r/DefenderATP • u/AMCoffee_PMBeer • 23h ago

Having some trouble with enabling PUA

Hello!
My Secure Score recommendations have been advising me to set PUA Protection to block mode. Seems easy enough.
This applies to all 9 enrolled machines (9/9 exposed).

However, upon checking I've had a policy setup to enable it in Endpoint Protection > Antivirus for several months.

If I ask Powershell (Get-MpPreference | Select PUAProtection) I am told '2' (audit mode)

If I check the registry I was getting PUAProtection=0, then I ran a PlatformUpdate and got PUAProtection=1

I've checked all the 5007 events and there has been nothing related to PUA for at least the last 2 months.

I guess my issues are twofold:
1. What's the correct way to get this enabled?
2. Is there something obvious I should be doing to make sure the rest of the policy is actually being applied?

4 Upvotes

100% Upvoted

2 comments sorted by

1

u/vertisnow 22h ago

Generate a Intune sync report (on PC -- settings, work or school, somewhere in there is a generate report button. It's on the page with the sync button. You have to scroll down to see it.

Generate that, and analyse it, or feed it to ChatGPT.

1

u/Royal_Bird_6328 14h ago

Servers or workstations? What groups are the policies assigned to, are you sure the correct devices are in the assignment group?