Skip to content

Microsoft Defender | Harden System Security

Microsoft Defender Cloud Protection features and abilities

  • Blue Check mark denoting Group Policy Extends the Cloud Security Scan time to the maximum amount of 60 seconds, by default it is 10 seconds. You need to be aware that this means actions like downloading and opening an unknown file will make Microsoft Defender send samples of it to the Cloud for more advanced analysis and it can take a maximum of 60 seconds from the time you try to open that unknown file to the time when it will be opened (if deemed safe). Rotating green checkmark denoting CSP CSP

  • Here is an example of the notification you will see in Windows 11 if that happens.

    Windows Security Cloud Scan Notification


  • Blue Check mark denoting Group Policy Configures the Cloud Block/Protection Level to the maximum level of Zero Tolerance and Block At First Sight. No unknown file can run on your system without first being recognized by the Microsoft's Security Graph and other globally omniscient systems. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Configures the Microsoft Defender to send all samples automatically. Increasing protection by participating in the SpyNet / MAPS network. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Sets the SpyNet membership to Advanced, improving Cloud Protection. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Enables file hash computation; designed to allow admins to force the anti-malware solution to "compute file hashes for every executable file that is scanned if it wasn't previously computed" to "improve blocking for custom indicators in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP). Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Clears Quarantined items after 1 day instead of the default behavior of keeping them indefinitely. Rotating green checkmark denoting CSP CSP

  • Quarantine involves isolating potentially harmful files in a non-executable area of your system to prevent any risk of execution. To further minimize potential threats, quarantined files are automatically removed after 1 day, rather than being retained indefinitely. This precaution helps mitigate the possibility of these files exploiting unforeseen vulnerabilities in the future, ensuring a proactive approach to system security.


  • Blue Check mark denoting Group Policy Allows Microsoft Defender to download security updates even on a metered connection. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Enables Microsoft Defender to scan mapped network drives during full scan. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Enables Microsoft Defender to scan emails. The engine will parse the mailbox and mail files. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Enables Microsoft Defender to scan Removable Drives. Rotating green checkmark denoting CSP CSP





  • Blue Check mark denoting Group Policy Forces Microsoft Defender to check for new virus and spyware definitions before it runs a scan. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Makes Microsoft Defender run catch-up scans for scheduled quick scans. A computer can miss a scheduled scan, usually because the computer is off at the scheduled time, but now after the computer misses two scheduled quick scans, Microsoft Defender runs a catch-up scan the next time someone logs onto the computer. Rotating green checkmark denoting CSP CSP




  • Rotating pink checkmark denoting registry or cmdlet Makes sure Async Inspection for Network protection of Microsoft Defender is turned on - Network protection now has a performance optimization that allows Block mode to start asynchronously inspecting long connections after they're validated and allowed by SmartScreen, which might provide a potential reduction in the cost that inspection has on bandwidth and can also help with app compatibility problems. Rotating green checkmark denoting CSP CSP


  • Rotating pink checkmark denoting registry or cmdlet Rotating green checkmark denoting Subcategory Enables Smart App Control (if it's in Evaluation mode): adds significant protection from new and emerging threats by blocking apps that are malicious or untrusted. Smart App Control also helps to block potentially unwanted apps, which are apps that may cause your device to run slowly, display unexpected ads, offer extra software you didn't want, or do other things you don't expect.

    • Smart App Control is User-Mode (and enforces Kernel-Mode) App Control for Business, more info in the Wiki. You can see its status in System Information and enable it manually from Microsoft Defender app's GUI. It is very important for Windows and Windows Defender intelligence updates to be always up-to-date in order for Smart App Control to work properly as it relies on live intelligence and definition data from the cloud and other sources to make a Smart decision about programs and files it encounters.

    • Smart App Control uses ISG (Intelligent Security Graph). The ISG isn't a "list" of apps. Rather, it uses the same vast security intelligence and machine learning analytics that power Microsoft Defender SmartScreen and Microsoft Defender Antivirus to help classify applications as having "known good", "known bad", or "unknown" reputation. This cloud-based AI is based on trillions of signals collected from Windows endpoints and other data sources and processed every 24 hours. As a result, the decision from the cloud can change.

    • Smart App Control can block a program entirely from running or only some parts of it in which case your app or program will continue working just fine most of the time. It's improved a lot since it was introduced, and it continues doing so. Consider turning it on after clean installing a new OS and fully updating it.

    • Smart App Control enforces the Microsoft Recommended Driver Block rules and the Microsoft Recommended Block Rules

    • Once you turn Smart App Control off, it can't be turned on without resetting or reinstalling Windows.



  • Blue Check mark denoting Group Policy Enables Controlled Folder Access. It helps protect your valuable data from malicious apps and threats, such as ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Due to the recent wave of global ransomware attacks, it is important to use this feature to protect your valuables files, specially OneDrive folders. Rotating green checkmark denoting CSP CSP

    • If it blocks a program from accessing one of your folders it protects, and you absolutely trust that program, then you can add it to exclusion list using Microsoft Defender GUI or PowerShell. you can also query the list of allowed apps using PowerShell (commands below). with these commands, you can backup your personalized list of allowed apps, that are relevant to your system, and restore them in case you clean install your Windows.

