Network isolation |
Your IT administrator has caused Windows Defender to disconnect your device. Contact IT help desk. |
SENSE_ISOLATION |
Yes |
Network isolation customized |
Company name has caused Windows Defender to disconnect your device. Contact IT help desk phone number, email address, url. |
SENSE_ISOLATION_CUSTOM (body) |
Yes |
Restricted access |
Your IT administrator has caused Windows Defender to limit actions on this device. Some apps may not function as expected. Contact IT help desk. |
SENSE_PROCESS_RESTRICTION |
Yes |
Restricted access customized |
Company has caused Windows Defender to limit actions on this device. Some apps may not function as expected. Contact IT help desk. |
SENSE_PROCESS_RESTRICTION_CUSTOM (body) |
Yes |
HVCI, driver compat check fails (upon trying to enable) |
There may be an incompatibility on your device. |
HVCI_ENABLE_FAILURE |
Yes |
HVCI, reboot needed to enable |
The recent change to your protection settings requires a restart of your device. |
HVCI_ENABLE_SUCCESS |
Yes |
Item skipped in scan, due to exclusion setting, or network scanning disabled by admin |
The Microsoft Defender Antivirus scan skipped an item due to exclusion or network scanning settings. |
ITEM_SKIPPED |
Yes |
Remediation failure |
Microsoft Defender Antivirus couldn’t completely resolve potential threats. |
CLEAN_FAILED |
Yes |
Follow-up action (restart & scan) |
Microsoft Defender Antivirus found threat in file name. Please restart and scan your device. Restart and scan |
MANUALSTEPS_REQUIRED |
Yes |
Follow-up action (restart) |
Microsoft Defender Antivirus found threat in file. Please restart your device. |
WDAV_REBOOT |
Yes |
Follow-up action (Full scan) |
Microsoft Defender Antivirus found threat in file. Please run a full scan of your device. |
FULLSCAN_REQUIRED |
Yes |
Sample submission prompt |
Review files that Windows Defender will send to Microsoft. Sending this information can improve how Microsoft Defender Antivirus helps protect your device. |
SAMPLE_SUBMISSION_REQUIRED |
Yes |
OS support ending warning |
Support for your version of Windows is ending. When this support ends, Microsoft Defender Antivirus won’t be supported, and your device might be at risk. |
SUPPORT_ENDING |
Yes |
OS support ended, device at risk |
Support for your version of Windows has ended. Microsoft Defender Antivirus is no longer supported, and your device might be at risk. |
SUPPORT_ENDED and SUPPORT_ENDED_NO_DEFENDER |
Yes |
Summary notification, items found |
Microsoft Defender Antivirus successfully took action on n threats since your last summary. Your device was scanned n times. |
RECAP_FOUND_THREATS_SCANNED |
No |
Summary notification, items found, no scan count |
Microsoft Defender Antivirus successfully took action on n threats since your last summary. |
RECAP_FOUND_THREATS |
No |
Summary notification, no items found, scans performed |
Microsoft Defender Antivirus did not find any threats since your last summary. Your device was scanned n times. |
RECAP_NO THREATS_SCANNED |
No |
Summary notification, no items found, no scans |
Microsoft Defender Antivirus did not find any threats since your last summary. |
RECAP_NO_THREATS |
No |
Scan finished, manual, threats found |
Microsoft Defender Antivirus scanned your device at timestamp on date, and took action against threats. |
RECENT_SCAN_FOUND_THREATS |
No |
Scan finished, manual, no threats found |
Microsoft Defender Antivirus scanned your device at timestamp on date. No threats were found. |
RECENT_SCAN_NO_THREATS |
No |
Threat found |
Microsoft Defender Antivirus found threats. Get details. |
CRITICAL |
No |
LPS on notification |
Microsoft Defender Antivirus is periodically scanning your device. You’re also using another antivirus program for active protection. |
PERIODIC_SCANNING_ON |
No |
Long running BaFS |
Your IT administrator requires a security scan of this item. The scan could take up to n seconds. |
BAFS |
No |
Long running BaFS customized |
Company requires a security scan of this item. The scan could take up to n seconds. |
BAFS_DETECTED_CUSTOM (body) |
No |
Sense detection |
This application was removed because it was blocked by your IT security settings |
WDAV_SENSE_DETECTED |
No |
Sense detection customized |
This application was removed because it was blocked by your IT security settings |
WDAV_SENSE_DETECTED_CUSTOM (body) |
No |
Ransomware specific detection |
Microsoft Defender Antivirus has detected threats which may include ransomware. |
WDAV_RANSOMWARE_DETECTED |
No |
ASR (HIPS) block |
Your IT administrator caused Windows Defender Security Center to block this action. Contact your IT help desk. |
HIPS_ASR_BLOCKED |
No |
ASR (HIPS) block customized |
Company caused Windows Defender Security Center to block this action. Contact your IT help desk. |
HIPS_ASR_BLOCKED_CUSTOM (body) |
No |
CFA (FolderGuard) block |
Controlled folder access blocked process from making changes to the folder path |
FOLDERGUARD_BLOCKED |
No |
Network protect (HIPS) network block customized |
Company caused Windows Defender Security Center to block this network connection. Contact your IT help desk. |
HIPS_NETWORK_BLOCKED_CUSTOM (body) |
No |
Network protection (HIPS) network block |
Your IT administrator caused Windows Defender Security Center to block this network connection. Contact your IT help desk. |
HIPS_NETWORK_BLOCKED |
No |
PUA detection, not blocked |
Your settings cause the detection of any app that might perform unwanted actions on your computer. |
PUA_DETECTED |
No |
PUA notification |
Your IT settings caused Microsoft Defender Antivirus to block an app that may potentially perform unwanted actions on your device. |
PUA_BLOCKED |
No |
PUA notification, customized |
Company caused Microsoft Defender Antivirus to block an app that may potentially perform unwanted actions on your device. |
PUA_BLOCKED_CUSTOM (body) |
No |
Network isolation ended |
|
|
No |
Network isolation ended, customized |
|
|
No |
Restricted access ended |
|
|
No |
Restricted access ended, customized |
|
|
No |
Dynamic lock on, but bluetooth off |
|
|
No |
Dynamic lock on, bluetooth on, but device unpaired |
|
|
No |
Dynamic lock on, bluetooth on, but unable to detect device |
|
|
No |
NoPa or federated no hello |
|
|
No |
NoPa or federated hello broken |
|
|
No |