You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-business/mdb-faq.yml
+25-25Lines changed: 25 additions & 25 deletions
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ metadata:
10
10
ms.topic: faq
11
11
ms.service: defender-business
12
12
ms.localizationpriority: medium
13
-
ms.date: 03/19/2024
13
+
ms.date: 05/20/2025
14
14
ms.reviewer: efratka, nehabha
15
15
f1.keywords: NOCSH
16
16
ms.collection:
@@ -61,10 +61,10 @@ sections:
61
61
answer: |
62
62
The following table compares server options for Defender for Business customers:
63
63
64
-
|Server license | Description|
65
-
|--|--|
66
-
|Microsoft Defender for Business servers | [Microsoft Defender for Business servers](get-defender-business.md#how-to-get-microsoft-defender-for-business-servers) is an add-on to Defender for Business and Microsoft 365 Business Premium. This offering enables small and medium sized businesses (up to 300 users) to onboard and protect servers and client devices in the [Microsoft Defender portal](https://security.microsoft.com).|
67
-
|Microsoft Defender for Servers Plan 1 / Plan 2|[Microsoft Defender for Servers Plan 1/Plan 2](/azure/defender-for-cloud/plan-defender-for-servers) is an enterprise-focused offering that can be purchased with any other Microsoft cloud plan. This offering is part of [Microsoft Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction), and includes advanced threat hunting with six months of data retention and the Microsoft Threat Experts service.<br/><br/>The admin experience for Defender for Cloud resides within the Azure portal ([https://portal.azure.com](https://portal.azure.com)).|
64
+
|Server license|Description|
65
+
|---|---|
66
+
|Microsoft Defender for Business servers|[Microsoft Defender for Business servers](get-defender-business.md#how-to-get-microsoft-defender-for-business-servers) is an add-on to Defender for Business and Microsoft 365 Business Premium. This offering enables small and medium sized businesses (up to 300 users) to onboard and protect servers and client devices in the [Microsoft Defender portal](https://security.microsoft.com).|
67
+
|Microsoft Defender for Servers Plan 1 / Plan 2|[Microsoft Defender for Servers Plan 1/Plan 2](/azure/defender-for-cloud/plan-defender-for-servers) is an enterprise-focused offering that can be purchased with any other Microsoft cloud plan. This offering is part of [Microsoft Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction), and includes advanced threat hunting with six months of data retention and the Microsoft Threat Experts service.<br/><br/>The admin experience for Defender for Cloud resides within the Azure portal ([https://portal.azure.com](https://portal.azure.com)).|
68
68
69
69
Adding Defender for Cloud to a tenant that has Defender for Business doesn't change the simplified configuration experience that Defender for Business offers. The functionality in Microsoft Defender for Servers Plan 1 or Plan 2 work with Defender for Business.
70
70
@@ -90,7 +90,7 @@ sections:
90
90
91
91
|OS|Method|Notes|
92
92
|---|---|---|
93
-
|Windows|[Attack surface reduction rules](/defender-endpoint/attack-surface-reduction-rules-deployment)|On Windows devices, you can configure device control through ASR rules. You'll need [Microsoft Intune](/mem/intune/fundamentals/what-is-intune) to set up your ASR rules. Intune is not included in the standalone version of Defender for Business, but you can add it on. Intune is included in [Microsoft 365 Business Premium](/microsoft-365/business-premium). <br/><br/>[ASR capabilities in Defender for Business](mdb-asr.md)|
93
+
|Windows|[Attack surface reduction rules](/defender-endpoint/attack-surface-reduction-rules-deployment)|On Windows devices, you can configure device control through ASR rules. You'll need [Microsoft Intune](/mem/intune/fundamentals/what-is-intune) to set up your ASR rules. Intune is not included in the standalone version of Defender for Business, but you can add it on. Intune is included in [Microsoft 365 Business Premium](/microsoft-365/business-premium). <br/><br/>[ASR capabilities in Defender for Business](mdb-asr.md)|
94
94
|Mac|Jamf or Intune|You can use Jamf or Intune to set up device control on Mac. See [Device Control for macOS](/defender-endpoint/mac-device-control-overview).|
95
95
96
96
- question: How do I run custom reports with Defender for Business?
