Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Configure local overrides for Microsoft Defender Antivirus settings

4 September 2026Doc update+68 / −45 lines

In brief

The article now states that Group Policy is the only supported method for configuring local override policies. It clarifies the configuration steps, supported tools for users, and local-versus-global exclusion list merge behavior.

What Defender admins need to know

Use the revised Group Policy procedure when managing local Microsoft Defender Antivirus overrides; no administrator action is explicitly required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Prevent or allow users to locally modify Microsoft Defender Antivirus policy settings

By default, Microsoft Defender Antivirus settings deployed viathat you deploy through a Group Policy Object (GPO) to the endpoints in your organization preventsprevent users from locally changing the settings. You might want to allowthose settings locally. However, some users might need to change these settings.settings on their own devices. For example, security researchers and threat investigators mightoften need more control over individual settings on the endpoints they use.settings.

This article explains how toThe following procedures configure local overrides and merge behavior ofcontrol how local and global exclusion lists.lists are merged.

  • Windows

Configure local overrides for Microsoft Defender Antivirus settings using Group Policy

The default settingGroup Policy is the only supported method for configuring these local override policies. By default, the policies isare set to Disabled. WhenIf you change the policiesset a policy to Enabled, users can make changes tochange the associated settingsrelated setting on their devices by using one of the following methods:

To configure local override policies by using Group Policy, follow these settings:steps:

  1. Open the Group Policy Management Console (GPMC) on your Group Policy management computer.

  2. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.

  3. Right-click on the GPO, and then select Edit.

  4. In the Group Policy Management Editor, go to Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus.

    |Real-time protection|Configure local setting override for monitoring file and program activity on your computer|Enable and configure Microsoft Defender Antivirus always-on protection and monitoring| |Real-time protection|Configure local setting override for monitoring for incoming and outgoing file activity|Enable and configure Microsoft Defender Antivirus always-on protection and monitoring| |Real-time protection|Configure local setting override for scanning all downloaded files and attachments|Enable and configure Microsoft Defender Antivirus always-on protection and monitoring| |Real-time protection|Configure local setting override forto turn on behavior monitoring|Enable and configure Microsoft Defender Antivirus always-on protection and monitoring| |Real-time protection|Configure local setting override to turn on real-time protection|Enable and configure Microsoft Defender Antivirus always-on protection and monitoring| |Remediation|Configure local setting override for the time of day to run a scheduled full scan to complete remediation|Configure remediation for scans| |Scan|Configure local setting override for maximum percentage of CPU utilization|Configure and run scans| |Scan|Configure local setting override for schedulethe scheduled scan day|About scheduled scans| |Scan|Configure local setting override for scheduled quick scan time|About scheduled scans| |Scan|Configure local setting override for scheduled scan time|About scheduled scans| |Scan|Configure local setting override for the scan type to use for a scheduled scan|About scheduled scans|

  5. In the details pane offor the selected Location you selected, open, find the setting you want to configure as identified bylisted in the Setting value incolumn of the previous table (fortable. For example, select Configure local setting override for reporting to Microsoft MAPS). You can useOpen the setting by using any of the following methods to open the setting:methods:

    • Double-click on the setting.
    • Right-click on the setting, and then select Edit.
    • Select the setting, and then select Action > Edit.

  6. In the setting window that opens, select your desiredthe required configuration (for example, Enabled or Disabled), and then Selectselect OK.

    Repeat the previousthese steps for any other settings.each setting you want to configure.

  7. Deploy the GPO as usual.to the devices you want to manage.

Configure how locally and globally defined threat remediation and exclusions lists are merged

You can also configurecontrol how locally and globally defined lists are combined or merged with globally defined lists. Thismerged. The local administrator merge behavior setting applies to the following features:

By default, lists configured in local group policyLocal Group Policy and the Windows Security app are mergedmerge with lists defined byfrom your deployed GPO. If the appropriatelists conflict, the deployed GPO you deployed. Where there are conflicts, the globally defined list takes precedence. You can disable this setting to ensurelocal list merging so that only globally defined lists (for example, from any deployed GPOs)management policies are used.

Use Microsoft Intune to disable local list merging

[!INCLUDE intune-recommended-separate-product]

To disable local list merging in Microsoft Intune, use an endpoint security Antivirus policy. For detailed instructions, see Create endpoint security policies or Modify existing policies (links open new tabs in the Intune documentation).

When you create the policy, use these specific settings:

When you create or modify the policy, use these specific settings on the Configuration settings tab:

  • Disable local admin merge: Select Disable local admin merge.

For more information about antivirus policy profiles available in Microsoft Intune, see Antivirus policy for endpoint security in Intune.

Use the Microsoft Defender portal to disable local list merging

If your organization manages endpoint security policies in the Microsoft Defender portal, use a Microsoft Defender Antivirus policy to disable local list merging.

For detailed instructions, see Create an endpoint security policy or Edit an endpoint security policy (links open new tabs).

When you create the policy on the Windows policies tab of the Endpoint security policies page in the Defender portal at https://security.microsoft.com/policy-inventory?osPlatform=Windows, use these specific settings:

  • Select platform: Select Windows.
  • Select template: Select Microsoft Defender Antivirus.

When you create or modify the policy, use this specific setting on the Configuration settings tab:

  • Disable local admin merge: Select Disable local admin merge.

Use Group Policy to disable local list merging

To disable local list merging by using Group Policy, follow these steps:

  1. Open the Group Policy Management Console (GPMC) on your Group Policy management computer.

  2. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.

  3. Right-click on the GPO, and then select Edit.

  4. In the Group Policy Management Editor, go to Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus.

  5. In the details pane of Microsoft Defender Antivirus, open the Configure local administrator merge behavior for lists setting by using any of the following methods:

    • Double-click on the setting.
    • Right-click on the setting, and then select Edit.
    • Select the setting, and then select Action > Edit.

  6. In the setting window that opens, select Disabled, and then select OK.

    • Administrative Templates (.admx) for Windows 11 2022 Update (22H2)
    • Administrative Templates (.admx) for Windows 10 November 2021 Update (21H2)

Use Microsoft Intune to disable local list merging

To disable local list merging in a Microsoft Intune Endpoint Security Antivirus policy, see Create an endpoint security policy (opens in a new tab in the Intune documentation).

When creating an Antivirus policy, use these settings:

  • Policy type: Antivirus
  • Platform: Windows
  • Profile: Microsoft Defender Antivirus

When creating or modifying an Antivirus policy, use this setting on the Configuration settings tab:

  • Disable local admin merge: Select Disable local admin merge.

For more information about antivirus policy profiles available in Microsoft Intune, see Antivirus policy for endpoint security in Intune.