Forum Discussion
EnableConvertWarnToBlock will not enable - stays False
Hi - please see answers below:
I have 2 machines, both on the same network, connected to the same domain and receiving the same GPO policy enabling these settings. MDE is active and primary - no other AV installed. Network protection is enabled and in block mode.
Both machines have the registry key in place to enable. See below results for your queries:
Machine 1:
Machine 2:
No valid reason why machine 2 should/is different from machine 1. All updates/patches have been applied.
Additional strangeness seen:
Machine 1 - when enabled into troubleshooting mode - network protection goes to 0 and ConvertWarn goes to False
I did not expect that enabling troubleshooting mode would disable network protection?
I can also see the following in the event log:
Once troubleshooting mode is completed (4h), network protection re-enables and ConvertWarn goes to block.
I see the same issue on machine 2, but ConvertWarn always stays as false - even though it it part of the same domain with the same GPO applied and the same registry keys shown. The above event log is not shown on the second machine.
After further investigation I have noted the following:
- when enabled via Intune as per below
The reported setting with Get-MpPreference = True (which is correct and what I want)
When the Intune policy is removed from the device, the setting reverts to False:
Then I configure the same value in GPO as per below:
And confirm the value is applied to the device via gpresult /h
and in the registry:
Yet the client device Get-MpPreference = False
Its as if the GPO setting does not work while the Intune setting does - has anyone else seen this?
I have checked the above in my lab and also on two production client sites and am seeing the same experience where MDE is ignoring the settings set by GPO to "EnableConvertWarnToBlock".
Anyone else able to check their environments please?
Is Microsoft product team able to comment as am sure this used to work!