Skip to content

Commit ef2c859

Browse files
authored
Update indicator-file.md
Edits include removing registry key editing because that's not supported
1 parent 5326d32 commit ef2c859

File tree

1 file changed

+1
-12
lines changed

1 file changed

+1
-12
lines changed

defender-endpoint/indicator-file.md

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -57,16 +57,8 @@ Understand the following prerequisites before you create indicators for files:
5757

5858
- This feature is available if your organization uses [Microsoft Defender Antivirus](microsoft-defender-antivirus-windows.md) (in active mode)
5959
- The antimalware client version must be `4.18.1901.x` or later. See [Monthly platform and engine versions](microsoft-defender-antivirus-updates.md#platform-and-engine-releases)
60-
6160
- This feature is supported on devices running Windows 10, version 1703 or later, Windows 11, Windows Server 2012 R2, Windows Server 2016 or later, Windows Server 2019, Windows Server 2022, and Windows Server 2025.
62-
- File hash computation is enabled, by setting `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\MpEngine\Enable File Hash Computation` to **Enabled**
63-
64-
Alternatively, use one of these two ways to enable File hash computation:
65-
Run the following command: `Set-MpPreference -EnableFileHashComputation $true`
66-
67-
```cmd
68-
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "EnableFileHashComputation" /t REG_DWORD /d 1 /f
69-
```
61+
- File hash computation is enabled by setting `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\MpEngine\Enable File Hash Computation` to **Enabled**. Or, you can run the following PowerShell command: `Set-MpPreference -EnableFileHashComputation $true`
7062

7163
> [!NOTE]
7264
> File indicators support portable executable (PE) files, including `.exe` and `.dll` files only.
@@ -99,9 +91,6 @@ reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "EnableF
9991
- Action: Specify the action to be taken and provide a description.
10092
- Scope: Define the scope of the device group (scoping isn't available in [Defender for Business](/defender-business/mdb-overview)).
10193

102-
> [!NOTE]
103-
> Device Group creation is supported in both Defender for Endpoint Plan 1 and Plan 2
104-
10594
5. Review the details in the Summary tab, then select **Save**.
10695

10796
## Create a contextual indicator from the file details page

0 commit comments

Comments
 (0)