Microsoft Defender Locked by Unknown Admin Policies on My Personal PC

Hello, Microsoft Community!

I'm experiencing a frustrating issue with my personal computer running Windows 10 Pro (22H2, build 19045).

I am the owner of this computer and have local administrator privileges. However, several Microsoft Defender settings are locked, displaying messages such as:

• "This setting is managed by your administrator."
• "Exclusion modifications have been disabled by your administrator."
• "Your administrator has blocked this action."

I first noticed the problem on October 30, 2026, when trying to launch Lunar Client (Minecraft), which had been working normally about a week earlier.

Microsoft Defender suddenly started blocking the Java installation used by Lunar Client.

1. Microsoft Defender ASR blocking a legitimate application

After investigating Windows Event Viewer, I found multiple security events with the following information:

• Event ID: 1121 — Microsoft Defender Exploit Guard
• ASR Rule ID: C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB
• Rule: Block use of copied or impersonated system tools
• Blocked executable: klist.exe, located inside Lunar Client's Java installation
• Affected Java versions: Java 17 and Java 21

I also identified 17 Attack Surface Reduction (ASR) rules configured in block mode.

2. Unknown administrative security policies

While investigating the Windows Registry, I found the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager

One of its values is:

DisableLocalAdminMerge = 1

I also discovered a large number of Microsoft Defender exclusions associated with enterprise software, including:

• N-able Technologies
• BeAnywhere Support Express
• TOTVS / CorporeRM
• N-central
• Various other corporate applications and executables

These exclusions are visible in Windows Security, but I cannot add or remove them because exclusion management is disabled by the administrator.

I do not recognize these exclusions as necessary for my personal computer.

3. Troubleshooting already performed

Work or school account enrollment

A family member previously connected an educational institution account to this computer. That account has since been removed.

Running dsregcmd /status returned:

• AzureAdJoined: NO
• DomainJoined: NO
• WorkplaceJoined: NO

The Settings → Accounts → Access work or school page is also empty.

Group Policy

Running gpresult /scope computer /r showed:

• OS configuration: Standalone Workstation
• Domain type: Local Computer
• Applied Group Policy Objects: Local Group Policy only

In gpedit.msc, I checked the following policies:

• Path Exclusions — Not Configured
• Process Exclusions — Not Configured
• Configure local administrator merge behavior for lists — Not Configured

Other management checks

• edge://policy shows no configured Microsoft Edge policies.
• No services matching N-able, N-central, BeAnywhere, or SolarWinds were found.
• An enrollment registry query returned WMI_Bridge_SCCM_Server, with no management server address displayed.

Attempted ASR exclusion

I attempted to add an exclusion for Lunar Client's klist.exe using:

Add-MpPreference -AttackSurfaceReductionOnlyExclusions

The command produced no error, but the exclusion did not appear in the effective Defender preferences.

4. What I need help with

My main concern is not just getting Lunar Client working again.

I want to restore legitimate administrative control over the security settings on my personally owned computer, without disabling Microsoft Defender or weakening its protection.

Specifically, I would appreciate guidance on the following questions:

1. How can I identify the source of these administrative restrictions when my PC is no longer connected to a work or school organization?
2. Could previous organizational enrollment have left persistent Microsoft Defender policies after the account was disconnected?
3. What is the safest Microsoft-supported method for identifying and removing obsolete corporate exclusions and restrictions?
4. Why is DisableLocalAdminMerge = 1 present in the Registry when the corresponding local Group Policy setting is "Not Configured"?
5. Can these settings be restored to their normal locally administered state without reinstalling Windows?

I have already contacted Microsoft Support, and the representative recommended posting this issue in the Microsoft Community for further technical assistance.

I understand that Windows 10 has reached the end of regular support. However, I would still appreciate assistance in identifying the source of these restrictions and understanding the appropriate remediation procedure.

I can provide screenshots of the Defender exclusions, Event Viewer logs, Registry values, and Group Policy results if needed.

Thank you in advance for any assistance, especially from members experienced with Microsoft Defender, Attack Surface Reduction, MDM, Intune, or Windows security policy management.