Skip to content

Commit effa5f6

Browse files
Stacyrch140Stacyrch140
authored
Merge branch 'main' into repo_sync_working_branch
2 parents 22125c1 + f063395 commit effa5f6

File tree

4 files changed

+297
-277
lines changed

4 files changed

+297
-277
lines changed

‎.openpublishing.redirection.defender.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@
44
"source_path": "defender/advanced-hunting-overview.md",
55
"redirect_url": "/defender-xdr/advanced-hunting-overview",
66
"redirect_document_id": false
7+
},
8+
{
9+
"source_path": "defender-endpoint/microsoft-defender-antivirus-using-mde-security-set-mngmnt.md",
10+
"redirect_url": "/defender-endpoint/evaluate-mdav-using-gp",
11+
"redirect_document_id": true
712
}
813
]
914
}

‎defender-endpoint/TOC.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,8 @@
6767
href: evaluate-microsoft-defender-antivirus.md
6868
- name: Evaluate Microsoft Defender Antivirus using PowerShell
6969
href: microsoft-defender-antivirus-using-powershell.md
70-
- name: Evaluate Microsoft Defender Antivirus using MDE Security Settings Management
71-
href: microsoft-defender-antivirus-using-mde-security-set-mngmnt.md
70+
- name: Evaluate Microsoft Defender Antivirus using Group Policy
71+
href: evaluate-mdav-using-gp.md
7272
- name: Microsoft Defender for Endpoint demonstration scenarios
7373
href: defender-endpoint-demonstrations.md
7474
- name: App reputation demonstration

