Export Antivirus Policy

[doom969]

I have sucessfully exporte settings from Bitlocker and other policies, but I cant seem to find my antivirus policy located in endpoint security, can someon point me in the right direction, been looking with this script as well as graph, but I can never list it
thanks

[Micke-K]

Hello,

Check under Settings Catalog. Some of the Endpoint Security policies uses the Settings Catalog APIs.

Cheers!

[komoornik]

@Micke-K have you ever observed an issue when importing the "new" EDR profiles?

Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/deviceManagement/configurationPolicies (Request ID: 306504f0-3769-4911-b5ac-c1d08af32d6a). Status code: BadRequest. Response message: . Response message: device_vendor_msft_windowsadvancedthreatprotection_onboarding_fromconnector: Unsupported value provided for ValueState - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 092d8b92-7bd3-42b5-a691-dedc691e8e0a - Url: https://fef.msub05.manage.microsoft.com/DeviceConfigV2/DCV2GraphService/de147310-ffff-7149-0407-060123230712/deviceManagement/configurationPolicies?api-version=5023-03-13 Exception: The remote server returned an error: (400) Bad Request.

[Micke-K]

Not really but I have seen similar issues before. Some of them were caused by additional properties eg trying to import properties that are read only.

Do you have and example policy I can try?

Cheers!

[komoornik]

This is with the Endpoint Security - Endpoint detection and response, profile with target: mdm, microsoftSense

https://i.imgur.com/D6LqTEg.png

[Micke-K]

Hello

I had a look at this and it looks like it uses an encrypted value. I could not find any documentation around this and there is no decryption function called in the background.
The value itself is not returned which unfortunately means that it is not supported for export/import. Not sure if this will ever work. Microsoft must implement a way of retrieving the decrypted value.

Cheers!