Specify threats upon which default action should not be taken when detected

Policy ID: Threats_ThreatIdDefaultAction
Scope: Computer Configuration
Supported on: At least Windows Server 2012, Windows 8 or Windows RT
Source: Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
Category: Windows Components › Microsoft Defender Antivirus › Threats

Description

This policy setting customize which remediation action will be taken for each listed Threat ID when it is detected during a scan. Threats should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid Threat ID, while the value contains the action ID for the remediation action that should be taken.

Valid remediation action values are:
2 = Quarantine
3 = Remove
6 = Ignore

Options

Specify threats upon which default action should not be taken when detected

Registry

ComputerHKEY_LOCAL_MACHINE

HKLM\Software\Policies\Microsoft\Windows Defender\Threats View registry values

Threats_ThreatIdDefaultAction-

HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatIdDefaultAction View registry values

(list values)REG_SZ

Other policies in the same category

View all policies in this category (2)