Show-ADTInstallationWelcome -BlockExecution trigger MS defender alert and block

The Toolkit General Discussion
1

I was using v4.0.6
This is the line was used in my script:
Show-ADTInstallationWelcome -CloseProcesses winword -AllowDefer -DeferTimes 3 -CheckDiskSpace -PersistPrompt -NoMinimizeWindows -BlockExecution

When I attempt to open Word during deployment to verify the block is working, it triggers the following Microsoft Defender alert:

image
image505×320 11.3 KB

Hope this issue can be resolved in the future.
Thanks.

2

Always check the open/closed issues: [Bug] Defender prevented execution of 'Trojan:Win32/ClickFix.ZGA' · Issue #1490 · PSAppDeployToolkit/PSAppDeployToolkit · GitHub