Microsoft Defender AV must control whether exclusions are visible to Local Admins.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-278658 | WNDF-AV-000054 | SV-278658r1190746_rule | CCI-001170 | medium |
| Description | ||||
| Disabled (Default): If this setting is not configured or disabled, local admins can see exclusions in the Windows Security App or via PowerShell. Enabled: If this setting is enabled, local admins no longer see the exclusion list in Windows Security App or via PowerShell.O13. Note: Applying this setting will not remove exclusions, it only prevents them from being visible to local admins. This is reflected in?Get-MpPreference.I13. | ||||
| STIG | Date | |||
| Microsoft Defender Antivirus Security Technical Implementation Guide | 2026-02-17 | |||
Details
Check Text (C-278658r1190746_chk)
Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Control whether or not exclusions are visible to Local Admins is set to "Enabled"; otherwise, this is a finding.
Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Windows Defender
Criteria: If the value "HideExclusionsFromLocalAdmins" is REG_DWORD = 1, this is not a finding.
If the value is "0", this is a finding.
Fix Text (F-83097r1190745_fix)
Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Control whether exclusions are visible to Local Admins to "Enabled".