[1909, ou] Windows 10 Tamper Protection GPO Issue

[caffrey]

No sure if anyone has come across this before but, I'm using MDT to push out a 1909 Task sequence which is working fine. However Windows defender tamper protection is causing Machine GPO policies to fail.

If I disable tamper protection then gpupdate / force then renable tamper protection everything is fine. (I'm guessing it's updating definitions ?)

 

Is there something in the task sequence I should be doing to fix this ?

[Steve21]

Are you using a 3rd party AV or anything? Tamper protection stops settings in defender being changed, so just wondering if it's conflicting with something you've got in a GPO like disable AV or what not

 

Steve

[caffrey]

No, just using Windows Defender and the task sequence is 1:1 the same as the 1809 task sequence I have except for the wim. The wim is just a thin image with appx packages removed so nothing out of the ordinary.

Got a few things to try, going to try adding a windows defender update step ("C:\Program Files\Windows Defender\MpCmdRun.exe -SignatureUpdate") and try Windows update pre and post application (I normally disable those steps for speed)

It's weird, but then again I believe tamper protection was introduced in 1903, we've been running 1809 the past year.

[caffrey]

Adding a task sequence seems to have done the trick - maybe just a coincidence ? But it's working now

 

Just add a Run Command Line task in the State Restore group with

 

"C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate

 

Seems like updating signatures works, I assume this is fixed in 20h2