What Policy Rules are needed for Windows Defender?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

What are the Policy Configurations needed to not scan Windows Defender?

Environment

• Carbon Black Cloud Console: All Versions
• Endpoint Standard Sensor: All Versions
• Microsoft Windows Defender

Resolution

The following or similar rule could be added to the Permissions section of the Policies page or the Event Reporting & Sensor Operations Exclusions:

Application at path: *:\ProgramData\Microsoft\Windows Defender\** 
**\Program Files*\Windows Defender*\**
Operation attempt: Performs any operation
Action: Bypass

Additional Information

• For assistance in creating permission rules, please see this article
• For assistance in configuring the Sensor Operations Exclusions