Changes

* Soon after installation it can recognise potentially useful software as a threat. For example if you have UltraVNC installed it will flag up UltraVNC.exe and RealVNC.exe. There's a risk that a user, when prompted, will choose to remove or quarantine such files and remove the administrator's ability to connect. Administrative users can allow, quarantine or remove suspicious files where as Limited users can only remove or quarantine suspicious files. It would be useful to script the white-listing of specific files that should not be considered a threat, upon installation.  White-listing can be performed maually manually using: Show details → Recommendation → Select an action → Allow → Apply actions (note that Close means 'don't take any action at this point') → Close - this is saved system-wide. Once done manually you can export the following registry "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Threats\ThreatIDDefaultAction". This key contains a list of signatures which are allowed and the action to perform, being dword:00000006 the action "Allow". Then import this file into the rest of computers with "regedit /s file.reg". Following the above example, to allow RealVNC and UltraVNC the registry file should look like this: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Threats\ThreatIDDefaultAction]; Allow RealVNC"7480"=dword:00000006; Allow UltraVNC"16555"=dword:00000006 Also, to set up exclusion paths and processes silently you could include the following keys in the registry file: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes]"C:\\Program Files\\UltraVNC\\winvnc.exe"=dword:00000000[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths]"C:\\Program Files\\UltraVNC\\winvnc.exe"=dword:00000000