Use the registry path behind Unknown in Defender effective settings

Source facts

The Effective settings view shows actual security-setting values, their configuration sources and report times. When a source is a registry location, Configured By can display Unknown alongside the registry path. The setting details also show configuration attempts that did not take effect; this view covers Windows antivirus settings, ASR rules and exclusions. Microsoft Learn.

Applicability

Use this diagnostic review on the Windows device entity page for antivirus settings, ASR rules or exclusions. Preserve the device identity and report time when comparing the displayed state with management policy.

DSE recommendation

DSE recommends carrying the displayed registry path into the policy investigation instead of classifying Unknown as an absent source. Compare the effective value with the intended policy, review competing attempts, and assign the discrepancy to the responsible management owner. Keep the proposed correction focused on the demonstrated conflict.

Verification

For an approved test device, record the effective value, attribution path and report time before and after the correction. Confirm the expected configuration after the relevant management cycle. Retain any unsuccessful competing attempt as context, and require an explained result before closing the ticket rather than relying only on a policy deployment status.

Official references

Microsoft Learn: Device entity page in Microsoft Defender. Source reviewed September 17, 2026.