用于为 Azure 启用和配置 Microsoft 反恶意软件的代码示例

本文提供了 PowerShell 代码示例，用于为不同的 Azure 服务启用和配置Microsoft反恶意软件，包括：

Azure 资源管理虚拟机
Azure Service Fabric 群集
Azure 云服务（扩展支持）
已启用 Azure Arc 的服务器

利用这些示例在您的 Azure 环境中部署和配置 Microsoft 反恶意软件扩展。

在 Azure 资源管理器 VM 上部署Microsoft反恶意软件

注释

在运行这个代码示例之前，先取消注释变量并提供相应的值。

警告

部署或更新此扩展将替换现有的Microsoft Defender防病毒设置，包括排除项。若要保留设置，请在扩展配置中指定它们。有关详细信息，请参阅默认和自定义反恶意软件配置。

# Script to add Microsoft Antimalware extension to Azure Resource Manager VMs
# Specify your subscription ID
$subscriptionId= " SUBSCRIPTION ID HERE "
# Specify location, resource group, and VM for the extension
$location = " LOCATION HERE " # For example, �China East 2� or �China North 2�
$resourceGroupName = " RESOURCE GROUP NAME HERE "
$vmName = " VM NAME HERE "

# Enable Antimalware with default policies
$settingString = '{"AntimalwareEnabled": true}'
# Enable Antimalware with custom policies
# $settingString = '{
# "AntimalwareEnabled": true,
# "RealtimeProtectionEnabled": true,
# "ScheduledScanSettings": {
#                             "isEnabled": true,
#                             "day": 0,
#                             "time": 120,
#                             "scanType": "Quick"
#                             },
# "Exclusions": {
#            "Extensions": ".ext1,.ext2",
#                  "Paths":"",
#                  "Processes":"sampl1e1.exe, sample2.exe"
#             },
# "SignatureUpdates": {
#                               "FileSharesSources": "",
#                               "FallbackOrder": "",
#                               "ScheduleDay": 0,
#                               "UpdateInterval": 0,
#                       },
# "CloudProtection": true
#
# }'
# Sign in to Azure and select the subscription to use
Connect-AzAccount -Environment AzureChinaCloud

Set-AzContext -SubscriptionId $subscriptionId
# Retrieve the most recent version number of the extension
$allVersions = (Get-AzVMExtensionImage -Location $location -PublisherName "Microsoft.Azure.Security" -Type "IaaSAntimalware").Version
$versionString = $allVersions[($allVersions.Count)-1].Split(".")[0] + "." + $allVersions[($allVersions.Count)-1].Split(".")[1]
# Set the extension by using prepared values
Set-AzVMExtension -ResourceGroupName $resourceGroupName -Location $location -VMName $vmName -Name "IaaSAntimalware" -Publisher "Microsoft.Azure.Security" -ExtensionType "IaaSAntimalware" -TypeHandlerVersion $versionString -SettingString $settingString

将 Microsoft 反恶意软件添加到 Azure Service Fabric 群集

Azure Service Fabric 使用 Azure 虚拟机扩展集来创建 Service Fabric 集群。创建Service Fabric集群的虚拟机规模集模板并未启用防恶意软件扩展。在秤套装上单独启用反恶意软件。当你在缩放集上启用它时，所有在虚拟机缩放集下创建的节点会自动继承并获得扩展。

以下代码示例展示了如何通过使用 Az.Compute PowerShell cmdlet 启用 IaaS 反恶意软件扩展。

注释

在运行这个代码示例之前，先取消注释变量并提供相应的值。

警告

# Script to add Microsoft Antimalware extension to a virtual machine scale set (VMSS) and Service Fabric cluster
# Sign in to Azure and select the subscription to use
Connect-AzAccount -Environment AzureChinaCloud
# Specify your subscription ID
$subscriptionId="SUBSCRIPTION ID HERE"
Set-AzContext -SubscriptionId $subscriptionId
# Specify location, resource group, and VMSS for the extension
$location = "LOCATION HERE" # For example, �China East 2� or �China North 2�
$resourceGroupName = "RESOURCE GROUP NAME HERE"
$vmScaleSetName = "YOUR VM SCALE SET NAME"

# Customize the configuration.json configuration file according to the documentation: https://msdn.microsoft.com/library/dn771716.aspx
$settingString = '{"AntimalwareEnabled": true}'
# Enable Antimalware with custom policies
# $settingString = '{
# "AntimalwareEnabled": true,
# "RealtimeProtectionEnabled": true,
# "ScheduledScanSettings": {
#                             "isEnabled": true,
#                             "day": 0,
#                             "time": 120,
#                             "scanType": "Quick"
#                             },
# "Exclusions": {
#            "Extensions": ".ext1,.ext2",
#                  "Paths":"",
#                  "Processes":"sampl1e1.exe, sample2.exe"
#             } ,
# "SignatureUpdates": {
#                               "FileSharesSources": "",
#                               "FallbackOrder": "",
#                               "ScheduleDay": 0,
#                               "UpdateInterval": 0,
#                       },
# "CloudProtection": true
# }'

