# Use the registry path behind Unknown in Defender effective settings

> How should analysts investigate a Defender effective setting whose configuration source is Unknown?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:55+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

How should analysts investigate a Defender effective setting whose configuration source is Unknown?

## Potentially affected

Use this diagnostic review on the Windows device entity page for antivirus settings, ASR rules or exclusions. Preserve the device identity and report time when comparing the displayed state with management policy.

## DSE recommendation

DSE recommends carrying the displayed registry path into the policy investigation instead of classifying Unknown as an absent source.

## Article

## Source facts

The Effective settings view shows actual security-setting values, their configuration sources and report times. When a source is a registry location, Configured By can display Unknown alongside the registry path. The setting details also show configuration attempts that did not take effect; this view covers Windows antivirus settings, ASR rules and exclusions. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-xdr/entity-page-device).

## Applicability

Use this diagnostic review on the Windows device entity page for antivirus settings, ASR rules or exclusions. Preserve the device identity and report time when comparing the displayed state with management policy.

## DSE recommendation

DSE recommends carrying the displayed registry path into the policy investigation instead of classifying Unknown as an absent source. Compare the effective value with the intended policy, review competing attempts, and assign the discrepancy to the responsible management owner. Keep the proposed correction focused on the demonstrated conflict.

## Verification

For an approved test device, record the effective value, attribution path and report time before and after the correction. Confirm the expected configuration after the relevant management cycle. Retain any unsuccessful competing attempt as context, and require an explained result before closing the ticket rather than relying only on a policy deployment status.

## Official references

[Microsoft Learn: Device entity page in Microsoft Defender](https://learn.microsoft.com/en-us/defender-xdr/entity-page-device). Source reviewed September 17, 2026.

## Primary reference

- Name: Device entity page in Microsoft Defender - Microsoft Defender XDR | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-xdr/entity-page-device
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use the registry path behind Unknown in Defender effective settings,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-065-use-the-registry-path-behind-unknown-in-defender-effective-settings/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.