-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathWindows_Defender.ps1
126 lines (91 loc) · 3.72 KB
/
Windows_Defender.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
# Windows Defender using PowerShell
Install-module -name WindowsDefender -AllowClobber -force
## Check the status of Windows Defender
Get-MpComputerStatus
## Stop Windows Defender service
Set-MpPreference -DisableRealtimeMonitoring $true
## Uninstall/Remove Windows Defender service
Uninstall-WindowsFeature -Name Windows-Defender
## Start Windows Defender service
sc start WinDefend
## Stop Windows Defender service
sc stop WinDefend
## Uninstall/Remove Windows Defender service
sc config WinDefend start= disabled
sc stop WinDefend
## Check the current state
sc query WinDefend
# Start a computer scan
Start-MpScan
[-ScanPath <String>]
[-ScanType <ScanType>] # Full/Quick/Custom scan
[-CimSession <CimSession[]>]
[-ThrottleLimit <Int32>]
[-AsJob]
[<CommonParameters>]
#
Start-MpScan -ScanType full -AsJob
# Get the detected malware/threats
Get-MpThreatDetection |out-gridview
# Gets the history of threats detected on the computer.
Get-MpThreat
# Gets known threats from the definitions catalog.
Get-MpThreatCatalog
## Schedule a periodic full scan daily to work in the background
Set-MpPreference -ScanOnlyIfIdleEnabled $true
Set-MpPreference -ScanParameters
Set-MpPreference -ScanScheduleDay 0
Set-MpPreference -ScanScheduleTime
Set-MpPreference -RandomizeScheduleTaskTimes
# 0: Everyday
#1: Sunday
#2: Monday
#3: Tuesday
#4: Wednesday
#5: Thursday
#6: Friday
#7: Saturday
#8: Never
# Gets preferences for the Windows Defender scans and updates.
Get-MpPreference
## PowerShell cmdlets for scheduling scans when an endpoint is not in use
Set-MpPreference -ScanOnlyIfIdleEnabled $true
## Display Defender services with their status working/stopped
get-service | where {$_.DisplayName -Like "Defender*"} | Select Status,DisplayName
## Update AV signature
update-mpsignature
## Example 1: Schedule to check for definition updates everyday
Set-MpPreference -SignatureScheduleDay Everyday
## Add an exclusion from AV protection
Set-MpPreference -ExclusionPath C:\
Set-MpPreference -ExclusionPath C:\Users\Hazem\.wsl
Set-MpPreference -ExclusionPath F:\Cracks
## Remove the exclusion from AV protection
Remove-MpPreference -ExclusionPath C:\
Remove-MpPreference -ExclusionPath F:\Cracks
Send-MailMessage
$PSEmailServer='smtp.office365.com'
Send-MailMessage -From 'User01 [email protected]' -To 'User02 [email protected]' -Subject 'Test mail' -smtpserver $PSEmailServer
Send-MailMessage -From '[email protected]' -To '[email protected]' -Subject 'Test mail' -smtpserver 'smtp.office365.com'
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /f
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" /f
reg delete "HKCU\Software\Microsoft\WindowsSelfHost" /f
reg delete "HKCU\Software\Policies" /f
reg delete "HKLM\Software\Microsoft\Policies" /f
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies" /f
reg delete "HKLM\Software\Microsoft\WindowsSelfHost" /f
reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies" /f
reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate" /f
## Reset Windows Security for NOT opening [common in Windows 11]
Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
Get-AppxPackage *
Get-AppxPackage *Microsoft.SecHealthUI* | Reset-AppxPackage
Get-AppxPackage *Windos.immersivecontrolpanel* | Reset-AppxPackage
Install-Module -name Appx -repository PSGallery -AllowClobber
Install-Module -name Appx -repository NuGet -AllowClobber
Import-Module Appx
import-module appx
Find-Module -Name Appx | Install-Module
get-module -ListAvailable
Get-InstalledModule
Get-PSRepository