Skip to content

Commit 4c2474c

Browse files
padmagit77padmagit77
authored
Merge pull request #3742 from YongRhee-MSFT/docs-editor/enable-network-protection-1747133056
Update enable-network-protection.md
2 parents 11d8200 + 31f3a28 commit 4c2474c

File tree

1 file changed

+47
-41
lines changed

1 file changed

+47
-41
lines changed

‎defender-endpoint/enable-network-protection.md‎

Lines changed: 47 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@ title: Turn on network protection
33
description: Enable network protection with Group Policy, PowerShell, or Mobile Device Management and Configuration Manager.
44
ms.service: defender-endpoint
55
ms.localizationpriority: medium
6-
ms.date: 01/22/2025
6+
ms.date: 05/13/2025
77
ms.topic: conceptual
8-
author: denisebmsft
9-
ms.author: deniseb
8+
author: emmwalshh
9+
ms.author: ewalsh
1010
ms.reviewer: tdoucett
1111
manager: deniseb
1212
ms.subservice: asr
@@ -64,42 +64,11 @@ You can use Registry Editor to check the status of network protection.
6464

6565
To enable network protection, you can use one of the following methods:
6666

67-
- [PowerShell](#powershell)
68-
- [Mobile Device Management (MDM)](#mobile-device-management-mdm)
6967
- [Microsoft Intune](#microsoft-intune)
68+
- [Mobile Device Management (MDM)](#mobile-device-management-mdm)
7069
- [Group Policy](#group-policy)
7170
- [Microsoft Configuration Manager](#microsoft-configuration-manager)
72-
73-
### PowerShell
74-
75-
1. On your Windows device, select Start, type `powershell`, right-click **Windows PowerShell**, and then select **Run as administrator**.
76-
77-
2. Run the following cmdlet:
78-
79-
```PowerShell
80-
Set-MpPreference -EnableNetworkProtection Enabled
81-
```
82-
83-
3. For Windows Server, use the additional commands that listed in the following table:
84-
85-
| Windows Server version | Commands |
86-
|---|---|
87-
| Windows Server 2019 and later | `set-mpPreference -AllowNetworkProtectionOnWinServer $true` |
88-
| Windows Server 2016 <br/>Windows Server 2012 R2 with the [unified agent for Microsoft Defender for Endpoint](/defender-endpoint/enable-network-protection) | `set-MpPreference -AllowNetworkProtectionDownLevel $true` <br/> `set-MpPreference -AllowNetworkProtectionOnWinServer $true` |
89-
90-
4. (This step is optional.) To set network protection to audit mode, use the following cmdlet:
91-
92-
```PowerShell
93-
Set-MpPreference -EnableNetworkProtection AuditMode
94-
```
95-
96-
To turn off network protection, use the `Disabled` parameter instead of `AuditMode` or `Enabled`.
97-
98-
### Mobile device management (MDM)
99-
100-
1. Use the [EnableNetworkProtection](/windows/client-management/mdm/policy-csp-defender#enablenetworkprotection) configuration service provider (CSP) to enable or disable network protection or enable audit mode.
101-
102-
2. [Update Microsoft Defender antimalware platform to the latest version](https://support.microsoft.com/topic/update-for-microsoft-defender-antimalware-platform-92e21611-8cf1-8e0e-56d6-561a07d144cc) before you enable or disable network protection or enable audit mode.
71+
- [PowerShell](#powershell)
10372

10473
### Microsoft Intune
10574

@@ -155,6 +124,12 @@ To enable network protection, you can use one of the following methods:
155124

156125
8. Review all the information, and then select **Create**.
157126

127+
### Mobile device management (MDM)
128+
129+
1. Use the [EnableNetworkProtection](/windows/client-management/mdm/policy-csp-defender#enablenetworkprotection) configuration service provider (CSP) to turn network protection on or off, or to enable audit mode.
130+
131+
2. [Update Microsoft Defender anti-malware platform to the latest version](https://support.microsoft.com/topic/update-for-microsoft-defender-antimalware-platform-92e21611-8cf1-8e0e-56d6-561a07d144cc) before you turn network protection on or off.
132+
158133
### Group Policy
159134

160135
Use the following procedure to enable network protection on domain-joined computers or on a standalone computer.
@@ -163,19 +138,19 @@ Use the following procedure to enable network protection on domain-joined comput
163138

