAction : 0
LowThreatDefaultAction : 0
MAPSReporting : 2
MeteredConnectionUpdates : False
ModerateThreatDefaultAction : 0
PlatformUpdatesChannel : 0
ProxyBypass :
ProxyPacUrl :
ProxyServer :
PUAProtection : 1
QuarantinePurgeItemsAfterDelay : 90
RandomizeScheduleTaskTimes : True
RealTimeScanDirection : 0
RemediationScheduleDay : 0
RemediationScheduleTime : 02:00:00
ReportingAdditionalActionTimeOut : 10080
ReportingCriticalFailureTimeOut : 10080
ReportingNonCriticalTimeOut : 1440
ScanAvgCPULoadFactor : 50
ScanOnlyIfIdleEnabled : True
ScanParameters : 1
ScanPurgeItemsAfterDelay : 15
ScanScheduleDay : 0
ScanScheduleQuickScanTime : 00:00:00
ScanScheduleTime : 02:00:00
SchedulerRandomizationTime : 4
SevereThreatDefaultAction : 0
SharedSignaturesPath :
SignatureAuGracePeriod : 0
SignatureBlobFileSharesSources :
SignatureBlobUpdateInterval : 60
SignatureDefinitionUpdateFileSharesSources :
SignatureDisableUpdateOnStartupWithoutEngine : False
SignatureFallbackOrder : MicrosoftUpdateServer|MMPC
SignatureFirstAuGracePeriod : 120
SignatureScheduleDay : 8
SignatureScheduleTime : 01:45:00
SignaturesUpdatesChannel : 0
SignatureUpdateCatchupInterval : 1
SignatureUpdateInterval : 0
SubmitSamplesConsent : 1
ThreatIDDefaultAction_Actions :
ThreatIDDefaultAction_Ids :
TrustLabelProtectionStatus : 0
UILockdown : False
UnknownThreatDefaultAction : 0
PSComputerName :

PS C:\WINDOWS\system32>

maurice naggar · Jul 21, 2021

Thanks Wynona. I'm thinking your pc is not getting a yellow flag, given that this shows that threat submission is fully on.
If there -is- some yellow flag now, then it would help to get a screenshot of exactly where it shows.

Wynona · Jul 21, 2021

maurice naggar said:
Thanks Wynona. I'm thinking your pc is not getting a yellow flag, given that this shows that threat submission is fully on.
If there -is- some yellow flag now, then it would help to get a screenshot of exactly where it shows.

Yes, it's fully on because I had enabled it just before I read your post.

maurice naggar · Jul 21, 2021

OK, Thanks.

AndreTen · Jul 22, 2021

Wynona said:
Yes, it's fully on because I had enabled it just before I read your post.

But does it stick after restart?

Wynona · Jul 22, 2021

AndreTen said:
But does it stick after restart?

Sometimes it does and sometimes it doesn't. I'm not sure, but I think it might be on when I boot, but later turns off. It's on right now; I'm going to watch it and see if it turns off later . . .

Bree · Jul 22, 2021

Wynona said:
Sometimes it does and sometimes it doesn't. I'm not sure...

For me it's absolutely consistent, never starts on boot, once started manually remain on forever (even after sleep or hibernation).

Still on Engine Version: 1.1.18300.4, no update offered yet....

Wynona · Jul 22, 2021

Bree said:
For me it's absolutely consistent, never starts on boot, once started manually remain on forever (even after sleep or hibernation).

Still on Engine Version: 1.1.18300.4, no update offered yet....

I've had to change from the yellow triangle several times so far.

BunnyJ · Jul 22, 2021

For me,, it's been kind of weird. When I installed 11 via update over 10 it wouldn't be on right away and I had to start defender up manually., But.. when I did a clean instillation defender has been running when I boot up every time.

Wynona · Jul 22, 2021

I'm on the Insider DEV Channel, and didn't know I was going to be updated to Windows 11; but when the update was finished, there it was! No problems at all, except for all the missing choices we have with Windows 10. So far, after the last change back to protected, it's stuck on.

maurice naggar · Jul 22, 2021

One wonders if all the cases with the "issue" only have Windefend antivirus on the system ( as the sole security) ? or whether there is another installed auto-started security program ?

Wynona · Jul 22, 2021

maurice naggar said:
One wonders if all the cases with the "issue" only have Windefend antivirus on the system ( as the sole security) ? or whether there is another installed auto-started security program ?

Windows Defender only here.

Bree · Jul 22, 2021

maurice naggar said:
One wonders if all the cases with the "issue" only have Windefend antivirus on the system ( as the sole security) ?

That's certainly the case for me, just the built-in Windows Security.

maurice naggar · Jul 22, 2021

Bree said:
That's certainly the case for me, just the built-in Windows Security.

