feat: add Defender KEV version compliance remediation#3
Conversation
📝 WalkthroughWalkthroughThree new files are added under ChangesDefender KEV Version Compliance Remediation Pair
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1 (1)
38-61: ⚡ Quick winShared root cause: both scripts define
Write-Log, which risks cmdlet shadowing and inconsistent behavior across PowerShell environments.
intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1#L38-L61: rename the helper to a non-cmdlet name (for exampleWrite-ScriptLog) and update all call sites in this file.intune/remediations/defender-kev-version-compliance/Remediate-DefenderKevVersionCompliance.ps1#L38-L61: apply the same rename to keep the pair consistent and avoid cross-script drift.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1` around lines 38 - 61, The Write-Log function defined in both scripts risks cmdlet shadowing and creates inconsistent behavior. Rename the function from Write-Log to Write-ScriptLog in both affected files to avoid conflicts with PowerShell's built-in cmdlets. In intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1 (lines 38-61), rename the function definition from Write-Log to Write-ScriptLog and update all call sites in this file that invoke Write-Log. In intune/remediations/defender-kev-version-compliance/Remediate-DefenderKevVersionCompliance.ps1 (lines 38-61), apply the identical rename to keep the pair consistent and prevent cross-script drift.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@intune/remediations/defender-kev-version-compliance/Remediate-DefenderKevVersionCompliance.ps1`:
- Around line 88-100: The MpCmdRun.exe lookup in the remediation script is
incomplete and only checks the legacy location at $env:ProgramFiles\Windows
Defender\MpCmdRun.exe, missing the platform-serviced installation path. Modify
the code before the Test-Path check on line 88 to search for MpCmdRun.exe in
both locations: first attempt to locate it at $env:ProgramData\Microsoft\Windows
Defender\Platform\<version>\MpCmdRun.exe (the recommended platform-serviced
path), then fall back to the legacy $env:ProgramFiles\Windows
Defender\MpCmdRun.exe location. Ensure the script uses whichever path is found,
allowing it to successfully update signatures on endpoints using the newer
platform-serviced Defender installation.
---
Nitpick comments:
In
`@intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1`:
- Around line 38-61: The Write-Log function defined in both scripts risks cmdlet
shadowing and creates inconsistent behavior. Rename the function from Write-Log
to Write-ScriptLog in both affected files to avoid conflicts with PowerShell's
built-in cmdlets. In
intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1
(lines 38-61), rename the function definition from Write-Log to Write-ScriptLog
and update all call sites in this file that invoke Write-Log. In
intune/remediations/defender-kev-version-compliance/Remediate-DefenderKevVersionCompliance.ps1
(lines 38-61), apply the identical rename to keep the pair consistent and
prevent cross-script drift.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2aa02a13-1c8b-4ce2-8455-a5ad6a0d6a88
📒 Files selected for processing (3)
intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1intune/remediations/defender-kev-version-compliance/README.mdintune/remediations/defender-kev-version-compliance/Remediate-DefenderKevVersionCompliance.ps1
| $MpCmdRun = Join-Path -Path $env:ProgramFiles -ChildPath 'Windows Defender\MpCmdRun.exe' | ||
| if (Test-Path -Path $MpCmdRun) { | ||
| try { | ||
| Write-Log -Message 'Running MpCmdRun signature update.' | ||
| Start-Process -FilePath $MpCmdRun -ArgumentList '-SignatureUpdate' -Wait -NoNewWindow -ErrorAction Stop | ||
| } | ||
| catch { | ||
| Write-Log -Message ('MpCmdRun signature update failed: {0}' -f $_.Exception.Message) -Level WARNING | ||
| } | ||
| } | ||
| else { | ||
| Write-Log -Message ('MpCmdRun not found at {0}' -f $MpCmdRun) -Level WARNING | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What are the documented/typical install locations of Microsoft Defender MpCmdRun.exe on current Windows versions, including platform-serviced paths?
