MC1227621 High Major change
(Updated) Microsoft Defender Antivirus: Change to exclusion storage when using MDE security settings management
Summary AI-generated
Starting March 2026, Defender Antivirus exclusions won't be visible in the registry for devices managed by MDE; use PowerShell cmdlets to retrieve settings instead.
Suggested actions AI-generated
- Update monitoring scripts to use PowerShell cmdlets
- Revise documentation and workflows
- Inform monitoring teams of registry change
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1187386 Microsoft Defender for Identity alerts transitioning to XDR-based detection platform
- MC1220762 (Updated) Retirement notice: MDE and XDR Advanced Hunting APIs retiring; migrate to Microsoft Graph Security API
- MC1465771 Microsoft Defender XDR: DLP alerts will be set as behaviors by default
- MC1381119 Microsoft Defender for Endpoint security updates move to Microsoft Update on Windows
- MC1381122 Microsoft Defender XDR: Retirement of in-app OS update notifications in Defender for Endpoint (iOS)
- MC1191616 Microsoft Secure Score: New recommendations for Microsoft Defender for Endpoint
Original post from Microsoft
Updated February 13, 2026: We have updated the content. Thank you for your patience.
[Introduction]
Microsoft Defender Antivirus on Windows is updating how antivirus configuration settings, such as exclusions, are stored when Microsoft Defender for Endpoint (MDE) security settings management is enabled. Starting with platform release 4.18.25110.6, devices using MDE security settings management will no longer store readable exclusion values in the local device registry. Organizations must retrieve configuration using supported Microsoft Defender PowerShell cmdlets, such as Get-MpPreference.
[When this will happen:]
General Availability (Worldwide): We will begin rolling out early March 2026 and expect to complete by late March 2026.
[How this affects your organization:]
Who is affected:
- Organizations using Microsoft Defender for Endpoint security settings management.
- Admins or tools relying on registry-based monitoring of antivirus settings.
What will happen:
- Defender antivirus configuration, such as exclusions, values will no longer be readable from the local device registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender. As such registry‑based extractions will no longer be supported.
- Supported Microsoft Defender PowerShell cmdlets (such as Get-MpPreference) will become the required method to retrieve antivirus configuration settings.
- Devices not using MDE configuration management are not affected.
- The feature is on by default for tenants using MDE configuration management.
[What you can do to prepare:]
- Update monitoring workflows and scripts to use supported PowerShell cmdlets such as:
-
Get-MpPreference Get-MpComputerStatus
-
- Review internal documentation on retrieving antivirus settings.
- Notify helpdesk or monitoring teams that registry-based queries will no longer return exclusion data.
Learn more: Troubleshoot Microsoft Defender Antivirus settings - Microsoft Defender for Endpoint | Microsoft Learn (will be updated to reflect this change)
[Compliance considerations:]
No compliance considerations identified, review as appropriate for your organization.
Additional details from Microsoft
- Summary
- Starting March 2026, Microsoft Defender Antivirus with MDE security settings will stop storing readable exclusions in the local registry. Organizations must use PowerShell cmdlets like Get-MpPreference to retrieve settings. Registry-based monitoring will no longer work; update scripts and notify teams accordingly.