# Retrieve the most recent version number of the extension
$allVersions = (Get-AzVMExtensionImage -Location $location -PublisherName "Microsoft.Azure.Security" -Type "IaaSAntimalware").Version
$versionString = $allVersions[($allVersions.Count)-1].Split(".")[0] + "." + $allVersions[($allVersions.Count)-1].Split(".")[1]
$vmss = Get-AzVmss -ResourceGroupName $resourceGroupName -VMScaleSetName $vmScaleSetName
Add-AzVmssExtension -VirtualMachineScaleSet $vmss -Name "IaaSAntimalware" -Publisher "Microsoft.Azure.Security" -Type "IaaSAntimalware" -TypeHandlerVersion $versionString -Setting $settingString
Update-AzVmss -ResourceGroupName $resourceGroupName -VMScaleSetName $vmScaleSetName -VirtualMachineScaleSet $vmss

通过使用扩展支持将 Microsoft Antimalware 添加到 Azure 云服务

以下代码示例展示了如何通过PowerShell cmdlet的扩展支持，向Azure 云服务添加或配置Microsoft反恶意软件。

注释

在运行这个代码示例之前，先取消注释变量并提供相应的值。

警告

# Create an Antimalware extension object, where file is AntimalwareSettings
$xmlconfig = [IO.File]::ReadAllText("C:\path\to\file.xml")
$extension = New-AzCloudServiceExtensionObject -Name "AntimalwareExtension" -Type "PaaSAntimalware" -Publisher "Microsoft.Azure.Security" -Setting $xmlconfig -TypeHandlerVersion "1.5" -AutoUpgradeMinorVersion $true

# Get existing Cloud Service
$cloudService = Get-AzCloudService -ResourceGroup "ContosOrg" -CloudServiceName "ContosoCS"

# Add Antimalware extension to existing Cloud Service extension object
$cloudService.ExtensionProfile.Extension = $cloudService.ExtensionProfile.Extension + $extension

# Update Cloud Service
$cloudService | Update-AzCloudService

这里有一个私有配置XML文件的示例：

<?xml version="1.0" encoding="utf-8"?>
<AntimalwareConfig
    xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
    <AntimalwareEnabled>true</AntimalwareEnabled>
    <RealtimeProtectionEnabled>true</RealtimeProtectionEnabled>
    <ScheduledScanSettings isEnabled="true" day="1" time="120" scanType="Full" />
    <Exclusions>
        <Extensions>
            <Extension>.ext1</Extension>
            <Extension>.ext2</Extension>
        </Extensions>
        <Paths>
            <Path>c:\excluded-path-1</Path>
            <Path>c:\excluded-path-2</Path>
        </Paths>
        <Processes>
            <Process>excludedproc1.exe</Process>
            <Process>excludedproc2.exe</Process>
        </Processes>
    </Exclusions>
</AntimalwareConfig>

为已启用 Azure Arc 的服务器添加Microsoft反恶意软件

以下代码示例演示了如何通过 PowerShell cmdlet 为已启用 Azure Arc 的服务器添加 Microsoft Antimalware。

注释

在运行这个代码示例之前，先取消注释变量并提供相应的值。

# Before you use Azure PowerShell to manage VM extensions on your hybrid server managed by Azure Arc-enabled servers, install the Az.ConnectedMachine module. Run the following command on your Azure Arc-enabled server:
# If Az.ConnectedMachine is installed, ensure the version is at least 0.4.0
Install-Module -Name Az.ConnectedMachine
Import-Module -Name Az.ConnectedMachine

# Specify location, resource group, and machine for the extension
$subscriptionid =" SUBSCRIPTION ID HERE "
$location = " LOCATION HERE " # For example, �China East 2� or �China North 2�
$resourceGroupName = " RESOURCE GROUP NAME HERE "
$machineName = "MACHINE NAME HERE "

# Enable Antimalware with default policies
$setting = @{"AntimalwareEnabled"=$true}
# Enable Antimalware with custom policies
$setting2 = @{
"AntimalwareEnabled"=$true;
"RealtimeProtectionEnabled"=$true;
"ScheduledScanSettings"= @{
                            "isEnabled"=$true;
                            "day"=0;
                            "time"=120;
                            "scanType"="Quick"
                            };
"Exclusions"= @{
           "Extensions"=".ext1, .ext2";
                 "Paths"="";
                 "Processes"="sampl1e1.exe, sample2.exe"
            };
"SignatureUpdates"= @{
                              "FileSharesSources"="";
                              "FallbackOrder"="";
                              "ScheduleDay"=0;
                              "UpdateInterval"=0;
                      };
"CloudProtection"=$true
}
# Sign in to Azure
Connect-AzAccount -Environment AzureChinaCloud
# Enable Antimalware with the policies
New-AzConnectedMachineExtension -Name "IaaSAntimalware" -ResourceGroupName $resourceGroupName -MachineName $machineName -Location $location -SubscriptionId $subscriptionid -Publisher "Microsoft.Azure.Security" -Settings $setting -ExtensionType "IaaSAntimalware"

后续步骤

Last updated on 2026-08-19

用于为 Azure 启用和配置 Microsoft 反恶意软件的代码示例

在 Azure 资源管理器 VM 上部署Microsoft反恶意软件

将 Microsoft 反恶意软件添加到 Azure Service Fabric 群集

通过使用扩展支持将 Microsoft Antimalware 添加到 Azure 云服务

为已启用 Azure Arc 的服务器添加Microsoft反恶意软件

后续步骤

Recursos adicionales