Microsoft Defender Locked by Unknown Admin Policies on My Personal PC
Hello, Microsoft Community! I'm experiencing a frustrating issue with my personal computer running Windows 10 Pro (22H2, build 19045). I am the owner of this computer and have local administrator privileges. However, several Microsoft Defender settings are locked, displaying messages such as: "This setting is managed by your administrator." "Exclusion modifications have been disabled by your administrator." "Your administrator has blocked this action." I first noticed the problem on October 30, 2026, when trying to launch Lunar Client (Minecraft), which had been working normally about a week earlier. Microsoft Defender suddenly started blocking the Java installation used by Lunar Client. 1. Microsoft Defender ASR blocking a legitimate application After investigating Windows Event Viewer, I found multiple security events with the following information: Event ID: 1121 — Microsoft Defender Exploit Guard ASR Rule ID: C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB Rule: Block use of copied or impersonated system tools Blocked executable: klist.exe, located inside Lunar Client's Java installation Affected Java versions: Java 17 and Java 21 I also identified 17 Attack Surface Reduction (ASR) rules configured in block mode. 2. Unknown administrative security policies While investigating the Windows Registry, I found the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager One of its values is: DisableLocalAdminMerge = 1 I also discovered a large number of Microsoft Defender exclusions associated with enterprise software, including: N-able Technologies BeAnywhere Support Express TOTVS / CorporeRM N-central Various other corporate applications and executables These exclusions are visible in Windows Security, but I cannot add or remove them because exclusion management is disabled by the administrator. I do not recognize these exclusions as necessary for my personal computer. 3. Troubleshooting already performed Work or school account enrollment A family member previously connected an educational institution account to this computer. That account has since been removed. Running dsregcmd /status returned: AzureAdJoined: NO DomainJoined: NO WorkplaceJoined: NO The Settings → Accounts → Access work or school page is also empty. Group Policy Running gpresult /scope computer /r showed: OS configuration: Standalone Workstation Domain type: Local Computer Applied Group Policy Objects: Local Group Policy only In gpedit.msc, I checked the following policies: Path Exclusions — Not Configured Process Exclusions — Not Configured Configure local administrator merge behavior for lists — Not Configured Other management checks edge://policy shows no configured Microsoft Edge policies. No services matching N-able, N-central, BeAnywhere, or SolarWinds were found. An enrollment registry query returned WMI_Bridge_SCCM_Server, with no management server address displayed. Attempted ASR exclusion I attempted to add an exclusion for Lunar Client's klist.exe using: Add-MpPreference -AttackSurfaceReductionOnlyExclusions The command produced no error, but the exclusion did not appear in the effective Defender preferences. 4. What I need help with My main concern is not just getting Lunar Client working again. I want to restore legitimate administrative control over the security settings on my personally owned computer, without disabling Microsoft Defender or weakening its protection. Specifically, I would appreciate guidance on the following questions: How can I identify the source of these administrative restrictions when my PC is no longer connected to a work or school organization? Could previous organizational enrollment have left persistent Microsoft Defender policies after the account was disconnected? What is the safest Microsoft-supported method for identifying and removing obsolete corporate exclusions and restrictions? Why is DisableLocalAdminMerge = 1 present in the Registry when the corresponding local Group Policy setting is "Not Configured"? Can these settings be restored to their normal locally administered state without reinstalling Windows? I have already contacted Microsoft Support, and the representative recommended posting this issue in the Microsoft Community for further technical assistance. I understand that Windows 10 has reached the end of regular support. However, I would still appreciate assistance in identifying the source of these restrictions and understanding the appropriate remediation procedure. I can provide screenshots of the Defender exclusions, Event Viewer logs, Registry values, and Group Policy results if needed. Thank you in advance for any assistance, especially from members experienced with Microsoft Defender, Attack Surface Reduction, MDM, Intune, or Windows security policy management.
Topic: Unable to Edit or Delete Promoted Results - Pros/Cons of Organization Search
We've run into an ongoing issue in utilizing Promoted Results in our SharePoint environment (specific questions below). We utilize a scoped search to just search a single site collection and have historically used Promoted Results frequently to ensure our most commonly used resources fire at the top of our search results for users. Earlier this year, we suddenly were no longer able to edit our Promoted Results. Every attempt at saving any changes or even deleting the entire query rule resulted in an error message and no change to the rule. As a result we now have Promoted Results firing that feature broken URLs. We cannot change them or delete them. A developer we work with attempted to override and make changes via a PowerShell script, but he was unsuccessful. We are aware of the deprecation of Promoted Results in favor of Bookmarks. However, this should not impact our ability to simply delete existing Promoted Results. We escalated the issue to Microsoft and were told there is a "corruption" in our site that is not fixable. The proposed solution provided by Microsoft was to rebuild our entire site and migrate our entire site collection to the new environment. We have a lot of customization in our existing site, and we don't feel the workload of this rebuild is the right approach at this time, and we are covering all our bases. We recognize that moving forward to utilizing Bookmarks may be our only option, and we have tested Bookmarks in our environment. Bookmarks however only fire on Organization search (i.e., not in our scoped search environment). Organization search currently pulls in too many non-relevant search results that we don't want our users to see, but it may be the only environment where we can ensure our broken Promoted Results aren't appearing. My questions for the community based on this are: Has anyone encountered a similar error with Promoted Results - as in, the results are firing, but you are unable to edit or delete them on the back-end? Has anyone found a solution to this issue? At this point, we would settle for just being able to delete the corrupted query rules. If we have to switch to Organization Search, is anyone aware of any customization available within Organization Search? We've historically used query rules (not just promoted results) to ensure certain results are elevated, and we don't want to lost that customization. What are the pros and cons of utilizing Organization search as our main search feature? Is there any other solution here that we are missing? My apologies if any of my terminology or explanation is lacking. I do appreciate any feedback as we are still struggling to find the best solution.