This commit is contained in:
qtkite 2021-07-19 20:43:11 +10:00
parent de966641a9
commit 39e26fdf18

View File

@ -371,14 +371,16 @@ I first wanted to see how powershell called the command, so i looked through the
```
Get-Command Set-MpPreference | fl
e``
```
If we wanted to read the MSFT_MpPreference class, it is documented here:
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)#requirements
We can access via powershell like so:
```
Get-WmiObject -ClassName MSFT_MpPreference -Namespace root/microsoft/windows/defender
```
If we look further we can write to this using the WMI as i suspected, it is documented here:
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal