drop windows defender operational evtx csv and registry export · detect cloud protection and maps reporting disabled · identify spynet telemetry suppression · surface defender intelligence feed disconnection hiding malware from cloud detection · runs locally
SpyNetReporting · SubmitSamplesConsent · CloudBlockLevel · Event 5007 · Set-MpPreference -MAPSReporting 0
drop windows defender operational evtx csv · registry export