‎defender-endpoint/evaluate-mdav-using-gp.md‎

Lines changed: 290 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,290 @@
1+
---
2+
title: Evaluate Microsoft Defender Antivirus using Group Policy
3+
description: Use this guide to evaluate and test the protection offered by Microsoft Defender Antivirus using Group Policy.
4+
ms.service: defender-endpoint
5+
ms.localizationpriority: medium
6+
ms.topic: conceptual
7+
author: deniseb
8+
ms.author: deniseb
9+
ms.custom: nextgen
10+
ms.date: 05/10/2024
11+
ms.reviewer:
12+
manager: deniseb
13+
ms.subservice: ngp
14+
ms.collection:
15+
- m365-security
16+
- tier2
17+
- mde-ngp
18+
search.appverid: met150
19+
---
20+
21+
# Evaluate Microsoft Defender Antivirus using Group Policy
22+
23+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
24+
25+
26+
**Applies to:**
27+
28+
- Microsoft Defender Antivirus
29+
- [Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
30+
- [Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
31+
32+
**Platforms**
33+
34+
- Windows
35+
36+
In Windows 10 or newer and Windows Server 2016 or newer, you can use next-generation protection features offered by Microsoft Defender Antivirus (MDAV) and Microsoft Defender Exploit Guard (Microsoft Defender EG).
37+
38+
This topic explains how to enable and test the key protection features in Microsoft Defender AV and Microsoft Defender EG and provides you with guidance and links to more information.
39+
40+
This article describes configuration options in Windows 10 or newer and Windows Server 2016 or newer.
41+
42+
## Use Microsoft Defender Antivirus using Group Policy to enable the features
43+
44+
This guide provides the Microsoft Defender Antivirus Group Policy that configures the features you should use to evaluate our protection.
45+
46+
1. Grab the latest 'Windows Group Policy Administrative Templates'.
47+
48+
For more information, see [Create and manage Central Store - Windows Client](/troubleshoot/windows-client/group-policy/create-and-manage-central-store#links-to-download-the-administrative-templates-files-based-on-the-operating-system-version).
49+
50+
> [!TIP]
51+
> 1. The Windows one works with the Windows Servers.
52+
>
53+
> 1. Even if you are running a Windows 10 or Windows Server 2016, get the latest administrative templates for Windows 11 or newer.
54+
55+
56+
2. Create a 'Central Store' to host the latest .admx and .adml templates.
57+
58+
For more information, see [Create and manage Central Store - Windows Client](/troubleshoot/windows-client/group-policy/create-and-manage-central-store#the-central-store).
59+
60+
If joined to a domain:
61+
62+
1. Create a new OU block policy inheritance.
63+
64+
1. Open Group policy Management Console (GPMC.msc).
65+
66+
1. Go to **Group Policy Objects** and create a new Group Policy.
67+
68+
1. Right-click the new policy created and select **Edit**.
69+
70+
1. Navigate to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus**.
71+
72+
or
73+
74+
If joined to a workgroup
75+
76+
1. Open Group Policy Editor MMC (GPEdit.msc).
77+
78+
2. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus**.
79+
80+
## MDAV and Potentially Unwanted Applications (PUA)
81+
82+
**Root:**
83+
84+
| Description | Setting |
85+
| --- | --- |
86+
| Turn off Microsoft Defender Antivirus | Disabled |
87+
| Configure detection for potentially unwanted applications | Enabled - Block |
88+
89+
## Real-time protection (always-on protection, real-time scanning)
90+
91+
\\**Real-time protection:**
92+
93+
| Description | Setting |
94+
| --- | --- |
95+
| Turn off real-time protection | Disabled |
96+
| Configure monitoring for incoming and outgoing file and program activity | Enabled, bi-directional (full on-access) |
97+
| Turn on Behavior Monitoring | Enabled |
98+
| Monitor file and program activity on your computer | Enabled |
99+
100+
## Cloud protection features
101+
102+
Standard security intelligence updates can take hours to prepare and deliver; our cloud-delivered protection service can deliver this protection in seconds.
103+
104+
For more information, see [Use next-gen technologies in Microsoft Defender Antivirus through cloud-delivered protection](/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus).
105+
106+
\\**MAPS:**
107+
108+
| Description | Setting |
109+
| --- | --- |
110+
| Join Microsoft MAPS | Enabled, Advanced MAPS |
111+
| Configure the ‘Block at First Sight’ feature | Enabled |
112+
| Send file samples when further analysis is required | Enabled, Send all samples |
113+
114+
\\**MpEngine:**
115+
116+
| Description | Setting |
117+
| --- | --- |
118+
| Select cloud protection level | Enabled, High blocking level |
119+
| Configure extended cloud check | Enabled, 50 |
120+
121+
## Scans
122+
123+
| Description | Setting |
124+
| --- | --- |
125+
| Turn on Heuristics | Enabled |
126+
