I'm really confused here. I am using DefenderUI (Agressive Profile) & i noticed today that my `Cloud-delivered protection & Automatic smaple submission is off" & disabled (This setting is managed by your administrator). This is my own personal pc so i am the administrator. Cloud-delivered protection is on according to DefenderUI but not according to Windows. Here are some screenshots:
DefenderUI Cloud-delivered protection is off
- Thread starter ncage
- Start date
- Featured
Please provide comments and solutions that are helpful to the author of this topic.
Hey ncage,
No worries, this kind of mismatch between DefenderUI and the native Windows Security app happens sometimes—it's usually down to how third-party tools like DefenderUI tweak settings under the hood. Let me break it down and suggest some steps to sort it out.
What's likely going on:
DefenderUI (especially in Aggressive mode) often applies configurations via registry edits or Group Policy equivalents, which can make certain options appear "managed by your administrator" in the Windows UI. This locks them out from manual toggling, even on a personal PC where you're the admin. From your screenshots:
- Windows Security shows Cloud-delivered protection and Automatic sample submission as off/disabled (with the admin note).
- DefenderUI shows them as enabled (e.g., Cloud protection level at "Zero trust" and Automatic sample submission on).
In reality, DefenderUI's settings are probably taking precedence, so those features should be active despite what Windows says. But to confirm and fix the discrepancy, we can check a few things.
Quick checks and fixes to try:
- Restart DefenderUI and Windows Security: Close both apps completely (use Task Manager if needed), then reopen them. Sometimes it's just a sync issue.
- Verify via PowerShell: Let's confirm the actual status. Open PowerShell as admin and run:
- SubmitSamplesConsent should be 1 (for always prompt) or 3 (for automatic).Code:Get-MpPreference | Select-Object -Property SubmitSamplesConsent, MAPSReporting
- MAPSReporting should be 2 (for advanced, which aligns with cloud protection).
If they're not what you expect, we can tweak them. - Check Group Policy: Press Win + R, type gpedit.msc, and hit Enter (if you're on Pro/Enterprise; Home edition might need a workaround). Navigate to:
Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > MAPS.
Look for policies like "Join Microsoft MAPS" and "Configure the 'Block at First Sight' feature." If they're set, that could be overriding things—set them to Not Configured and restart. - Reset Defender settings: If the above doesn't help, you could reset Defender to defaults via PowerShell (as admin):
This enables automatic submission and advanced cloud protection. Then, reapply your DefenderUI profile.Code:Set-MpPreference -SubmitSamplesConsent 1 -MAPSReporting 2 - Reinstall or tweak DefenderUI: If it's still wonky, try uninstalling DefenderUI, restarting your PC, and checking Windows Security directly. If everything looks good there, reinstall DefenderUI and set it up again—maybe switch to a less aggressive profile temporarily to test.
If none of that resolves it, could you share the output from that PowerShell command? Also, what Windows version are you on (e.g., 10/11, build number)? That might give more clues. Hang in there—we'll get it straightened out!
If facing conflict while using 3rd party program, just do it yourself.
Run: gpedit.msc
Computer configuration: Administrative template: Windows components: Microsoft defender:
Microsoft defender exploit guard: Attack surface reduction: Configure attack surface reduction rules: Enable
Value name: 01443614-cd74-433a-b99e-2ecdc07bfc25 Value:1
Value name: 5beb7efe-fd9a-4556-801d-275e5ffc04cc Value:1
Value name: c1db55ab-c21a-4637-bb3f-a12568109d35 Value:1
MpEngine:
Configure extended cloud check: Enable (50)
Select cloud protection level: Enable (Zero tolerance blocking level)
Run: gpedit.msc
Computer configuration: Administrative template: Windows components: Microsoft defender:
Microsoft defender exploit guard: Attack surface reduction: Configure attack surface reduction rules: Enable
Value name: 01443614-cd74-433a-b99e-2ecdc07bfc25 Value:1
Value name: 5beb7efe-fd9a-4556-801d-275e5ffc04cc Value:1
Value name: c1db55ab-c21a-4637-bb3f-a12568109d35 Value:1
MpEngine:
Configure extended cloud check: Enable (50)
Select cloud protection level: Enable (Zero tolerance blocking level)
@ncage I think you'd be better served by sending a support email to @danb, or wait for him to reply here. assuming MS Defender is your primary av, changing MSD settings one way with DefenderUI then changing them manually with regedit or with windows standard settings or another 3d-party seems too easy to have unintended consequences for your primary security app. (my 2 cents). another option uninstall DefenderUI, then manually tweak settings or in the alternative try @Andy Ful ConfigureDefender app
Last edited:
Gandalf_The_Grey
Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Forum Veteran
You could try the latest version 1.44 and see if you still have this problem with that version.
Otherwise like @simmerskool suggested, mail or wait for @danb .
Either of these options is actually the best advice, as @Parkinsond alluded to.
You may also like...
-
-
-
-
-
How to Protect Your Windows NTLM Credentials from Zero Day Threats- Started by lokamoka820
- Replies: 1