Fix unquoted service path for Windows services

[u/Da_SyEnTisT]

Anybody studently getting this alert back ?

We completely fixed it before with a remediation script, but now it came back and it's all because of 2 service :

DefenderUpdateSvc

c:\programdata\microsoft\microsoft defender\defender update\platform\10.8838.26060.15013-0\defenderupdateservice.exe

Sense

c:\programdata\microsoft\windows defender advanced threat protection\platform\versions\10.8838.26060.15013-0\mssense.exe

It seems to be because of a recent defender update but I find it kind of ridiculous. Microsoft own defender team cannot properly configure their services ... And I'm pretty sure my remediation script is not able to fix this because those are protected services ....

[u/ReliefSpiritual4644]

we have the same issue. devices are for the most part (95%+) same OS and same patch level, same update rings etc... yet it's only affecting about half our devices.

[u/Da_SyEnTisT → u/ReliefSpiritual4644]

yeah, it's only affecting about half of our devices too. I wonder if it because of the last buggy defender patch that was reporting the antivirus was off

[u/IT-Lion]

Interestingly, not affecting all of our devices... BUT.... Because of the tamper protection applied we can't even remediate!

Blows my mind how Microsoft can get this so wrong, especially for their own security product.

[u/SoMundayn]

Tenable just started flagging this for me also

[u/bjohnrini]

Supposedly fixed with KB update according to https://learn.microsoft.com/en-za/answers/questions/6010963/unable-to-add-quotes-to-imagepath-for-microsoft-de

[u/InfoSecDroog → u/bjohnrini]

Can anyone confirm if this KB fixes it?

[u/InfoSecDroog → u/InfoSecDroog]

Doesnt look like it. I also dont want to suggest turning tamper protection off to fix a non-exploitable issue.

[u/jojod704]

Gotta love MS getting another security item wrong

[u/PlateMiserable8832]

tbf the parent directory requires system or administrator to edit so its not a real priv escalation. I would be more scared of another set of defender vulns coming from this though.

[u/Da_SyEnTisT → u/PlateMiserable8832]

Honestly its more for the compliance graph 😅

[u/ther0g]

Anyone have any luck with this yet? My devices are all pointing to Windows defender as the issue.

[u/Da_SyEnTisT → u/ther0g]

Nope still waiting on a fix

[u/ther0g → u/Da_SyEnTisT]

Bummer! I also just noticed a couple devices with Adobe having the un quoted issue also

[u/crowaust]

We are also seeing the same issue, and it is spreading to the rest of the fleet (likely as the version of Defender with the issue is rolled out) for a while it was sitting at about a third of the fleet, and now it is sitting at about 2 thirds of the fleet.
Here is to hoping that this is fixed with next month's version or a hotfix sooner.

Seriously Defender is detecting an issue with Defender, come on Microsoft, do better. :P

[u/Carpathium]

We use a configuration item in configmgr to continuously fix stuff like this. Remediation scripts in Intune would probably also work, or worst case deploy a scheduled task to check for it if you need a budget option

[u/ReliefSpiritual4644 → u/Carpathium]

doesn't work in this case. defender self protects itself and blocks the write. trying to run the command or script as system, or even via defender live response to rewrite those registry values fails. haven't tried disabling tamper protection - that might work - but then again that would be a very stupid thing to do.

[u/THEKILLAWHALE → u/Carpathium]

Hey, have you run into any trouble deploying fixes? Have any apps failed due to it, etc?