# Local modification of Microsoft Defender Antivirus policy is blocked
Microsoft Defender Antivirus policy can be weakened when local administrator settings merge with centrally managed settings, especially exclusions and…
Source: https://maester.dev/docs/tests/ZTA.41119
:::note[Maester checks this too]
[MT.1166](/docs/tests/MT.1166) (Local Admin Merge should be disabled.) checks the same setting. Running both reports it twice.
:::
## Overview
Microsoft Defender Antivirus policy can be weakened when local administrator settings merge with centrally managed settings, especially exclusions and other list preferences. Microsoft Learn documents the Intune Antivirus setting Defender local admin merge, backed by the Defender CSP Configuration/DisableLocalAdminMerge, and states that selecting Yes means only management-defined items are used in the resulting effective policy. This matters because threat actors who gain local administrator rights can try to evade defense by adding exclusions for malware paths, tools, or processes instead of turning Defender Antivirus off. If local merge remains allowed, that defense-evasion step can reduce scanning while execution, credential access, lateral movement, and impact continue. Microsoft also states that DisableLocalAdminMerge must be enabled for tamper protection to protect antivirus exclusions from being merged with local settings. This control does not replace tamper protection, least privilege, or monitoring for suspicious exclusions, and emergency local changes may need a managed exception process. The check reads Intune Endpoint Security Antivirus Settings Catalog policies for the defender_disablelocaladminmerge / DisableLocalAdminMerge setting.
## Remediation
- [Windows Antivirus policy settings for Microsoft Defender Antivirus for Intune](https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/ref-antivirus-defender-settings-windows)
- [Manage antivirus settings with endpoint security policies in Microsoft Intune](https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/antivirus)
- [Defender CSP — Configuration/DisableLocalAdminMerge](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp#configurationdisablelocaladminmerge)
- [Manage tamper protection for your organization using Microsoft Intune](https://learn.microsoft.com/en-us/defender-endpoint/manage-tamper-protection-intune)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Endpoint threat protection |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Endpoint antivirus |
| Area | Devices and endpoints |
| ATT&CK | [T1685](/docs/tests?mitre=T1685) Disable or Modify Tools, [T1564.012](/docs/tests?mitre=T1564.012) File/Path Exclusions |
| Licence | INTUNE_A |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.