    • Rotating pink checkmark denoting registry or cmdlet The root of the OneDrive folders of all the user accounts will be added to the protected folders list of Controlled Folder Access, to provide Ransomware protection for the entire OneDrive folder. Rotating green checkmark denoting CSP CSP

- 

# Add multiple programs to the exclusion list of Controlled Folder Access
Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Program Files\App\app.exe','C:\Program Files\App2\app2.exe'

- 

# Get the list of all allowed apps
(Get-MpPreference).ControlledFolderAccessAllowedApplications


  • Rotating pink checkmark denoting registry or cmdlet Enables Mandatory ASLR, It might cause compatibility issues only for some poorly-made 3rd party programs, specially portable ones. Rotating green checkmark denoting CSP CSP

    • Automatically detects and excludes the Git executables of GitHub Desktop and Git (Standalone version) from mandatory ASLR if they are installed on the system. More info here

    • You can add Mandatory ASLR override for a trusted program using the PowerShell command below or in the Program Settings section of Exploit Protection in Microsoft Defender app.

      • Set-ProcessMitigation -Name "C:\TrustedApp.exe" -Disable ForceRelocateImages


  • Rotating pink checkmark denoting registry or cmdlet Applies Exploit Protections/Process Mitigations from this list to the following programs: Rotating green checkmark denoting CSP CSP

    • All channels of Microsoft Edge browser

    • Quick Assist app

    • Some System processes

    • Microsoft 365 apps

    • More apps and processes will be added to the list over time once they are properly validated to be fully compatible.

    • Exploit Protection configurations are also accessible in XML format within this repository. When implementing exploit protections using an XML file, the existing exploit mitigations will seamlessly integrate rather than being overwritten. Should there be pre-existing exploit protections applied to an executable on the system, and the XML file specifies different mitigations for the same executable, these protections will be merged and applied collectively.


  • Rotating pink checkmark denoting registry or cmdlet Turns on Data Execution Prevention (DEP) for all applications, including 32-bit programs. By default, the output of BCDEdit /enum "{current}" (in PowerShell) for the NX bit is OptIn but the Harden System Security app sets it to AlwaysOn


  • Blue Check mark denoting Group Policy Check for the latest virus and spyware security intelligence on startup. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Specifies the maximum depth to scan archive files to the maximum possible value of 4,294,967,295 Rotating green checkmark denoting CSP CSP




  • Blue Check mark denoting Group Policy Enables notifying user of malicious and phishing scenarios in Microsoft Defender Enhanced Phishing Protection. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Enables the feature in Enhanced Phishing Protection in Microsoft Defender SmartScreen that warns users if they reuse their work or school password. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Enables warning users if they type their work or school passwords in unsafe apps. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Enables automatic data collection (formerly known as Capture Threat Window) of Enhanced Phishing Protection in Microsoft Defender SmartScreen for security analysis from a suspicious website or app. Rotating green checkmark denoting CSP CSP




  • Blue Check mark denoting Group Policy Defines the number of days before spyware security intelligence is considered out of date to 2. The default is 7. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Defines the number of days before virus security intelligence is considered out of date to 2. The default is 7. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Sets the default action for Severe and High threat levels to Remove, for Medium and Low threat levels to Quarantine. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Configures real-time protection and Security Intelligence Updates to be enabled during OOBE. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Enables the Intel TDT (Intel® Threat Detection Technology) integration with Microsoft Defender. Rotating green checkmark denoting CSP CSP



  • Rotating pink checkmark denoting registry or cmdlet Enables a network protection setting that blocks malicious network traffic instead of displaying a warning. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Configures the Brute-Force Protection to use cloud aggregation to block IP addresses that are over 99% likely malicious Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Configures the Brute-Force Protection to detect and block attempts to forcibly sign in and initiate sessions Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Sets the internal feature logic to determine blocking time for the Brute-Force Protections Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Configures the Remote Encryption Protection to use cloud intel and context, and block when confidence level is above 90%. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Configures the Remote Encryption Protection to detect and block attempts to replace local files with encrypted versions from another device Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Sets the internal feature logic to determine blocking time for the Remote Encryption Protection Rotating green checkmark denoting CSP CSP


  • Rotating pink checkmark denoting registry or cmdlet Extends the brute-force protection coverage in the Microsoft Defender Antivirus to block local network addresses. Rotating green checkmark denoting CSP CSP


  • Rotating pink checkmark denoting registry or cmdlet Enables ECS Configurations in the Microsoft Defender. They improve product health and security by automatically fixing any possible issues/bugs that may arise, in a timely manner.


  • Blue Check mark denoting Group Policy Enables Network Protection to be configured into block or audit mode on Windows Server. Rotating green checkmark denoting CSP CSP


Tip

Performance analyzer for Microsoft Defender Antivirus