TestimoX

API Reference

Class

DefenderPolicyInfo

Namespace ADPlayground.Gpo
Assembly ADPlayground
Modifiers sealed

Flattened view of Microsoft Defender policy settings captured from GPO for a specific GPO/domain pair. Booleans indicate configured values; null means not configured.

Inheritance

  • Object
  • DefenderPolicyInfo

Constructors

Properties

public Guid GpoId { get; set; } #

GPO identifier.

public String DomainName { get; set; } #

DNS domain name that owns the GPO.

public Nullable<Boolean> DisableRealtimeMonitoring { get; set; } #

Disable real-time protection.

public Nullable<Boolean> DisableBehaviorMonitoring { get; set; } #

Disable behavior monitoring.

public Nullable<Boolean> DisableIOAVProtection { get; set; } #

Disable IOAV (I/O Antivirus) protection.

public Nullable<Boolean> DisableScriptScanning { get; set; } #

Disable script scanning.

public Nullable<Boolean> Notification_Suppress { get; set; } #

Suppress Defender notifications.

public Nullable<Boolean> SuppressRebootNotification { get; set; } #

Suppress reboot notifications.

public Nullable<Boolean> UILockdown { get; set; } #

Enable UI lockdown.

public Nullable<Boolean> DisableRemovableDriveScanning { get; set; } #

Disable removable drive scanning.

public Nullable<Boolean> DisableBlockAtFirstSeen { get; set; } #

Disable Block at First Sight feature.

public Nullable<Boolean> ASRRulesEnabled { get; set; } #

Any Attack Surface Reduction (ASR) rules enabled.

public Nullable<Boolean> ControlledFolderAccessAllowedAppsConfigured { get; set; } #

Controlled Folder Access allowed apps configured.

public Nullable<Boolean> ControlledFolderAccessProtectedFoldersConfigured { get; set; } #

Controlled Folder Access protected folders configured.

public String[] ExclusionExtensions { get; set; } #

File extension exclusions.

public String[] ExclusionPaths { get; set; } #

Path exclusions.

public String[] ExclusionProcesses { get; set; } #

Process image exclusions.

public IReadOnlyDictionary<String, Int32> ASRRules { get; set; } #

ASR rule actions keyed by rule ID (DWORD action value).

public String[] CFAAllowedApplications { get; set; } #

Controlled Folder Access allowed application paths.

public String[] CFAProtectedFolders { get; set; } #

Controlled Folder Access protected folder paths.