Windows Defender Real Time Monitoring Status

PowerShell script that you can use to check the status of Windows Defender’s real-time monitoring on a list of computers from a text file

# Import the required module
Import-Module Defender

# Get the list of computers from a text file
$computers = Get-Content -Path "C:\path\to\your\file.txt"

foreach ($computer in $computers) {
    # Get the status of real-time monitoring
    $DefenderStatus = Invoke-Command -ComputerName $computer -ScriptBlock { Get-MpPreference }

    # Display the status
    if ($DefenderStatus.DisableRealtimeMonitoring -eq $false) {
        Write-Output "$computer: Windows Defender real-time monitoring is enabled."
    } else {
        Write-Output "$computer: Windows Defender real-time monitoring is disabled."
    }
}

This script first imports the Defender module, which provides cmdlets to manage Windows Defender. It then reads a list of computers from a text file using the Get-Content cmdlet. For each computer in the list, it retrieves the preferences for Windows Defender using the Get-MpPreference cmdlet via Invoke-Command. The DisableRealtimeMonitoring property of the returned object indicates whether real-time monitoring is disabled ($true) or enabled ($false). The script then checks this property and outputs a message indicating the status of real-time monitoring for each computer.

Please note that you need to run this script with administrative privileges as accessing Windows Defender settings requires admin rights. Also, ensure that your execution policy allows running scripts. You can check your execution policy by running Get-ExecutionPolicy, and set it to allow scripts by running Set-ExecutionPolicy RemoteSigned or Set-ExecutionPolicy Unrestricted (be aware of the security implications). Additionally, you need to have PowerShell remoting enabled on the target computers and have the necessary permissions to perform operations on them. Replace "C:\path\to\your\file.txt" with the actual path to your text file containing the list of computers. Each computer name should be on a new line in the text file.