GPO settings for Internet Explorer trigger a Defender warning.

[Guest]

We have a policy implemented on our network that forces the start page and
some other things that should be correctly set on all computers.

Since this policy is regularly re-enforced Windows Defender keeps on
complaining about settings being altered at logon and at the GPO refresh
intervals. I cant find a option though that this particular change of
settings is allowed, and should be ignored in the future.

 

[Bill Sanderson]

Microsoft has said that an ADM file allowing configuration control via group
policy will be available by release time, fwiw.

I don't have an answer in the near term, however. I suppose the same answer
as for beta1 may be available--turning off real-time-protection options in
Tools, General Settings. Such a change would presumably be reflected in the
registry, which would allow you to replicate the configuration.

HKLM\software\Microsoft\Windows Defender\Real-Time Protection is where this
stuff seems to live.

And, as with beta1, this opens you up to whatever other exploits would have
raised alerts via that checkpoint (the one I am looking at is
IEConfigurationAgent.)

 

[Guest]

We use similar policies in our school environment, but don't regularly
reinforce them since a rebooted computer reapplies the GPO anyway. Don't seem
to be getting any error messages from defender at all in our environment. You
could play with the real time settings and try only turning off those aspects
which whine. It's a compromise, but I did prefer the granularity in Beta 1.

 

[Guest]

after a couple of reboots, the whining seems to have stopped afterall.
I think it'll now only start to whine if I would change some IE policy
settings.

Still annoying, but I guess that's why it has Beta in the name, so...

 

[Guest]

Just wanted to add the same is true for Windows XP firewall settings defined
in a GPO. We have defined some port exclusion in a GPO to be able to control
our users workstations even if they turn on their local XP firewall, but this
morning my Windows Defender asked me to allow or block these firewall port
exceptions...

Roland.

 

[Bill Sanderson]

This kind of issue is a good reason not to deploy this beta software on
production machines. This KB article from beta1 still applies:

http://support.microsoft.com/kb/892375/en-us

--