💡 Result:
On current Windows versions, the Microsoft Defender command-line utility, MpCmdRun.exe, is documented to reside in two primary locations [1][2]. 1. C:\Program Files\Windows Defender 2. C:\ProgramData\Microsoft\Windows Defender\Platform<antimalware platform version>\ The path C:\ProgramData\Microsoft\Windows Defender\Platform<antimalware platform version> (often referred to as the platform-serviced path) is the recommended location [1][2]. Microsoft advises that the latest version of the utility is always available within this folder if it exists on the system [1][2]. Because these directories are not included in the system PATH environment variable by default, you must navigate to the directory or use the full path to execute the file [1][2]. Microsoft provides an official script snippet to programmatically identify and switch to the most current version of the utility: (set "_done=" & if exist "%ProgramData%\Microsoft\Windows Defender\Platform" (for /f "delims=" %d in ('dir "%ProgramData%\Microsoft\Windows Defender\Platform" /ad /b /o:-n 2^>nul') do if not defined _done (cd /d "%ProgramData%\Microsoft\Windows Defender\Platform%d" & set _done=1)) else (cd /d "%ProgramFiles%\Windows Defender")) >nul 2>&1 [1][2] This approach is the standard practice for ensuring that scripts and automated tasks interact with the most recent, serviced version of the Defender platform [1][2][3].
Citations:
- 1: https://learn.microsoft.com/en-us/defender-endpoint/command-line-arguments-microsoft-defender-antivirus
- 2: https://github.com/MicrosoftDocs/defender-docs/blob/refs/heads/public/defender-endpoint/command-line-arguments-microsoft-defender-antivirus.md
- 3: https://github.com/MicrosoftDocs/defender-docs/blob/public/defender-endpoint/configure-network-connections-microsoft-defender-antivirus.md
MpCmdRun.exe lookup is incomplete and misses platform-serviced Defender installations.
Line 88 only checks $env:ProgramFiles\Windows Defender\MpCmdRun.exe. Microsoft documents two primary locations for MpCmdRun.exe: the legacy Program Files\Windows Defender directory and the platform-serviced path at $env:ProgramData\Microsoft\Windows Defender\Platform\<version>\MpCmdRun.exe. The platform path is the recommended location and contains the latest serviced version. On many endpoints, this causes the script to skip the signature update and reduces remediation success rates.
Suggested diff
- $MpCmdRun = Join-Path -Path $env:ProgramFiles -ChildPath 'Windows Defender\MpCmdRun.exe'
- if (Test-Path -Path $MpCmdRun) {
+ $MpCmdRunCandidates = @(
+ (Join-Path -Path $env:ProgramFiles -ChildPath 'Windows Defender\MpCmdRun.exe'),
+ (Get-ChildItem -Path "$env:ProgramData\Microsoft\Windows Defender\Platform" -Directory -ErrorAction SilentlyContinue |
+ Sort-Object Name -Descending |
+ ForEach-Object { Join-Path -Path $_.FullName -ChildPath 'MpCmdRun.exe' } |
+ Select-Object -First 1)
+ ) | Where-Object { $_ -and (Test-Path -Path $_) }
+
+ $MpCmdRun = $MpCmdRunCandidates | Select-Object -First 1
+ if ($MpCmdRun) {
try {
Write-Log -Message 'Running MpCmdRun signature update.'
Start-Process -FilePath $MpCmdRun -ArgumentList '-SignatureUpdate' -Wait -NoNewWindow -ErrorAction Stop
}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@intune/remediations/defender-kev-version-compliance/Remediate-DefenderKevVersionCompliance.ps1`
around lines 88 - 100, The MpCmdRun.exe lookup in the remediation script is
incomplete and only checks the legacy location at $env:ProgramFiles\Windows
Defender\MpCmdRun.exe, missing the platform-serviced installation path. Modify
the code before the Test-Path check on line 88 to search for MpCmdRun.exe in
both locations: first attempt to locate it at $env:ProgramData\Microsoft\Windows
Defender\Platform\<version>\MpCmdRun.exe (the recommended platform-serviced
path), then fall back to the legacy $env:ProgramFiles\Windows
Defender\MpCmdRun.exe location. Ensure the script uses whichever path is found,
allowing it to successfully update signatures on endpoints using the newer
platform-serviced Defender installation.
1 participant
Adds a public-safe Intune Proactive Remediation pair for Microsoft Defender Antivirus engine/platform version compliance.
Why this is worth adding:
Files:
intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1intune/remediations/defender-kev-version-compliance/Remediate-DefenderKevVersionCompliance.ps1intune/remediations/defender-kev-version-compliance/README.mdPublic safety:
Summary by CodeRabbit
New Features
Documentation