diff --git a/docset/winserver2025-ps/Defender/Get-MpPreference.md b/docset/winserver2025-ps/Defender/Get-MpPreference.md index 6156eb36c6..977a27ea3c 100644 --- a/docset/winserver2025-ps/Defender/Get-MpPreference.md +++ b/docset/winserver2025-ps/Defender/Get-MpPreference.md @@ -2,10 +2,11 @@ description: Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell. external help file: MSFT_MpPreference.cdxml-help.xml Module Name: Defender -ms.date: 12/20/2016 +ms.date: 11/11/2026 online version: https://learn.microsoft.com/powershell/module/defender/get-mppreference?view=windowsserver2025-ps&wt.mc_id=ps-gethelp schema: 2.0.0 title: Get-MpPreference +ai-usage: ai-assisted --- # Get-MpPreference @@ -40,6 +41,19 @@ The first command gets the preferences, and then stores them in the **$Preferenc The second command uses standard dot syntax to display the **ScanScheduleDay** property of the object stored in the **$Preferences** variable. +### Example 2: View AI agent runtime protection preferences + +```powershell +Get-MpPreference | + Select-Object AiAgentProtection, AiAgentNetworkInspection, PromptEvidenceCollection +``` + +This command displays the device's agent-native inspection, network inspection, and prompt evidence +collection preferences. +The properties require supported Microsoft Defender Antivirus platform and engine updates. +For requirements, configuration, and policy precedence, see +[Set up AI agent runtime protection](/defender-endpoint/configure-ai-agent-runtime-protection). + ## PARAMETERS ### -AsJob diff --git a/docset/winserver2025-ps/Defender/Remove-MpPreference.md b/docset/winserver2025-ps/Defender/Remove-MpPreference.md index 6f6c39caf0..a95499c534 100644 --- a/docset/winserver2025-ps/Defender/Remove-MpPreference.md +++ b/docset/winserver2025-ps/Defender/Remove-MpPreference.md @@ -2,10 +2,11 @@ description: The Remove-MpPreference cmdlet removes exclusions for file name extensions, paths, and processes, or default actions for high, moderate, and low threats. external help file: MSFT_MpPreference.cdxml-help.xml Module Name: Defender -ms.date: 12/20/2016 +ms.date: 11/11/2026 online version: https://learn.microsoft.com/powershell/module/defender/remove-mppreference?view=windowsserver2025-ps&wt.mc_id=ps-gethelp schema: 2.0.0 title: Remove-MpPreference +ai-usage: ai-assisted --- # Remove-MpPreference @@ -45,7 +46,8 @@ Remove-MpPreference [-ExclusionPath ] [-ExclusionExtension ] [-DisableDnsOverTcpParsing] [-DisableSshParsing] [-PlatformUpdatesChannel] [-EngineUpdatesChannel] [-SignaturesUpdatesChannel] [-DisableGradualRelease] [-AllowNetworkProtectionDownLevel] [-AllowDatagramProcessingOnWinServer] [-EnableDnsSinkhole] [-DisableInboundConnectionFiltering] - [-DisableRdpParsing] [-Force] [-CimSession ] [-ThrottleLimit ] [-AsJob] + [-DisableRdpParsing] [-AiAgentProtection] [-AiAgentNetworkInspection] [-PromptEvidenceCollection] + [-Force] [-CimSession ] [-ThrottleLimit ] [-AsJob] [] ``` @@ -69,8 +71,52 @@ Remove-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Windows\App.exe" This command will exclude only that specific file app.exe in that specific folder. +### Example 3: Remove a local prompt evidence collection preference + +```powershell +Remove-MpPreference -PromptEvidenceCollection +``` + +This command removes the locally configured prompt evidence collection preference. +It doesn't remove or override a setting configured through Intune or another management channel. +To explicitly disable local collection instead, use `Set-MpPreference -PromptEvidenceCollection $false`. + ## PARAMETERS +### -AiAgentNetworkInspection + +Removes the locally configured AI agent network inspection preference. +This switch doesn't remove or override managed device policy. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: ani + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -AiAgentProtection + +Removes the locally configured agent-native AI agent runtime protection preference. +This switch doesn't remove or override managed device policy. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: ap + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + ### -AllowDatagramProcessingOnWinServer Indicates that the cmdlet removes whether to disable inspection of UDP connections on Windows Server. @@ -995,6 +1041,26 @@ Accept pipeline input: False Accept wildcard characters: False ``` +### -PromptEvidenceCollection + +Removes the locally configured prompt evidence collection preference. +Removing the preference isn't the same as explicitly disabling collection, and doesn't remove +or override a setting configured through Intune or another management channel. +For requirements and policy precedence, see +[Configure prompt evidence collection](/defender-endpoint/configure-ai-agent-runtime-protection#configure-prompt-evidence-collection). + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: pec + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + ### -ProxyBypass Specifies proxy bypasses. diff --git a/docset/winserver2025-ps/Defender/Set-MpPreference.md b/docset/winserver2025-ps/Defender/Set-MpPreference.md index 3082d74af4..68221b977a 100644 --- a/docset/winserver2025-ps/Defender/Set-MpPreference.md +++ b/docset/winserver2025-ps/Defender/Set-MpPreference.md @@ -2,10 +2,11 @@ description: The Set-MpPreference cmdlet configures preferences for Windows Defender scans and updates. external help