Stop-XdrEndpointDeviceAction
SYNOPSIS
Cancels a pending device action in Microsoft Defender XDR.
SYNTAX
Stop-XdrEndpointDeviceAction [-RequestGuid] <String> [[-Comment] <String>] [-ProgressAction <ActionPreference>]
[-WhatIf] [-Confirm] [<CommonParameters>]
DESCRIPTION
Cancels a device response action that is currently in a pending/submitted state. Uses the request GUID from the original action submission to identify the action to cancel.
EXAMPLES
EXAMPLE 1
Stop-XdrEndpointDeviceAction -RequestGuid "b28b630c-d1a1-4b1d-9676-680c15366a52" -Comment "Action no longer needed"
Cancels the specified device action with a comment.
EXAMPLE 2
Stop-XdrEndpointDeviceAction -RequestGuid "b28b630c-d1a1-4b1d-9676-680c15366a52"
Cancels the specified device action.
PARAMETERS
-RequestGuid
The GUID of the request to cancel. This is returned when an action is submitted.
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Comment
A comment explaining the reason for the cancellation.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 2
Default value: "Action cancelled - Performed by $env:USERNAME via XDRInternals"
Accept pipeline input: False
Accept wildcard characters: False
-WhatIf
Shows what would happen if the command runs. The command is not run.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Confirm
Prompts for confirmation before making changes.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.