Local modification of Microsoft Defender Antivirus policy is blocked

Maester checks this too

MT.1166 (Local Admin Merge should be disabled.) checks the same setting. Running both reports it twice.

Overview

Microsoft Defender Antivirus policy can be weakened when local administrator settings merge with centrally managed settings, especially exclusions and other list preferences. Microsoft Learn documents the Intune Antivirus setting Defender local admin merge, backed by the Defender CSP Configuration/DisableLocalAdminMerge, and states that selecting Yes means only management-defined items are used in the resulting effective policy. This matters because threat actors who gain local administrator rights can try to evade defense by adding exclusions for malware paths, tools, or processes instead of turning Defender Antivirus off. If local merge remains allowed, that defense-evasion step can reduce scanning while execution, credential access, lateral movement, and impact continue. Microsoft also states that DisableLocalAdminMerge must be enabled for tamper protection to protect antivirus exclusions from being merged with local settings. This control does not replace tamper protection, least privilege, or monitoring for suspicious exclusions, and emergency local changes may need a managed exception process. The check reads Intune Endpoint Security Antivirus Settings Catalog policies for the defender_disablelocaladminmerge / DisableLocalAdminMerge setting.

Remediation

• Windows Antivirus policy settings for Microsoft Defender Antivirus for Intune
• Manage antivirus settings with endpoint security policies in Microsoft Intune
• Defender CSP — Configuration/DisableLocalAdminMerge
• Manage tamper protection for your organization using Microsoft Intune

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Endpoint threat protection
Product	Defender
Feature	Endpoint antivirus
Area	Devices and endpoints
ATT&CK	T1685 Disable or Modify Tools, T1564.012 File/Path Exclusions
Licence	INTUNE_A
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.