Configure local administrator merge behavior for lists
This machine-level registry value controls whether Microsoft Defender Antivirus combines locally defined list entries with lists managed centrally through Group Policy.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\DisableLocalAdminMerge
This machine-level registry value controls whether Microsoft Defender Antivirus combines locally defined list entries with lists managed centrally through Group Policy.
A value of 1 disables local list merging. Only centrally managed list entries are included in the effective configuration; entries defined locally by administrators are ignored.
When the value is 0 or absent, unique local and centrally managed entries are merged. If entries conflict, the centrally managed policy settings take precedence.
Notes
Additional effects
The merge behavior applies in particular to:
- Microsoft Defender Antivirus exclusion lists
- Specified threat-remediation lists
- File and folder exclusions for attack surface reduction (ASR) rules
Disabling local merging also prevents locally configured controlled folder access settings from contributing to the effective policy. This includes protected folders and allowed apps added by a local administrator.
Security
When local list merging is allowed, a local administrator can add antivirus exclusions. Such exclusions can reduce or bypass scanning for the affected files, folders, or processes and therefore weaken malware protection. An attacker who has compromised an administrator account could use the same capability.
Setting the value to 1 prevents locally defined list entries from extending the centrally managed protection configuration. It does not remove general administrative privileges or control every possible local change to Microsoft Defender Antivirus.
Possible side effects
With a value of 1, locally required exceptions have no effect. Applications or workflows that depend on a local antivirus or ASR exclusion, or on an app locally allowed through controlled folder access, can consequently be blocked, detected, or otherwise disrupted unless the corresponding entry is present in the centrally managed policy.
Microsoft documentation
Microsoft Learn: ADMX_MicrosoftDefenderAntivirus Policy CSP – DisableLocalAdminMerge
Microsoft Learn: Configure local overrides for Microsoft Defender Antivirus settings