Detected Registry Changes from GPO

[pickles78249]

Can anyone verify that MBAM takes into account registry changes made by GPO before showing them as possible malware changes?

Just want to be sure that any registry changes we make due to GPO will not show up in MBAM scans as false positives.

[David H. Lipman]

If you are applying Group Policy Objects ( GPO ) then you are most likely running MBAM in a business.  This is the retail product support sub-forum where GPO settings is very uncommon.

Support for MBAM in a corporate environment is in;  Malwarebytes Anti-Malware for Business

I that the case here ?

[pickles78249]

Yes it is.  My apologies, did not realize there was a separate forum.

 

[David H. Lipman]

No problem. 

I will request a moderator move this thread there.

 

[AdvancedSetup]

There are some GPO values that used to be common tactics for change that we would detect because there is no good way to know if the policy was set by malware or by an Admin on purpose. In general most GPO are not detected as a threat, if you do run into one though you can exclude it and then push that exclusion out to the other workstations.

If you need further assistance or you're actively having an issue @pickles78249 then it might be best to open a ticket directly with support.

 

Please contact our Malwarebytes Business Product Support for further assistance if needed.

Thank you

Ron