| Turn on e-mail scanning | Enabled |
127+
| Scan all downloaded files and attachments | Enabled |
128+
| Turn on script scanning | Enabled |
129+
| Scan archive files | Enabled |
130+
| Scan packed executables | Enabled |
131+
| Configure scanning of network files (Scan Network Files) | Enabled |
132+
| Scan removable drives | Enabled |
133+
| Turn on reparse point scanning | Enabled |
134+
135+
## Security Intelligence updates
136+
137+
| Description | Setting |
138+
| --- | --- |
139+
| Specify the interval to check for security intelligence updates | Enabled, 4 |
140+
| Define the order of sources for downloading security intelligence updates | Enabled, under 'Define the order of sources for downloading security intelligence updates'<br><br>InternalDefinitionUpdateServer \| MicrosoftUpdateServer \| MMPC<br><br>**Note:** Where InternalDefinitionUpdateServer is WSUS with Microsoft Defender Antivirus updates allowed.<br><br>MicrosoftUpdateServer == Microsoft Update (formerly Windows Update).<br><br>MMPC == https://www.microsoft.com/en-us/wdsi/definitions |
141+
142+
## Disable local administrator AV settings
143+
144+
Disable local administrator AV settings such as exclusions, and enforce the policies from the Microsoft Defender for Endpoint Security Settings Management.
145+
146+
**Root:**
147+
148+
| Description | Setting |
149+
| --- | --- |
150+
| Configure local administrator merge behavior for lists | Disabled |
151+
| Control whether or not exclusions are visible to local admins | Enabled |
152+
153+
## Threat Severity Default Action
154+
155+
\\**Threats**
156+
157+
| Description | Setting | Alert level | Action |
158+
| --- | --- | --- | --- |
159+
| Specify threat alert levels at which default action shouldn't be taken when detected | Enabled | | |
160+
| | | 5 (Severe) | 2 (Quarantine) |
161+
| | | 4 (High) | 2 (Quarantine) |
162+
| | | 2 (Medium) | 2 (Quarantine) |
163+
| | | 1 (Low) | 2 (Quarantine) |
164+
165+
\\**Quarantine**
166+
167+
| Description | Setting |
168+
| --- | --- |
169+
| Configure removal of items from Quarantine folder | Enabled, 60 |
170+
171+
\\**Client Interface**
172+
173+
| Description | Setting |
174+
| --- | --- |
175+
| Enable headless UI mode | Disabled |
176+
177+
## Network Protection
178+
179+
\\**Microsoft Defender Exploit Guard\\Network Protection:**
180+
181+
| Description | Setting |
182+
| --- | --- |
183+
| Prevent users and apps from accessing dangerous websites | Enabled, Block |
184+
| This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server | Enabled |
185+
| Allow Network Protection Down Level | Network protection is enabled downlevel |
186+
| Allow Datagram Processing On Win Server | Datagram processing on Windows Server is enabled |
187+
| Disable DNS over TCP parsing | DNS over TCP parsing is enabled |
188+
| Disable HTTP parsing | HTTP parsing is enabled |
189+
| Disable SSH parsing | SSH parsing is enabled |
190+
| Disable TLS parsing | TLS parsing is enabled |
191+
| Enable DNS Sinkhole | DNS Sinkhole is enabled |
192+
193+
194+
## Attack Surface Reduction Rules
195+
196+
1. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Microsoft Defender Exploit Guard** > **Attack Surface Reduction**.
197+
198+
2. Select **Next**.
199+
200+
| Description | Setting |
201+
| --- | --- |
202+
| be9ba2d9-53ea-4cdc-84e5-9b1eeee46550<br><br>**Note:** (Block executable content from email client and webmail) | 1 (Block) |
203+
| 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c<br><br>**Note:** (Block Adobe Reader from creating child processes) | 1 (Block) |
204+
| 5beb7efe-fd9a-4556-801d-275e5ffc04cc<br><br>**Note:** (Block execution of potentially obfuscated scripts) | 1 (Block) |
205+
| 56a863a9-875e-4185-98a7-b882c64b5ce5<br><br>**Note:** (Block abuse of exploited vulnerable signed drivers) | 1 (Block) |
206+
| 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b<br><br>**Note:** (Block Win32 API calls from Office macros) | 1 (Block) |
207+
| 01443614-cd74-433a-b99e-2ecdc07bfc25<br><br>**Note:** (Block executable files from running unless they meet a prevalence, age, or trusted list criterion) | 1 (Block) |
208+
| 26190899-1602-49e8-8b27-eb1d0a1ce869<br><br>**Note:** (Block Office communication application from creating child processes) | 1 (Block) |
209+
| d4f940ab-401b-4efc-aadc-ad5f3c50688a<br><br>**Note:** (Block all Office applications from creating child processes) | 1 (Block) |
210+
| c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb<br><br>**Note:** ( \[PREVIEW\] Block use of copied or impersonated system tools) | 1 (Block) |
211+
| d3e037e1-3eb8-44c8-a917-57927947596d<br><br>**Note:** (Block JavaScript or VBScript from launching downloaded executable content) | 1 (Block) |
212+
| 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2<br><br>**Note:** (Block credential stealing from the Windows local security authority subsystem) | 1 (Block) |
