Endpoint Standard: What Permission Rules are needed for Windows Defender?

[#1]

Environment

• Carbon Black Cloud Console: All Versions
• Endpoint Standard Sensor: All Versions
• Microsoft Windows Defender

Question

What are the Permissions needed to not scan Windows Defender?

Answer

The following should be added to the Permissions section of the Policies page:

Application at path: *:\ProgramData\Microsoft\Windows Defender\** 
**\Program Files*\Windows Defender*\**
Operation attempt: Performs any operation
Action: Bypass

Additional Notes

For assistance in creating these permission rules, please see: https://community.carbonblack.com/t5/Knowledge-Base/Endpoint-Standard-How-to-Create-Policy-Blocking-...

Related Content

Cb Defense: Anti-Virus Exclusions For Defense in Other Security Products
Carbon Black Cloud Console: How to Set up Exclusions in the Carbon Black Cloud Console for other AV ...