Remove-XdrEndpointDeviceLiveResponseLibraryFile
SYNOPSIS
Deletes a file from the Live Response library.
SYNTAX
ByName (Default)
Remove-XdrEndpointDeviceLiveResponseLibraryFile [-FileName] <String> [-ProgressAction <ActionPreference>]
[-WhatIf] [-Confirm] [<CommonParameters>]
InputObject
Remove-XdrEndpointDeviceLiveResponseLibraryFile -InputObject <Object> [-ProgressAction <ActionPreference>]
[-WhatIf] [-Confirm] [<CommonParameters>]
DESCRIPTION
Removes a script file from the Microsoft Defender XDR Live Response library. When only -FileName is provided, the cmdlet automatically looks up the file metadata (last_updated_time) required by the API. Accepts pipeline input from Get-XdrEndpointDeviceLiveResponseLibrary.
EXAMPLES
EXAMPLE 1
Remove-XdrEndpointDeviceLiveResponseLibraryFile -FileName 'OldScript.ps1'
Deletes OldScript.ps1 from the library after confirmation.
EXAMPLE 2
Remove-XdrEndpointDeviceLiveResponseLibraryFile -FileName 'OldScript.ps1' -Confirm:$false
Deletes without prompting.
EXAMPLE 3
Get-XdrEndpointDeviceLiveResponseLibrary | Where-Object file_name -eq 'OldScript.ps1' | Remove-XdrEndpointDeviceLiveResponseLibraryFile
Deletes using pipeline input from the library listing.
EXAMPLE 4
Remove-XdrEndpointDeviceLiveResponseLibraryFile -FileName 'OldScript.ps1' -WhatIf
Shows what would be deleted without performing the deletion.
PARAMETERS
-FileName
The name of the file to delete from the library (e.g. 'PasskeyLogin.ps1').
Type: String
Parameter Sets: ByName
Aliases: file_name
Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-InputObject
A library file object from Get-XdrEndpointDeviceLiveResponseLibrary. Extracts file_name and last_updated_time automatically.
Type: Object
Parameter Sets: InputObject
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False
-WhatIf
Shows what would happen if the cmdlet runs. The file is not deleted.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Confirm
Prompts you for confirmation before deleting the file. Confirmation is required by default.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.