November 27, 2019

[NOTE] Win10 - get the full message for "Unauthorized changes blocked"

Event Viewer > Application and Services > Microsoft > Windows > Windows Defender > Operational

Get the full message using PowerShell:

> Get-WinEvent -FilterHashtable @{logname=’Microsoft-Windows-Windows Defender/Operational’; id=1123} | Select-Object Message

No comments:

Post a Comment