Function warnIfWindowsDefenderNotActive

windows_asr.go:278–316

warnIfWindowsDefenderNotActive shows a notification if Windows Defender settings might prevent ASR rules from working.

()

// warnIfWindowsDefenderNotActive shows a notification if Windows Defender
// settings might prevent ASR rules from working.
func warnIfWindowsDefenderNotActive() {
	// Cloud Protection.
	{
		command := "(Get-MpPreference).MAPSReporting"
		expectedValue := "2"
		out, err := executeCommand("PowerShell.exe", "-noprofile", "-Command", command)
		if err != nil {
			Info.Printf("Could not verify if Windows Defender Cloud Protection is enabled due to error accessing registry")
			return
		}

		out = strings.ReplaceAll(out, "\r\n", "")
		if out != expectedValue {
			// show notification
			Info.Println("Windows Defender Cloud Protection  is not enabled. Return Value = '" +
				out + "' instead of '2'")
			showInfoDialog("Windows Defender Cloud Protection  is not enabled.\nSome ASR rules won't work.")
		}
	}

	// Real-time protection.
	{
		command := "(Get-MpPreference).DisableRealtimeMonitoring"
		expectedValue := "False"
		out, err := executeCommand("PowerShell.exe", "-noprofile", "-Command", command)
		if err != nil {
			Info.Printf("Could not verify if Windows Defender Cloud Protection is enabled due to error accessing registry")
			return
		}

		out = strings.ReplaceAll(out, "\r\n", "")

		if out != expectedValue {
			Info.Println("Windows Defender Realtime Protection is not enabled. Return Value = '" +
				out + "' instead of 'True'")
			showInfoDialog("Windows Defender Realtime Protection is not enabled.\nASR rules won't work.")
		}
	}
}