213+
| a8f5898e-1dc8-49a9-9878-85004b8a61e6<br><br>**Note:** (Block Webshell creation for Servers) | 1 (Block) |
214+
| 3b576869-a4ec-4529-8536-b80a7769e899<br><br>**Note:** (Block Office applications from creating executable content) | 1 (Block) |
215+
| b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4<br><br>**Note:** (Block untrusted and unsigned processes that run from USB) | 1 (Block) |
216+
| 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84<br><br>**Note:** (Block Office applications from injecting code into other processes) | 1 (Block) |
217+
| e6db77e5-3df2-4cf1-b95a-636979351e5b<br><br>**Note:** (Block persistence through WMI event subscription) | 1 (Block) |
218+
| c1db55ab-c21a-4637-bb3f-a12568109d35<br><br>**Note:** (Use advanced protection against ransomware) | 1 (Block) |
219+
| d1e49aac-8f56-4280-b9ba-993a6d77406c<br><br>**Note:** (Block process creations originating from PSExec and WMI commands) | 1 (Block)<br><br>**Note:** If you have Configuration Manager (formerly SCCM), or other management tools that use WMI, you might need to set this to 2 (‘audit’) instead of 1(‘block’). |
220+
| 33ddedf1-c6e0-47cb-833e-de6133960387<br><br>**Note:** ( \[PREVIEW\] Block rebooting machine in Safe Mode) | 1 (Block) |
221+
222+
> [!TIP]
223+
> Some rules may block behavior you find acceptable in your organization. In these cases, change the rule from 'Enabled' to 'Audit' to prevent unwanted blocks.
224+
225+
## Controlled Folder Access
226+
227+
Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Microsoft Defender Exploit Guard** > **Attack Surface Reduction**.
228+
229+
| Description | Setting |
230+
| --- | --- |
231+
| Configure Controlled Folder Access | Enabled, Block |
232+
233+
Assign the policies to the OU where the test machines are located.
234+
235+
## Check the Platform Update version
236+
237+
The latest 'Platform Update' version Production channel (GA) is available here:
238+
239+
[Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623+update)
240+
241+
To check which 'Platform Update' version you have installed, use the following PowerShell command (Run as admin):
242+
243+
```powershell
244+
get-mpComputerStatus | ft AMProductVersion
245+
```
246+
247+
## Check the Security Intelligence Update version
248+
249+
The latest 'Security Intelligence Update' version is available here:
250+
251+
[Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware - Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi/defenderupdates)
252+
253+
To check which 'Security Intelligence Update' version you have installed, use the following PowerShell command (Run as admin):
254+
255+
```PowerShell
256+
get-mpComputerStatus | ft AntivirusSignatureVersion
257+
```
258+
259+
## Check the Engine Update version
260+
261+
The latest scan 'engine update' version is available here:
262+
263+
[Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware - Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi/defenderupdates)
264+
265+
To check which 'Engine Update' version you have installed, use the following PowerShell command(Run as admin):
266+
267+
```PowerShell
268+
get-mpComputerStatus | ft AMEngineVersion
269+
```
270+
271+
If you're finding that your settings aren't taking effect, you might have a conflict. To resolve conflicts, refer:
272+
[Troubleshoot Microsoft Defender Antivirus settings](troubleshoot-settings.md).
273+
274+
## For False Negatives (FNs) submissions
275+
276+
If you have any questions about a detection that Microsoft Defender AV makes, or you discover a missed detection, you can submit a file to us.
277+
278+
If you have Microsoft XDR, Microsoft Defender for Endpoint P2/P1, or Microsoft Defender for Business: refer [Submit files in Microsoft Defender for Endpoint](admin-submissions-mde.md).
279+
280+
If you have Microsoft Defender Antivirus, refer:
281+
https://www.microsoft.com/security/portal/mmpc/help/submission-help.aspx
282+
283+
Microsoft Defender AV indicates a detection through [standard Windows notifications](configure-notifications-microsoft-defender-antivirus.md). You can also [review detections in the Microsoft Defender AV app](review-scan-results-microsoft-defender-antivirus.md).
284+
285+
The Windows event log also records detection and engine events. See the [Microsoft Defender Antivirus events article for a list of event IDs](troubleshoot-microsoft-defender-antivirus.yml) and their corresponding actions.
286+
287+
If your settings aren't applied properly, find out if there are conflicting policies that are enabled in your environment. For more information, see [Troubleshoot Microsoft Defender Antivirus settings](troubleshoot-settings.md).
288+
289+
If you need to open a Microsoft support case:
290+
[Contact Microsoft Defender for Endpoint support](contact-support.md).

0 commit comments

Comments
 (0)