164139
*-Or-*
165140

166-
On a domain-joined Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**.
141+
On a domain-joined Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx). Right-click the Group Policy Object you want to configure and select **Edit**.
167142

168143
2. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**.
169144

170145
3. Expand the tree to **Windows components** \> **Microsoft Defender Antivirus** \> **Microsoft Defender Exploit Guard** \> **Network protection**.
171146

172-
Note that on older versions of Windows, the Group Policy path might have *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus*.
147+
On older versions of Windows, the Group Policy path might have *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus*.
173148

174149
4. Double-click the **Prevent users and apps from accessing dangerous websites** setting and set the option to **Enabled**. In the options section, you must specify one of the following options:
175150

176151
- **Block** - Users can't access malicious IP addresses and domains.
177152
- **Disable (Default)** - The Network protection feature won't work. Users aren't blocked from accessing malicious domains.
178-
- **Audit Mode** - If a user visits a malicious IP address or domain, an event will be recorded in the Windows event log. However, the user won't be blocked from visiting the address.
153+
- **Audit Mode** - If a user visits a malicious IP address or domain, an event is recorded in the Windows event log. However, the user won't be blocked from visiting the address.
179154

180155
> [!IMPORTANT]
181156
> To fully enable network protection, you must set the Group Policy option to **Enabled** and also select **Block** in the options drop-down menu.
@@ -203,11 +178,42 @@ Use the following procedure to enable network protection on domain-joined comput
203178

204179
7. From the ribbon, select **Deploy** to deploy the policy to a collection.
205180

181+
### PowerShell
182+
183+
1. On your Windows device, click **Start**, type `powershell`, right-click **Windows PowerShell**, and then select **Run as administrator**.
184+
185+
2. Run the following cmdlet:
186+
187+
```PowerShell
188+
Set-MpPreference -EnableNetworkProtection Enabled
189+
```
190+
191+
3. For Windows Server, use the additional commands listed in the following table:
192+
193+
| Windows Server version | Commands |
194+
|---|---|
195+
|Windows Server 2019 and later | `set-mpPreference -AllowNetworkProtectionOnWinServer $true` |
196+
|Windows Server 2016 <br/>Windows Server 2012 R2 with the [unified agent for Microsoft Defender for Endpoint](/defender-endpoint/enable-network-protection) | `set-MpPreference -AllowNetworkProtectionDownLevel $true` <br/> `set-MpPreference -AllowNetworkProtectionOnWinServer $true` <br/> `set-MpPreference -AllowDatagramProcessingOnWinServer $true`|
197+
198+
> [!IMPORTANT]
199+
> For Domain Controllers and Microsoft Exchange servers, set the `AllowDatagramProcessingOnWinServer` parameter to `$false`. These roles often generate high volumes of UDP traffic, which can affect network performance and reliability when datagram processing is enabled. Disabling this setting helps maintain network stability and optimize resource usage in demanding environments.
200+
201+
4. (This step is optional.) To set network protection to audit mode, use the following cmdlet:
202+
203+
```PowerShell
204+
Set-MpPreference -EnableNetworkProtection AuditMode
205+
```
206+
207+
To turn off network protection, use the `Disabled` parameter instead of `AuditMode` or `Enabled`.
208+
206209
#### Important information about removing Exploit Guard settings from a device
207210

208-
Once an Exploit Guard policy is deployed using Configuration Manager, Exploit Guard settings aren't removed from the clients if you remove the deployment. Furthermore, if you remove the client's Exploit Guard deployment, `Delete not supported` is recorded in the client's `ExploitGuardHandler.log` in Configuration Manager. <!--CMADO8538577-->
211+
When you deploy an Exploit Guard policy using Configuration Manager, the settings remain on the client even if you later remove the deployment. If the deployment is removed, the client logs `Delete` not supported in the `ExploitGuardHandler.log` file.
212+
213+
<!--CMADO8538577-->
209214

210-
Use the following PowerShell script in the SYSTEM context to remove Exploit Guard settings correctly:<!--CMADO9907132-->
215+
Use the following PowerShell script in the `SYSTEM` context to remove Exploit Guard settings correctly:
216+
<!--CMADO9907132-->
211217

212218
```powershell
213219
$defenderObject = Get-WmiObject -Namespace "root/cimv2/mdm/dmmap" -Class "MDM_Policy_Config01_Defender02" -Filter "InstanceID='Defender' and ParentID='./Vendor/MSFT/Policy/Config'"

0 commit comments

Comments
 (0)