Notify Antivirus when Opening Attachments using Intune

Today’s topic of discussion is the Notify antivirus when opening attachments Policy, which will be configured using Intune. As with previous posts in this segment, we will utilize Configuration Profiles from Intune to achieve our objective.

Enabling this policy setting instructs Windows to direct the registered antivirus program to scan the file when a user opens a file attachment. In the event that the antivirus program fails, the attachment will be blocked from being opened.

You can use this policy setting to control the way in which registered antivirus programs are notified. When multiple programs are registered, all of them will receive a notification. If a registered antivirus program already performs on-access checks or scans files as they arrive on the computer’s email server, additional notifications would be unnecessary.

Disabling this policy setting, however, prevents Windows from notifying registered antivirus programs when file attachments are opened. If this policy setting is left unconfigured, Windows will not call the registered antivirus programs when file attachments are opened.

This policy setting is particularly useful when multiple antivirus programs are installed on a system. Notifying all registered antivirus programs can increase the likelihood of detecting and blocking any potential security threats. However, if a registered antivirus program is already performing on-access checks or scans files as they arrive on the computer’s email server, additional notifications would be redundant.

• Best Method to Prevent Users from Modifying Settings Policy Using Intune
• Windows Error Reporting Service Policy Using Intune

Windows CSP Details NotifyAntivirusPrograms

Let’s go through Windows CSP Details for this Policy setting NotifyAntivirusPrograms. The Notify antivirus when opening attachments policy is a security feature that helps protect your system from malware and other security threats that may be delivered via email attachments. By enabling this policy setting, Windows instructs the registered antivirus program to scan the file when a user opens a file attachment. If the antivirus program fails to detect any threats, the attachment is allowed to be opened.

CSP URI – ./User/Vendor/MSFT/Policy/Config/AttachmentManager/NotifyAntivirusPrograms

Notify antivirus when opening attachments Policy Using Intune

To set Notify antivirus when opening attachments Policy Using Intune, follow the steps stated below:

• Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
• Select Devices > Windows > Configuration profiles > Create a profile.

In Create Profile, Select Windows 10 and later in Platform, and Select Profile Type as Settings catalog. Click on Create button.

Platform	Profile Type
Windows 10 and later	Settings Catalog

In the Basics tab pane, enter a name for the Policy as Notify antivirus when opening attachments Policy. You can enter the Description for the Policy if you want, then select Next.

Now in Configuration settings, click Add Settings to browse or search the catalog for the settings you want to configure.

In the Settings Picker windows, search by the keyword Antivirus, among many you will see Administrative Templates\Windows Components\Attachment Manager, and select this.

When you select the option as stated above, you will see only one setting, which is Notify antivirus programs when opening attachments (User). After selecting your setting, click the cross mark at the right-hand corner, as shown below.

Now, in the Administrative Templates, enable Notify antivirus programs when opening attachments (User), as shown below in the image.

Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required) and click Next to continue. Now in Assignments, in Included Groups, you need to click on Add Groups, choose Select Groups to include one or more groups, and click Next to continue.

In the Review + Create tab, you need to review your settings. After clicking on Create, your changes are saved, and the profile is assigned.

A notification will appear automatically if you see it in the top right-hand corner. One can easily see that the “Notify antivirus when opening attachments Policy” was created successfully. Also, if you check in the Configuration Profiles list, the Policy is visible there.

Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.

Intune Report for Notify Antivirus when Opening Attachments Policy

From Intune Portal, you can view the Intune settings catalog profile report, which provides an overview of device configuration policies and deployment status.

To monitor the assignment of the policy, you must choose the appropriate policy from the list of Configuration Profiles. You can check the device and user check-in status to see if the policy has been successfully applied. If you wish to view more information, you can click on “View Report” to see additional details.

Intune MDM Event Log

Intune event IDs 813 and 814 can be used to identify if the String or integer policy has been successfully applied to Windows 10 or 11 devices. By examining these event IDs, you can also determine the specific value of the policy that is being applied to those devices. In the case of this particular policy, the value is a string and is associated with event ID 814.

To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.

MDM PolicyManager: Set policy string, Policy: (NotifyAntivirusPrograms), Area: (AttachmentManager), EnrollmentID requesting merge: (4009A089-4FBA-482B-9D17-9E5A8428CB98), Current User: (S-1-5-21-2901188661-3025291148-348095268-29601), String: (<enabled/>), Enrollment Type: (0xD), Scope: (0x1).

You will get some important information like Area and Enrollment ID that will help you detect the registry path after you look in the event viewer to log above. Please refer to the below table for this information:

Area	Policy	String	Scoped	Event ID
AttachmentManager	NotifyAntivirusPrograms	Enabled	User	814

Information from the above table of Notify antivirus when opening attachments Policy Using Intune can be used to REGEDIT.exe on a target computer to view the registry settings that store group policy settings. These settings are located in the registry path.

• Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\providers\4009A089-4FBA-482B-9D17-9E5A8428CB98\default\S-1-5-21-2901188661-3025291148-348095268-29601\AttachmentManager

When you navigate to the above path in the Registry Editor, you will find the registry key with the name NotifyAntivirusPrograms. Refer to the table and image below.

Registry Name	Value
NotifyAntivirusPrograms	Enabled

Author

Abhinav Rana is working as an SCCM Admin. He loves to help the community by sharing his knowledge. He is a B.Tech graduate in Information Technology.