Windows Defender

[Gatt]

Tried installing this on the kids PC's today... and removed it after a trial run.

Few reasons

1) wouldn't get updates - prob my WSUS server settings, etc

2) the main reason - If you click on Tools then Windows Defender Website - it opens up IE but COMPLETELEY UNRESTRICTED!!

IE is locked down tight by GPO's but Windows Defender removes this and they can get access to (and modify) Homepage, Proxy settings, etc, etc

Anyone else seen this or know how to resolve it?

[ChrisH]

Hmm and your suprised at these little issues? I have just unpacked a few of our LFTs and it seems to have it on I will have a play tommorow.

[Geoff]

1) Yes, it is. You need to enable 'Windows Defender' in the Products. Plus 'Definitions' in the Catagories.

2) Alter the ACLs on the Windows Defender exe. There's no reason a non-admin needs to run it.

[Gatt]

1) Yes, it is. You need to enable 'Windows Defender' in the Products. Plus 'Definitions' in the Catagories.

2) Alter the ACLs on the Windows Defender exe. There's no reason a non-admin needs to run it.

You've lost me :P

[ChrisH]

You need to enable Windows defender updates in WSUS he is saying and that you should set the NTFS permissions on the defender.exe to stop normal users running it.

[Gatt]

D'oh!!

Set up the WSUS defs and stuff before i left so should be able to get the updates from tomorrow

As for the NTFS side - surely if i disallow the rights to run it then it wont "defend" the PC unless and admin logs in?
Or am i missing the blindingly obvious here :P

[ChrisH]

It should run as system I would assume.

[Gatt]

Cheers Chris, I'll try again tomorrow and see what happens

[Geoff]

The actual spyware scanner runs as a system service under the system account. The .exe is just the gui/tray icon.