Local versus group policy powershell exploit prevention control

[paguilar]

Can exploit prevention script control distinguish between a user initiated powershell script and one that is externally initiated such as a group policy?  I am creating a scheduled task to run on endpoints after group policy has a chance to synchronize.  Except, I don't know if I need to create an exclusion in AMP to allow that script to run if I have the script control enabled?

[Mohammed al Baqari]

Hi,

It doesn't distinguish between initiators. It rather identifies based on
activities and processes. So depends what application/process will be
impacted by you GPO. Give it a try to test.

**** please remember to rate useful posts

[paguilar]

I'm afraid I need to provide more clarification. See I'm trying to determine whether a scheduled task execution of a script made in Powershell is being blocked because of AMP. I don't know what times of intelligence/judgement AMP is using to block script execution so I would need to know ahead of time before creating say a wild card exclusion into my policy.