@@ -141,25 +141,25 @@ sections:
141
141
142
142
The following table summarizes some differences between Defender for Business and Defender for Endpoint:
143
143
144
-
|Capabilities | Defender forBusiness | Defender forEndpoint Plan 1 | Defender forEndpoint Plan 2|
145
-
|---|---|---|---|
146
-
|Centralized management | ✔ | ✔ | ✔ |
147
-
|Simplified firewall and antivirus configuration for Windows | ✔ | | |
Copy file name to clipboardExpand all lines: defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus.md
+4-5Lines changed: 4 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Exclude files from Microsoft Defender Antivirus scans based on thei
4
4
ms.service: defender-endpoint
5
5
ms.subservice: ngp
6
6
ms.localizationpriority: medium
7
-
ms.date: 01/27/2025
7
+
ms.date: 05/19/2025
8
8
author: emmwalshh
9
9
ms.author: ewalsh
10
10
ms.topic: conceptual
@@ -38,10 +38,9 @@ You can define exclusions for Microsoft Defender Antivirus that apply to [schedu
38
38
-[Exclusions for files that are opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md)
39
39
40
40
> [!IMPORTANT]
41
-
> Microsoft Defender Antivirus exclusions do apply to some Microsoft Defender for Endpoint capabilities, such as [attack surface reduction rules](attack-surface-reduction.md). Some Microsoft Defender Antivirus exclusions are applicable to some ASR rule exclusions. See [Attack surface reduction rules reference - Microsoft Defender Antivirus exclusions and ASR rules](attack-surface-reduction-rules-reference.md#microsoft-defender-antivirus-exclusions-and-asr-rules).
42
-
> Files that you exclude using the methods described in this article can still trigger Endpoint Detection and Response (EDR) alerts and other detections.
43
-
> To exclude files broadly, add them to the Microsoft Defender for Endpoint [custom indicators](indicators-overview.md).
44
-
> Variables, such as `%USERPROFILE%` aren't interpreted in exclusion settings. We recommend using an explicit path format.
41
+
> - Microsoft Defender Antivirus exclusions do apply to some Microsoft Defender for Endpoint capabilities, such as [attack surface reduction rules](attack-surface-reduction.md). Some Microsoft Defender Antivirus exclusions are applicable to some ASR rule exclusions. See [Attack surface reduction rules reference - Microsoft Defender Antivirus exclusions and ASR rules](attack-surface-reduction-rules-reference.md#microsoft-defender-antivirus-exclusions-and-asr-rules).
42
+
> - Files that you exclude using the methods described in this article can still trigger Endpoint Detection and Response (EDR) alerts and other detections. To exclude files broadly, add them to the Microsoft Defender for Endpoint [custom indicators](indicators-overview.md).
43
+
> - Variables, such as `%USERPROFILE%` aren't interpreted in exclusion settings. We recommend using an explicit path format.
5. On the **Basics** page, enter a name and description for the profile, then choose **Next**.
62
60
63
-
## Enable network protection
61
+
6. On the **Settings** page, expand each group of settings, and configure the settings you want to manage with this profile.
62
+
63
+
- Network Protection on Windows clients:
64
+
65
+
| Description| Setting|
66
+
| -------- | -------- |
67
+
| Enable Network Protection|Options:<br>- Enabled (block mode) Block mode is needed to block IP address/URL indicators and Web Content Filtering.<br>- Enabled (audit mode) <br>- Disabled (Default) <br>- Not Configured|
68
+
69
+
- Network Protection on Windows Server 2012 R2 and Windows Server 2016
70
+
71
+
| Description|Setting|
72
+
| -------- | -------- |
73
+
|Allow Network Protection Down Level|Options:<br>- Network protection will be enabled downlevel. <br>- Network Protection will be disabled downlevel. (Default) <br>- Not Configured|
74
+
75
+
- Optional Network Protection settings for Windows and Windows Server:
76
+
77
+
> [!WARNING]
78
+
> For Domain Controllers, Windows DNS servers and Microsoft Exchange servers, set the **Allow Datagram Processing On WinServer** to **Datagram processing on Windows Server is disabled**. These roles often generate high volumes of UDP traffic, which can affect network performance and reliability when datagram processing is enabled. Disabling this setting helps maintain network stability and optimize resource usage in demanding environments.
79
+
80
+
|Description| Setting|
81
+
| -------- | -------- |
82
+
|Allow Datagram Processing On Win Server|- Datagram processing on Windows Server is enabled. <br>- Datagram processing on Windows Server is disabled (Default). <br>- Not configured|
83
+
|Disable DNS over TCP parsing|- DNS over TCP parsing is disabled. <br>- DNS over TCP parsing is enabled (Default). <br>- Not configured|
84
+
|Disable HTTP parsing|- HTTP parsing is disabled. <br>- HTTP parsing is enabled (Default). <br>- Not configured|
85
+
|Disable SSH parsing|- SSH parsing is disabled. <br>- SSH parsing is enabled (Default). <br>- Not configured|
86
+
|Disable TLS parsing |- TLS parsing is disabled. <br>- TLS parsing is enabled (Default). <br>- Not configured|
87
+
|[Deprecated]Enable DNS Sinkhole|- DNS Sinkhole is disabled. <br>- DNS Sinkhole is enabled. (Default) <br>- Not configured|
