Window Updates fail

Question

Windows updates will fail to load and virus protection will stop working when safeguard is installed. We uninstall SGN Client and all returns to normal. Any ideas of what would cause this?

MichaelMcLannahan · Answer

Thanks for that Brian - If you're using File Encryption then I would add that path to the exclude policies - to be ignored. It would be likely the SafeGuard is trying to interrogate/encrypt that location and this is causing an issue for Defender. I had a similar issue with OneDrive - not AV related but strange anomalies with OneDrive and File Encryption. Missing/deleted files was common. In the console - Go to Polices. Create a test group and then assign the policy to this group to test - Don't apply to everyone yet until you can verify this resolves it. My OneDrive exclusion looks like this...You'll need something similar but using the path (s) you found %OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\* You can substitute the first bit of the path with So your exclude path for your test policy would be \Microsoft\Windows Defender\Platform

MichaelMcLannahan · Answer

Hi Brian - It's a little long winded but.... 
 Right click your domain (or workgroup) and select New. 
 Select Create New Group. 
 Put a character at the beginning (this will make it appear higher on the tree and easier to find that wading through the whole directory) 
 ".Test Defender Group" 
 (Note don't use quotes and I used a "." at the beginning)

Once created - Select the Member tab. 
 Find your test machines and drag them into the window to make them members. 
 Click SAVE (top left)

Select the root of your domain (or workgroup) you wish to apply the policy to. 
 Select the Policies Tab. 
 Drag in your policy (or group of policies) in to the window. 
 BEFORE you save - we now modify WHO that policy applies to. 
 REMOVE .Authenticated Computers AND .Authenticated Users. If you miss this step the policy will apply to ALL. 
 Drag in the group you created earlier (Test Defender Group)

Note the NO OVERRIDE means the policy WILL apply/force even it something else conflicts. 
 
 You can then see if the policy has applied by finding your test machine (s) and using the RSOP tab - the resulting policy applied to the machine. A username won't be needed if you applied your policy to a computer object and not a user. 
 
 Hope this helps?