Configure Endpoint Protection in Configuration ManagerĬonfigure remediation options using Group Policy.

If you're using Configuration Manager, see the following articles:

Configure remediation options using Configuration Manager Review your settings, and then choose Save.įor more information about antivirus policies in Intune, see Antivirus policy for endpoint security in Intune. Specify the device groups that should receive this policy (such as All Devices). Under Allow On Access Protection, select a remediation action for each level: Platform: Windows 10, Windows 11, and Windows Serverįor configuration settings, expand Defender, scroll down to Allow On Access Protection.Configure remediation options using IntuneĪs a global or security administrator, go to the Intune admin center and sign in.Įither create a new policy, or edit an existing policy using the following settings:

See Configure and validate exclusions for Microsoft Defender Antivirus scans.Īlso see Configure remediation-required scheduled full Microsoft Defender Antivirus scans for more remediation-related settings. To avoid this problem in the future, you can exclude files from the scans.

See Restore quarantined files in Microsoft Defender Antivirus. If you are certain Microsoft Defender Antivirus quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed. Sometimes, completing a remediation requires a reboot. Microsoft Defender Antivirus detects and remediates files based on many factors.

DefenderUI 1.12 free