About whether a setting in autounattend.xml is invalid?

[devilink]

<component name="Security-Malware-Windows-Defender" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
      <DisableAntiSpyware>true</DisableAntiSpyware>
</component>

Hello, everyone.

The above paragraph I have been using to disable Defender

I've been putting it in specialize, but recently the installation system will report specialize error.

Does anyone know how to solve this problem?

Thanks!

 

[garlin]

Why not post the whole autounattend.xml? (if there are no passwords or product keys)

 

[garlin]

What version of Windows?
https://learn.microsoft.com/en-us/w...y-malware-windows-defender-disableantispyware

Important

DisableAntiSpyware is intended to be used by OEMs and IT Pros to disable Microsoft Defender Antivirus and deploy another antivirus product during deployment. This is a legacy setting that is no longer necessary as Microsoft Defender Antivirus automatically turns itself off when it detects another antivirus program on the endpoint. This setting is not intended for consumer devices, and we’ve decided to remove this registry key. Also, to improve the security posture of our customers and ensure parity across our offerings (SKUs), setting DisableAntiSpyware (and disabling Microsoft Defender Antivirus) on client endpoints will be ignored for customers using Microsoft 365 E3 or E5. This change is included in Microsoft Defender Antimalware platform version 4.18.2108.4 and later (see KB405623). This setting is protected by tamper protection, which is available in all editions of Windows 10, version 1903 and later. Tamper protection is enabled by default for consumers and new enterprise customers. The impact of removing DisableAntiSpyware is limited to versions of Windows 10 prior to 1903 using Microsoft Defender Antivirus. This change does not impact non-Microsoft antivirus connections to the Windows Security app. Those connections will still work as expected.

 

[devilink]

Why not post the whole autounattend.xml? (if there are no passwords or product keys)

thanks, added

 

[devilink]

What version of Windows?
https://learn.microsoft.com/en-us/w...y-malware-windows-defender-disableantispyware

10.0.19044.2006

 

[garlin]

C:\Windows\Panther\diagerr.xml -> ERROR_ACCESS_DENIED

 

[devilink]

C:\Windows\Panther\diagerr.xml -> ERROR_ACCESS_DENIED

It seems that it may be affected by tamper protection.

But it takes effect in offlineServicing and oobeSystem, so strange.

Protect security settings with tamper protection - Microsoft Defender for Endpoint

Use tamper protection to prevent malicious apps from changing important security settings.

learn.microsoft.com