file: MSFT_MpPreference.cdxml-help.xml Module Name: Defender -ms.date: 09/29/2025 +ms.date: 11/11/2026 online version: https://learn.microsoft.com/powershell/module/defender/set-mppreference?view=windowsserver2025-ps&wt.mc_id=ps-gethelp schema: 2.0.0 title: Set-MpPreference +ai-usage: ai-assisted --- # Set-MpPreference @@ -65,6 +66,8 @@ Set-MpPreference [-ExclusionPath ] [-ExclusionExtension ] [- [-SignaturesUpdatesChannel ] [-DisableGradualRelease ] [-AllowNetworkProtectionDownLevel ] [-AllowDatagramProcessingOnWinServer ] [-EnableDnsSinkhole ] [-DisableInboundConnectionFiltering ] [-DisableRdpParsing ] + [-AiAgentProtection ] + [-AiAgentNetworkInspection ] [-PromptEvidenceCollection ] [-CimSession ] [-ThrottleLimit ] [-AsJob] [] ``` @@ -115,8 +118,72 @@ PS C:\> Set-MpPreference -SignatureScheduleTime 02:00:00 This command configures preferences to check for definition updates 120 minutes after midnight on days when it's scheduled to check. +### Example 3: Audit AI agent activity + +```powershell +Set-MpPreference -AiAgentProtection Audit -AiAgentNetworkInspection Audit +``` + +This command enables agent-native event inspection and network inspection in audit mode. +Each inspection method detects supported threats without blocking the agent action. +Configure each method independently, using `Block` for enforcement or `Disabled` to turn it off. + +### Example 4: Enable prompt evidence collection + +```powershell +Set-MpPreference -PromptEvidenceCollection $true +``` + +This command enables additional prompt evidence collection on the device. +Use `$false` to disable collection. +Review the privacy considerations in +[Configure prompt evidence collection](/defender-endpoint/configure-ai-agent-runtime-protection#configure-prompt-evidence-collection) +before enabling this setting. + ## PARAMETERS +### -AiAgentNetworkInspection + +Configures network inspection for supported AI agent-to-LLM traffic. +Use `Disabled` to turn off this inspection method, `Audit` to detect and report threats without +blocking, or `Block` to block detected threats at supported inspection points. +This setting is independent of **AiAgentProtection**. +The device preference is disabled by default. + +```yaml +Type: AiAgentNetworkInspectionType +Parameter Sets: (All) +Aliases: ani +Accepted values: Disabled, Block, Audit + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -AiAgentProtection + +Configures AI agent runtime protection through supported agent-native event interfaces. +Use `Disabled` to turn off this inspection method, `Audit` to detect and report threats without +blocking, or `Block` to block detected threats at supported inspection points. +This setting is independent of **AiAgentNetworkInspection**. +The device preference is disabled by default. + +```yaml +Type: AiAgentProtectionType +Parameter Sets: (All) +Aliases: ap +Accepted values: Disabled, Block, Audit + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + ### -AllowDatagramProcessingOnWinServer Specifies whether to disable inspection of UDP connections on Windows Server. @@ -1221,6 +1288,46 @@ Accept pipeline input: False Accept wildcard characters: False ``` +### -PromptEvidenceCollection + +Controls prompt evidence collection for AI agent runtime protection. +When collection is enabled and runtime protection is enabled in audit or block mode, Defender +exposes prompt snippets exchanged between the user and the agent to support deeper analysis of +agent-related alerts. +These snippets include only the portions of user prompts or agent responses identified as suspicious +and relevant to security classification. +Set this parameter to `$true` to enable collection or `$false` to disable it. + +The default is changing from Off to On through an update to the November 2026 Microsoft Defender +Antivirus platform release. +Devices that haven't received that update still default to Off. +Explicitly configured settings take precedence over this default. + +Managed device policy takes precedence over a local PowerShell preference and the tenant-wide +prompt evidence collection preference. +This setting doesn't enable runtime protection or change the audit or block mode of either +inspection method. +Content associated with activity that Defender blocks can still appear in the associated alert +when this additional collection is disabled. + +> [!IMPORTANT] +> Prompt evidence can contain sensitive customer conversations. +> Review your organization's privacy and data-handling requirements before enabling collection. +> For prerequisites and privacy details, see +> [Configure prompt evidence collection](/defender-endpoint/configure-ai-agent-runtime-protection#configure-prompt-evidence-collection). + +```yaml +Type: Boolean +Parameter Sets: (All) +Aliases: pec + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + ### -ProxyBypass Specifies proxy bypasses. @@ -2062,6 +2169,12 @@ This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable ## NOTES +AI agent runtime protection is a preview feature for supported Windows client devices. +The AI agent and prompt evidence parameters require supported Microsoft Defender Antivirus platform +and engine updates. +For requirements and deployment guidance, see +[Set up AI agent runtime protection](/defender-endpoint/configure-ai-agent-runtime-protection). + ## RELATED LINKS [Add-MpPreference](./Add-MpPreference.md)