Skip to main content
Version: 2.1.1-preview

MT.1154 - Full Scan Removable Drives should be enabled

Overview​

Verify that full scan of removable drives is enabled to mitigate USB risks.

Disabled removable drive scanning allows USB-based malware infections.

Remediation action:​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Enable Allow Full Scan on Removable Drives

Test Metadata​

FieldValue
Test IDMT.1154
SeverityHigh
SuiteM365 Advisor
CategoryDefender
PowerShell testTest-MtMdeRemovableDriveScanning
TagsDefender, M365Advisor, MT.1154

Remediation​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Enable Allow Full Scan on Removable Drives

Source​

  • Pester test: tests/M365Advisor/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
  • PowerShell source: powershell/public/M365Advisor/defender/Test-MtMdeRemovableDriveScanning.ps1