ADMX Viewer
Microsoft.Policies.WindowsDefender• Machine

Specify threats upon which default action should not be taken when detected

This policy setting customize which remediation action will be taken for each listed Threat ID when it is detected during a scan. Threats should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid Threat ID, while the value contains the action ID for the remediation action that should be taken. Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore

Policy Details

Policy Name
Threats_ThreatIdDefaultAction
Registry Key
Software\Policies\Microsoft\Windows Defender\Threats
Value Name
Threats_ThreatIdDefaultAction
Supported On
At least Windows Server 2012, Windows 8 or Windows RT
OMA-URI (CSP)
ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction
OS Build Version:10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202
CSP Version:10.0
Conflict Resolution:LastWrite
Allowed Editions:
EnterpriseEnterprise NProfessionalProfessional NEnterprise EvaluationEnterprise N EvaluationEducationEducation NEnterprise SEnterprise S NEnterprise S EvaluationEnterprise S N EvaluationHolographic BusinessPro Single LanguagePro ChinaPro WorkstationPro Workstation NPro For EducationPro For Education NEnterprisegEnterprisegnServerrdshIotenterpriseIotenterprisesCloudeditionnCloudeditionIotenterpriseskIotenterpriseseval
Available Languages
en-us

Configuration Elements

Specify threats upon which default action should not be taken when detected

Type: list

Explicit values: true
Additive: true