Reply to thread

Message

<blockquote data-quote="simmerskool" data-source="post: 1040353" data-attributes="member: 61091">here is what the CyF tech wrote earlier: &quot;Integrate with windows security center basically tells defender to let DI do what it wants first then defender will look at things.&quot; To me his comment states or implies that MS Defender is not disabled; hence my confusion. I have installed other AV on VM and sure they do disable Defender. For me the real question: tech says, just enable Di integration. Nothing else to do, no reboot, etc... But if I do that and I decide I don&#039;t like Di integration, how easy then to get MS Defender working again? I guess I&#039;m a little skittish since ESET borked my win firewall (according to MS support).ok! I did find something officially authoritative on page 130 of the Di Admin Guide | &quot;Integrate D-Client with WSC, by default this feature is disabled...If Windows Defender (n/k/a MS Defender) is active and the D-Client integration is enabled, Windows Defender is disabled.&quot; How does square with CyF tech saying &quot;...basically tells defender to let DI do what it wants first then defender will look at things.&quot; It&#039;s not like I want to run MS Defender, I just don&#039;t want to break MS Defender, and I want to have the ability to restore Defender without another win10 in-place upgrade <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite121" alt=":cautious:" title="Cautious&nbsp; &nbsp; :cautious:" loading="lazy" data-shortname=":cautious:" /> It is not stated or clear that once Di is integrated, if you subsequently disable, does that automatically and fully restore MS Defender.Update on the app that Di blocked earlier due to Behavior Analysis | Reflective DLL Injection: I went into dashboard, found the event and had an option to add to allow list (paraphrase), did that, and shortly after got a new Di popup that it was &quot;Restored, is safe and can be accessed.&quot; Easy... until I tried to access it again and got the same Threat Prevented. Posting this not because I&#039;m annoyed, I&#039;m not, I&#039;m sure there&#039;s a tweak in there. Glad that it&#039;s working and preventing stuff Di thinks is bad.&nbsp; PS I sent an email to that app&#039;s developer but I speculate he is unlikely to fix this on his end.EDIT also sent a message to CyF support. (I&#039;m glad Di is catching &quot;stuff&quot;)</blockquote>

[QUOTE="simmerskool, post: 1040353, member: 61091"] here is what the CyF tech wrote earlier: "Integrate with windows security center basically tells defender to let DI do what it wants first then defender will look at things." To me his comment states or implies that MS Defender is not disabled; hence my confusion. I have installed other AV on VM and sure they do disable Defender. For me the real question: tech says, just enable Di integration. Nothing else to do, no reboot, etc... But if I do that and I decide I don't like Di integration, how easy then to get MS Defender working again? I guess I'm a little skittish since ESET borked my win firewall (according to MS support). ok! I did find something officially authoritative on page 130 of the Di Admin Guide | "Integrate D-Client with WSC, by default this feature is disabled...If Windows Defender (n/k/a MS Defender) is active and the D-Client integration is enabled, Windows Defender is disabled." How does square with CyF tech saying "...basically tells defender to let DI do what it wants first [U][B]then defender will look at things.[/B][/U]" It's not like I want to run MS Defender, I just don't want to break MS Defender, and I want to have the ability to restore Defender without another win10 in-place upgrade :cautious: It is not stated or clear that once Di is integrated, if you subsequently disable, does that automatically and fully restore MS Defender. Update on the app that Di blocked earlier due to Behavior Analysis | Reflective DLL Injection: I went into dashboard, found the event and had an option to add to allow list (paraphrase), did that, and shortly after got a new Di popup that it was "Restored, is safe and can be accessed." Easy... until I tried to access it again and got the same Threat Prevented. Posting this not because I'm annoyed, I'm not, I'm sure there's a tweak in there. Glad that it's working and preventing stuff Di thinks is bad. PS I sent an email to that app's developer but I speculate he is unlikely to fix this on his end. EDIT also sent a message to CyF support. (I'm glad Di is catching "stuff") [/QUOTE]

Verification