hkey_local_machine software policies microsoft windows defender

Having a single instance means that threat hunting and automation has full visibility of all devices across the entire organisation which is critical when a threat is hitting multiple endpoints.

For example, in a large organisation spanning multiple geos rather than each geo having their own instance of Microsoft Defender for Endpoint, you would have a single instance where access is controlled through the use of roles and machine groups. Really the purpose of this is to enable a level of control such that different users can log into the portal and see only the machines that they are responsible for. The primary use for tagging is to allow you to create machine groups that can then be used for applying RBAC permissions. We have split this into three parts to cover the basics but also some advanced scenarios for how to use tagging in your environment, so make sure to stay tuned to the blog for the full series. In this blog we wanted to cover not only the primary uses for the tagging functionality, but also to explain some tips and tricks around how to effectively use this within your organisation. This is a functionality that was introduced to allow you to apply a granular level of control over how you manage your devices. One important feature which often isn’t utilised correctly is the use of tags within Microsoft Defender for Endpoint.

Hkey_local_machine software policies microsoft windows defender