Skip to main content
Version: 2.1.1-preview

MT.1166 - Local Admin Merge should be disabled

Overview​

Checks that local admin merge is disabled to block local exclusions in all assigned Microsoft Defender Antivirus policies.

Local admin policy override allows privilege escalation to bypass security controls, enabling local administrators to add exclusions that weaken endpoint protection.

Remediation action:​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Enable Disable Local Admin Merge to prevent local overrides

Test Metadata​

FieldValue
Test IDMT.1166
SeverityHigh
SuiteM365 Advisor
CategoryDefender
PowerShell testTest-MtMdeDisableLocalAdminMerge
TagsDefender, M365Advisor, MT.1166

Remediation​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Enable Disable Local Admin Merge to prevent local overrides

Source​

  • Pester test: tests/M365Advisor/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
  • PowerShell source: powershell/public/M365Advisor/defender/Test-MtMdeDisableLocalAdminMerge.ps1