Hdparm.exe trigger alerts in defender why

[SamSepiolWarden]

Summary

_
just need help to understand why hdparm.exe is trigerring alerts in defender

it is normal behavior or not ?
i know hdparm.exe is use by glpi-agent but our controlled folder access trigger alert.
It is normal behavior or not ?

[g-bougard]

Hi @SamSepiolWarden

we don't see your screenshot so I can't tell you if the error is a normal behavior.

Anyway, you should probably ask first Defender support as you still known hdparm.exe is used by glpi-agent.

[g-bougard]

It's very probably a false positive.

[SamSepiolWarden]

the screenshot

[g-bougard]

I'm not surprised, this command is a low-level one as it will try to make direct disk access to discover interesting datas like essentially the serialnumber. In the context of glpi-agent it will read datas.

To me, this is really a false positive.

If you don't require storage inventory, you can eventually disable the storage category by setting it in no-category option. This will prevent the run of hdparm.

[SamSepiolWarden]

when you say setting it in no-category for the storage what do you mean ? where i can disable this ? because right now i set up an automatic inventory

[SamSepiolWarden]

by the way i deploy my agent via intune

[g-bougard]

This is a configuration parameter: https://glpi-agent.readthedocs.io/en/latest/configuration.html#no-category
On windows, MSI installer supports to set it up using NO_CATEGORY=storage in your case.