From a902dfc765d7a9ad9bd21a6a425e4ef70fd56199 Mon Sep 17 00:00:00 2001
From: Shamil Mubarakshin
 <127750046+shamil-mubarakshin@users.noreply.github.com>
Date: Wed, 15 Apr 2026 10:59:54 +0200
Subject: [PATCH] [windows-11] Unset DisableBlockAtFirstSeen defender
 preference (#13903)

---
 .../windows/scripts/build/Configure-WindowsDefender.ps1   | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/images/windows/scripts/build/Configure-WindowsDefender.ps1 b/images/windows/scripts/build/Configure-WindowsDefender.ps1
index c84d47eb5..aa7774605 100644
--- a/images/windows/scripts/build/Configure-WindowsDefender.ps1
+++ b/images/windows/scripts/build/Configure-WindowsDefender.ps1
@@ -8,7 +8,6 @@ $avPreference = @(
     @{DisableArchiveScanning = $true}
     @{DisableAutoExclusions = $true}
     @{DisableBehaviorMonitoring = $true}
-    @{DisableBlockAtFirstSeen = $true}
     @{DisableCatchupFullScan = $true}
     @{DisableCatchupQuickScan = $true}
     @{DisableIntrusionPreventionSystem = $true}
@@ -30,6 +29,13 @@ $avPreference += @(
     @{EnableNetworkProtection = "Disabled"}
 )
 
+# DisableBlockAtFirstSeen=1 is flagged as a threat by defender and gets remediated (removed) on Windows 11 during build
+# Running defender scan later causes false positive alert on older remediation event
+# Set this preference only for Windows Servers
+if (-not (Test-IsWin11-Arm64)) {
+    $avPreference += @{DisableBlockAtFirstSeen = $true}
+}
+
 $avPreference | Foreach-Object {
     $avParams = $_
     Set-MpPreference @avParams