88
+
89
+
7. When you're done configuring settings, select **Next**.
90
+
91
+
8. On the **Assignments** page, select the groups that will receive this profile. Then select **Next**.
64
92
65
-
To enable network protection, you can use one of the following methods:
93
+
9. On the **Review + create** page, review the information, and then select **Save**.
The new profile is displayed in the list when you select the policy type for the profile you created.
72
96
73
97
### Microsoft Intune
74
98
@@ -188,15 +212,16 @@ Use the following procedure to enable network protection on domain-joined comput
188
212
Set-MpPreference -EnableNetworkProtection Enabled
189
213
```
190
214
191
-
3. For Windows Server, use the additional commands listed in the following table:
215
+
1. For Windows Server, use the additional commands listed in the following table:
192
216
193
-
| Windows Server version | Commands |
194
-
|---|---|
195
-
|Windows Server 2019 and later |`set-mpPreference -AllowNetworkProtectionOnWinServer $true` <br/> `set-MpPreference -AllowDatagramProcessingOnWinServer $true`|
196
-
|Windows Server 2016 <br/>Windows Server 2012 R2 with the [unified agent for Microsoft Defender for Endpoint](/defender-endpoint/enable-network-protection)|`set-MpPreference -AllowNetworkProtectionDownLevel $true` <br/> `set-MpPreference -AllowNetworkProtectionOnWinServer $true` <br/> `set-MpPreference -AllowDatagramProcessingOnWinServer $true`|
217
+
| Windows Server version | Commands |
218
+
|---|---|
219
+
|Windows Server 2019 and later |`set-mpPreference -AllowNetworkProtectionOnWinServer $true` <br/> `set-MpPreference -AllowDatagramProcessingOnWinServer $true`|
220
+
|Windows Server 2016 <br/>Windows Server 2012 R2 with the [unified agent for Microsoft Defender for Endpoint](/defender-endpoint/enable-network-protection)|`set-MpPreference -AllowNetworkProtectionDownLevel $true` <br/> `set-MpPreference -AllowNetworkProtectionOnWinServer $true` <br/> `set-MpPreference -AllowDatagramProcessingOnWinServer $true`|
197
221
198
222
> [!IMPORTANT]
199
-
> For Domain Controllers and Microsoft Exchange servers, set the `AllowDatagramProcessingOnWinServer` parameter to `$false`. These roles often generate high volumes of UDP traffic, which can affect network performance and reliability when datagram processing is enabled. Disabling this setting helps maintain network stability and optimize resource usage in demanding environments.
223
+
> For Domain Controllers, Windows DNS servers and Microsoft Exchange servers, set the `AllowDatagramProcessingOnWinServer` parameter to `$false`. These roles often generate high volumes of UDP traffic, which can affect network performance and reliability when datagram processing is enabled. Disabling this setting helps maintain network stability and optimize resource usage in demanding environments.
224
+
200
225
201
226
4. (This step is optional.) To set network protection to audit mode, use the following cmdlet:
202
227
@@ -206,6 +231,27 @@ Use the following procedure to enable network protection on domain-joined comput
206
231
207
232
To turn off network protection, use the `Disabled` parameter instead of `AuditMode` or `Enabled`.
208
233
234
+
235
+
## Check if network protection is enabled
236
+
237
+
You can use Registry Editor to check the status of network protection.
238
+
239
+
1. Select the **Start** button in the task bar and type `regedit`. In the list of results, select Registry editor to open it.
240
+
241
+
2. Choose **HKEY_LOCAL_MACHINE** from the side menu.
242
+
243
+
3. Navigate through the nested menus to **SOFTWARE**\>**Policies**\>**Microsoft**\>**Windows Defender**\>**Policy Manager**.
244
+
245
+
If the key is missing, navigate to **SOFTWARE**\>**Microsoft**\>**Windows Defender**\>**Windows Defender Exploit Guard**\>**Network Protection**.
246
+
247
+
4. Select **EnableNetworkProtection** to see the current state of network protection on the device:
#### Important information about removing Exploit Guard settings from a device
210
256
211
257
When you deploy an Exploit Guard policy using Configuration Manager, the settings remain on the client even if you later remove the deployment. If the deployment is removed, the client logs `Delete` not supported in the `ExploitGuardHandler.log` file.
0 commit comments