@Bree
Could you do the Powershell inquiry and paste the results ( like I had Wynona do )

Bree · Jul 22, 2021

maurice naggar said:
@Bree
Could you do the Powershell inquiry and paste the results ( like I had Wynona do )

Here (with the ComputerID redacted)

Code:

PS C:\Users\Owner> get-mppreference


AllowDatagramProcessingOnWinServer            : False
AllowNetworkProtectionDownLevel               : False
AllowNetworkProtectionOnWinServer             : False
AttackSurfaceReductionOnlyExclusions          :
AttackSurfaceReductionRules_Actions           :
AttackSurfaceReductionRules_Ids               :
CheckForSignaturesBeforeRunningScan           : False
CloudBlockLevel                               : 0
CloudExtendedTimeout                          : 0
ComputerID                                    : 1DD*****-****-****-****-*********FF0
ControlledFolderAccessAllowedApplications     : {C:\Portable Apps\AnyBurn(64-bit)\AnyBurn.exe, C:\Portable
                                                Apps\CPU-ZPortable\App\CPU-Z\cpuz_x64.exe, C:\Portable
                                                Apps\LibreOfficePortable\App\libreoffice\program\soffice.bin,
                                                C:\Portable Apps\MiniTool Partition Wizard Free
                                                9.1\PartitionWizard.exe...}
ControlledFolderAccessProtectedFolders        :
DisableArchiveScanning                        : False
DisableAutoExclusions                         : False
DisableBehaviorMonitoring                     : False
DisableBlockAtFirstSeen                       : False
DisableCatchupFullScan                        : True
DisableCatchupQuickScan                       : True
DisableCpuThrottleOnIdleScans                 : True
DisableDatagramProcessing                     : False
DisableDnsOverTcpParsing                      : False
DisableDnsParsing                             : False
DisableEmailScanning                          : True
DisableGradualRelease                         : False
DisableHttpParsing                            : False
DisableInboundConnectionFiltering             : False
DisableIntrusionPreventionSystem              :
DisableIOAVProtection                         : False
DisableNetworkProtectionPerfTelemetry         : False
DisablePrivacyMode                            : False
DisableRdpParsing                             : False
DisableRealtimeMonitoring                     : False
DisableRemovableDriveScanning                 : True
DisableRestorePoint                           : True
DisableScanningMappedNetworkDrivesForFullScan : True
DisableScanningNetworkFiles                   : False
DisableScriptScanning                         : False
DisableSshParsing                             : False
DisableTlsParsing                             : False
EnableControlledFolderAccess                  : 1
EnableDnsSinkhole                             : False
EnableFileHashComputation                     : False
EnableFullScanOnBatteryPower                  : False
EnableLowCpuPriority                          : False
EnableNetworkProtection                       : 0
EngineUpdatesChannel                          : 0
ExclusionExtension                            :
ExclusionIpAddress                            :
ExclusionPath                                 :
ExclusionProcess                              :
ForceUseProxyOnly                             : False
HighThreatDefaultAction                       : 0
LowThreatDefaultAction                        : 0
MAPSReporting                                 : 2
MeteredConnectionUpdates                      : False
ModerateThreatDefaultAction                   : 0
PlatformUpdatesChannel                        : 0
ProxyBypass                                   :
ProxyPacUrl                                   :
ProxyServer                                   :
PUAProtection                                 : 0
QuarantinePurgeItemsAfterDelay                : 90
RandomizeScheduleTaskTimes                    : True
RealTimeScanDirection                         : 0
RemediationScheduleDay                        : 0
RemediationScheduleTime                       : 02:00:00
ReportingAdditionalActionTimeOut              : 10080
ReportingCriticalFailureTimeOut               : 10080
ReportingNonCriticalTimeOut                   : 1440
ScanAvgCPULoadFactor                          : 50
ScanOnlyIfIdleEnabled                         : True
ScanParameters                                : 1
ScanPurgeItemsAfterDelay                      : 15
ScanScheduleDay                               : 0
ScanScheduleQuickScanTime                     : 00:00:00
ScanScheduleTime                              : 02:00:00
SchedulerRandomizationTime                    : 4
SevereThreatDefaultAction                     : 0
SharedSignaturesPath                          :
SignatureAuGracePeriod                        : 0
SignatureBlobFileSharesSources                :
SignatureBlobUpdateInterval                   : 60
SignatureDefinitionUpdateFileSharesSources    :
SignatureDisableUpdateOnStartupWithoutEngine  : False
SignatureFallbackOrder                        : MicrosoftUpdateServer|MMPC
SignatureFirstAuGracePeriod                   : 120
SignatureScheduleDay                          : 8
SignatureScheduleTime                         : 01:45:00
SignaturesUpdatesChannel                      : 0
SignatureUpdateCatchupInterval                : 1
SignatureUpdateInterval                       : 0
SubmitSamplesConsent                          : 1
ThreatIDDefaultAction_Actions                 :
ThreatIDDefaultAction_Ids                     :
TrustLabelProtectionStatus                    : 0
UILockdown                                    : False
UnknownThreatDefaultAction                    : 0
PSComputerName                                :



PS C:\Users\Owner>

maurice naggar · Jul 22, 2021

@Bree Thank you for the info. Let's give this a try. Start a elevated Powershell.
Then copy > paste this entire line as-is onto it

Code:

set-mppreference -DisablePrivacyMode $true

tap Enter. Then observe for result. Then exit Powershell.
Watch for the behavior there after. and can you then get a screen grab of the screen for Virus & Threat Protection / Security at a glance
and
the other one for Virus and Threat Protecrion.
It would help to have a visual capture of each of those 2.

Bree · Jul 22, 2021

maurice naggar said:
@Bree Thank you for the info. Let's give this a try. Start a elevated Powershell.
Then copy > paste this entire line as-is onto it

Code:

set-mppreference -DisablePrivacyMode $true

tap Enter. Then observe for result. Then exit Powershell.
Watch for the behavior there after. and can you then get a screen grab of the screen for Virus & Threat Protection / Security at a glance
and
the other one for Virus and Threat Protecrion.
It would help to have a visual capture of each of those 2.