0

I am trying to set the preference DisableRealtimeMonitoring to false with the following runspace:

try
{
    Runspace runspace = RunspaceFactory.CreateRunspace();
    runspace.Open();
    Pipeline pipeline = runspace.CreatePipeline();
    Command setMp = new Command("Set-MpPreference");
    string paramRT = "DisableRealtimeMonitoring";
    bool pF = Convert.ToBoolean(Convert.ToInt32("0"));
    setMp.Parameters.Add(paramRT, pF);
    pipeline.Commands.Add(setMp);
    runspace.Close();
}
catch (Exception ex)
{
    MessageBox.Show(ex.Message);
}

This runspace should be the equivalent of the following PS command:

Set-MpPreference -DisableRealtimeMonitoring 0

The PS command works like a charm whilst the runspace code above does not work even if the UAC is disabled. For troubleshooting purpose, I performed some modifications to the code for catching the error which is the following:

The term 'Set-MpPreference' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

Does anyone know what is wrong in the code?

Clijsters
  • 4,031
  • 1
  • 27
  • 37
Goemon Code
  • 73
  • 1
  • 10
  • 1
    PowerShell does automatic module importing, I suspect C# doesn't, and you need to import the `Defender` module to get access to `Set-MpPreference` - https://stackoverflow.com/q/6266108/478656 – TessellatingHeckler Dec 15 '17 at 09:01
  • Hi Clijsters, thanks for the suggestion. I tried multiple ways to import the module including the answer I found in your link, but the code is still not doing anything. Can't figure it out where the code is wrong. Any idea? Thank you – Goemon Code Jan 06 '18 at 22:35

0 Answers0