Apply Action on Detected Item???

[Guest]

Obviously, if I choose to enable this option in settings, Windows Defender
will automatically take the default action for the detected item. What
happens if I do not choose to select this option? Will Defender notify me of
items found, offer options to take AND make recommendations?

There is nothing in the instructions to advise on what happens if you
deselect this option. I don't want it to automatically delete any false
positives. What is the safest setting?

 

[Bill Sanderson]

Safest is not easy to determine.

I unchecked this box, and also checked the box to notify on both
unclassified and changes to known.

This was on an SBS-2003 server (trial version) that I was installing on my
laptop. I then went through Device manager and pulled in drivers for all
the unknown items--ethernet nic, motherboard sound, and smartcard. After
that process was all completed, I got an alert from Windows Defender about
the three driver additions, and was asked to allow or disallow them. I've
no idea what would have happened if I hadn't approved them--I wasn't that
brave.

If you set one of the extra "notify" options, you need to be there and check
for the notifications, I think.

I think for most people, the defaults are probably just right. I decided to
uncheck the "apply actions" on servers I administer, just to be able to
check each found item carefully to see whether it is a false positive before
choosing the action to take. I've done full scans of each server so I know
they are clean now. I'm not going to make that change on client machines,
except, perhaps, my own--partly out of curiosity--you get lots of
information about what is happening in a driver install or software update,
for example.

 

[Guest]

I don't think the automatic setting is safe for the average home user, and it
should not be the default setting.