Automatic corrections in Windows Def AV (through GPOs) VS AIR (automatic investigation and response)

%3CLINGO-SUB%20id%3D%22lingo-sub-1453423%22%20slang%3D%22en-US%22%3EAutomatic%20corrections%20in%20Windows%20Def%20AV%20(through%20GPOs)%20VS%20AIR%20(automatic%20investigation%20and%20response)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1453423%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3ECan%20someone%20explain%20me%20how%20automatic%20remediations%2Fupon%20approval%20actions%20work%20if%20the%20GPO%20%22Specify%20threat%20alert%20levels%20at%20which%20default%20action%20should%20not%20be%20taken%20when%20detected%22%20is%20active.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDoes%20the%20alerts%20still%20display%20in%20Action%20Center%20if%20this%20GPO%20is%20active%20and%20set%20%3F%3C%2FP%3E%3CP%3EWhat%20if%20the%20GPO%20is%20not%20active%20but%20users%20take%20actions%20in%20windows%20security%20center%20on%20local%20machine%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethanks%20in%20advance%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

Hello,

Can someone explain me how automatic remediations/upon approval actions work if the GPO "Specify threat alert levels at which default action should not be taken when detected" is active.

 

Does the alerts still display in Action Center if this GPO is active and set ?

What if the GPO is not active but users take actions in windows security center on local machine ?

 

thanks in advance

0 Replies