Enhancement: Defender Cloud, use Set-MpPreference instead of registry hack

The functions DisableDefenderCloud and EnableDefenderCloud use a registry hack approach for to perform its goals.

It is possible to use these PowerShell command Set-MpPreference -MAPSReporting … and Set-MpPreference -SubmitSamplesConsent ... for to obtain same results.

Advantages:

• Defender Cloud is being configured as user scope, not as admin scope
• You can also set MAPSReporting and SubmitSamplesConsent with more flexibility: not only on/off but also their level (see https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=win10-ps#parameters)
• It is a more standardized way also for future development.

[Disassembler0]

That "hack" is a documented group policy setting. :)

Couterpoints:

• GPO allows the setting to be added as part of sysprep, allowing for customized installation images.
• The scenario of "Hey, we've noticed that you have something disabled, surely by mistake, so we've enabled it for you" after major updates is less likely to happen with GPO.
• Disabling something what's enabled by default via Set-MpPreference results in "Your device may be vulnerable" warning which needs to be manually dismissed, unless you're ok with yellow warning triangles everywhere.
• Set-MpPreference still needs to be run as administrator and applies system-wide, so your first point is not valid.
• GPO can set the same levels as Set-MpPreference, not just on/off (e.g. the registry value for SubmitSamplesConsent is 2, implying there are at least 3 different states), so your second point is not valid either.
• GPOs are the "standardized way" since WinNT, so even your third point might not be entirely valid. However we've already seen a lot of cases of Microsoft going bananas and ignoring their own well-established practices, so some far-future development may indeed depend on it. For the near future, we're good with GPOs. EnableCtrldFolderAccess uses Set-MpPreference only because there was no GPO for this setting at the time (i.e. in 1709, there may be some now, I need to check)

That "hack" is a documented group policy setting. :)

I didn't know, my lack :)

All counterpoints are clear and winning, definitely.
Thanks for sharing the reasons.