{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/", "slug": "dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings", "url": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/" }, "title": "Use the registry path behind Unknown in Defender effective settings", "summary": "How should analysts investigate a Defender effective setting whose configuration source is Unknown?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:55+00:00", "modified_at": "2026-09-17T16:38:45+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 206, "potentially_affected": "Use this diagnostic review on the Windows device entity page for antivirus settings, ASR rules or exclusions. Preserve the device identity and report time when comparing the displayed state with management policy.", "dse_recommendation": "DSE recommends carrying the displayed registry path into the policy investigation instead of classifying Unknown as an absent source.", "primary_source": { "name": "Device entity page in Microsoft Defender - Microsoft Defender XDR | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-xdr/entity-page-device", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The Effective settings view shows actual security-setting values, their configuration sources and report times. When a source is a registry location, Configured By can display Unknown alongside the registry path. The setting details also show configuration attempts that did not take effect; this view covers Windows antivirus settings, ASR rules and exclusions. Microsoft Learn.

\n

Applicability

\n

Use this diagnostic review on the Windows device entity page for antivirus settings, ASR rules or exclusions. Preserve the device identity and report time when comparing the displayed state with management policy.

\n

DSE recommendation

\n

DSE recommends carrying the displayed registry path into the policy investigation instead of classifying Unknown as an absent source. Compare the effective value with the intended policy, review competing attempts, and assign the discrepancy to the responsible management owner. Keep the proposed correction focused on the demonstrated conflict.

\n

Verification

\n

For an approved test device, record the effective value, attribution path and report time before and after the correction. Confirm the expected configuration after the relevant management cycle. Retain any unsuccessful competing attempt as context, and require an explained result before closing the ticket rather than relying only on a policy deployment status.

\n

Official references

\n

Microsoft Learn: Device entity page in Microsoft Defender. Source reviewed September 17, 2026.

", "content_text": "Source facts\nThe Effective settings view shows actual security-setting values, their configuration sources and report times. When a source is a registry location, Configured By can display Unknown alongside the registry path. The setting details also show configuration attempts that did not take effect; this view covers Windows antivirus settings, ASR rules and exclusions. Microsoft Learn.\nApplicability\nUse this diagnostic review on the Windows device entity page for antivirus settings, ASR rules or exclusions. Preserve the device identity and report time when comparing the displayed state with management policy.\nDSE recommendation\nDSE recommends carrying the displayed registry path into the policy investigation instead of classifying Unknown as an absent source. Compare the effective value with the intended policy, review competing attempts, and assign the discrepancy to the responsible management owner. Keep the proposed correction focused on the demonstrated conflict.\nVerification\nFor an approved test device, record the effective value, attribution path and report time before and after the correction. Confirm the expected configuration after the relevant management cycle. Retain any unsuccessful competing attempt as context, and require an explained result before closing the ticket rather than relying only on a policy deployment status.\nOfficial references\nMicrosoft Learn: Device entity page in Microsoft Defender. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nThe Effective settings view shows actual security-setting values, their configuration sources and report times. When a source is a registry location, Configured By can display Unknown alongside the registry path. The setting details also show configuration attempts that did not take effect; this view covers Windows antivirus settings, ASR rules and exclusions. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-xdr/entity-page-device).\n\n## Applicability\n\nUse this diagnostic review on the Windows device entity page for antivirus settings, ASR rules or exclusions. Preserve the device identity and report time when comparing the displayed state with management policy.\n\n## DSE recommendation\n\nDSE recommends carrying the displayed registry path into the policy investigation instead of classifying Unknown as an absent source. Compare the effective value with the intended policy, review competing attempts, and assign the discrepancy to the responsible management owner. Keep the proposed correction focused on the demonstrated conflict.\n\n## Verification\n\nFor an approved test device, record the effective value, attribution path and report time before and after the correction. Confirm the expected configuration after the relevant management cycle. Retain any unsuccessful competing attempt as context, and require an explained result before closing the ticket rather than relying only on a policy deployment status.\n\n## Official references\n\n[Microsoft Learn: Device entity page in Microsoft Defender](https://learn.microsoft.com/en-us/defender-xdr/entity-page-device). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/", "url": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Use the registry path behind Unknown in Defender effective settings", "item": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/", "url": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/", "headline": "Use the registry path behind Unknown in Defender effective settings", "description": "How should analysts investigate a Defender effective setting whose configuration source is Unknown?", "abstract": "How should analysts investigate a Defender effective setting whose configuration source is Unknown?", "articleBody": "Source facts\nThe Effective settings view shows actual security-setting values, their configuration sources and report times. When a source is a registry location, Configured By can display Unknown alongside the registry path. The setting details also show configuration attempts that did not take effect; this view covers Windows antivirus settings, ASR rules and exclusions. Microsoft Learn.\nApplicability\nUse this diagnostic review on the Windows device entity page for antivirus settings, ASR rules or exclusions. Preserve the device identity and report time when comparing the displayed state with management policy.\nDSE recommendation\nDSE recommends carrying the displayed registry path into the policy investigation instead of classifying Unknown as an absent source. Compare the effective value with the intended policy, review competing attempts, and assign the discrepancy to the responsible management owner. Keep the proposed correction focused on the demonstrated conflict.\nVerification\nFor an approved test device, record the effective value, attribution path and report time before and after the correction. Confirm the expected configuration after the relevant management cycle. Retain any unsuccessful competing attempt as context, and require an explained result before closing the ticket rather than relying only on a policy deployment status.\nOfficial references\nMicrosoft Learn: Device entity page in Microsoft Defender. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:33:55+00:00", "dateModified": "2026-09-17T16:38:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use the registry path behind Unknown in Defender effective settings" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 206, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Device entity page in Microsoft Defender - Microsoft Defender XDR | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-xdr/entity-page-device" } } ] } }