How to Prevent Admin Users to add exclusions via Registry? + Simple Posh to disable Real-time?
So I know this is pretty much a quick "REMOVE ADMIN ACCESS!" answer, but in this case it is not. We'd like to know how to prevent users to exclude extensions, paths, or even processes via Registry. We set our policies via GPO so anyone with user admin or in this case the primary user can just add the simple exclusion so defender excludes it. Also, I'd like to know how everyone else prevents users to disable real-time scanning. We will be getting our Intune up and running but we have to have co-management enabled. This will be at the end of the year. Does Exploit Guard help with this?
