You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Download and run this [setup script](https://demo.wd.microsoft.com/Content/CFA_SetupScript.zip). Before running the script set execution policy to Unrestricted using this PowerShell command:
66
+
Download and run this [setup script](https://demo.wd.microsoft.com/Content/CFA_SetupScript.zip). Before running the script, set execution policy to `Unrestricted` by using this PowerShell command:
67
67
68
68
```powershell
69
69
Set-ExecutionPolicy Unrestricted
70
70
```
71
71
72
-
You can perform these manual steps instead:
72
+
Or, you can perform these manual steps instead:
73
73
74
-
1. Create a folder under c: named demo, "c:\demo".
74
+
1. Create a folder under `c:` named `demo`, as in `c:\demo`.
75
75
76
-
2. Save this [clean file](https://demo.wd.microsoft.com/Content/testfile_safe.txt) into c:\demo (we need something to encrypt).
76
+
2. Save this [clean file](https://demo.wd.microsoft.com/Content/testfile_safe.txt) into `c:\demo` (we need something to encrypt).
77
77
78
-
3. Execute PowerShell commands listed earlier in this article.
78
+
3. Run the PowerShell commands listed earlier in this article.
79
+
80
+
Next, check that status of the *Aggressive Ransomware Prevention* ASR rule and disable it for the duration of this test if it's enabled:
if ($idx -ge 0) {Write-Host "Rule Status: " $(Get-MpPreference).AttackSurfaceReductionRules_Actions[$idx]} else {Write-Host "Rule does not exist on this machine"}
86
86
```
87
87
88
-
2. Add the demo folder to protected folders list using PowerShell command:
88
+
If the rule exists and the status is `1 (Enabled)` or `6 (Warn)`, it must be disabled to run this test:
-[Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
27
25
-[Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
28
26
-[Microsoft Defender XDR](/defender-xdr)
27
+
- Microsoft Defender for Servers
29
28
- Microsoft Defender Antivirus
30
29
31
30
**Platforms**
32
31
33
32
- Windows
34
-
- Linux \(See [Network protection for Linux](network-protection-linux.md)\)
35
-
- macOS \(See [Network protection for macOS](network-protection-macos.md)\)
33
+
- Linux (See [Network protection for Linux](network-protection-linux.md))
34
+
- macOS (See [Network protection for macOS](network-protection-macos.md))
36
35
37
36
> [!TIP]
38
37
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-assignaccess-abovefoldlink)
@@ -43,27 +42,27 @@ search.appverid: met150
43
42
44
43
## Check if network protection is enabled
45
44
46
-
Check to see if network protection is enabled on a local device by using Registry editor.
45
+
You can use Registry Editor to check the status of network protection.
47
46
48
-
1. Select the **Start** button in the task bar and type **regedit** to open Registry editor.
47
+
1. Select the **Start** button in the task bar and type `regedit`. In the list of results, select Registry editor to open it.
49
48
50
49
2. Choose **HKEY_LOCAL_MACHINE** from the side menu.
51
50
52
51
3. Navigate through the nested menus to **SOFTWARE**\>**Policies**\>**Microsoft**\>**Windows Defender**\>**Policy Manager**.
53
52
54
-
If the Key is missing, Navigate to **SOFTWARE**\>**Microsoft**\>**Windows Defender**\>**Windows Defender Exploit Guard**\>**Network Protection**.
53
+
If the key is missing, navigate to **SOFTWARE**\>**Microsoft**\>**Windows Defender**\>**Windows Defender Exploit Guard**\>**Network Protection**.
55
54
56
55
4. Select **EnableNetworkProtection** to see the current state of network protection on the device:
@@ -73,27 +72,34 @@ Enable network protection by using any of these methods:
73
72
74
73
### PowerShell
75
74
76
-
1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator**.
75
+
1. On your Windows device, select Start, type `powershell`, right-click **Windows PowerShell**, and then select **Run as administrator**.
76
+
77
+
2. Run the following cmdlet:
77
78
78
-
2. Enter the following cmdlet:
79
+
```PowerShell
80
+
Set-MpPreference -EnableNetworkProtection Enabled
81
+
```
79
82
80
-
```PowerShell
81
-
Set-MpPreference -EnableNetworkProtection Enabled
82
-
```
83
+
3. For Windows Server, use the additional commands that listed in the following table:
83
84
84
-
3. Optional: Enable the feature in audit mode using the following cmdlet:
85
+
| Windows Server version | Commands |
86
+
|---|---|
87
+
| Windows Server 2022 and later |`set-mpPreference -AllowNetworkProtectionOnWinServer $true`|
88
+
| Windows Server 2016 <br/>Windows Server 2012 R2 |`set-MpPreference -AllowNetworkProtectionDownLevel $true` <br/> `set-MpPreference -AllowNetworkProtectionOnWinServer $true`|
To turn off network protection, use the `Disabled` parameter instead of `AuditMode` or `Enabled`.
91
97
92
98
### Mobile device management (MDM)
93
99
94
-
Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](/windows/client-management/mdm/policy-csp-defender) configuration service provider (CSP) to enable or disable network protection or enable audit mode.
100
+
1.Use the [EnableNetworkProtection](/windows/client-management/mdm/policy-csp-defender#enablenetworkprotection) configuration service provider (CSP) to enable or disable network protection or enable audit mode.
95
101
96
-
[Update Microsoft Defender antimalware platform to the latest version](https://support.microsoft.com/topic/update-for-microsoft-defender-antimalware-platform-92e21611-8cf1-8e0e-56d6-561a07d144cc) before you enable or disable network protection or enable audit mode.
102
+
2.[Update Microsoft Defender antimalware platform to the latest version](https://support.microsoft.com/topic/update-for-microsoft-defender-antimalware-platform-92e21611-8cf1-8e0e-56d6-561a07d144cc) before you enable or disable network protection or enable audit mode.
97
103
98
104
### Microsoft Intune
99
105
@@ -141,13 +147,13 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](/windows/
141
147
142
148
4. In the **Template name**, Choose **Endpoint protection** from the list of templates, and then select **Create**.
143
149
144
-
4. Go to **Endpoint protection** > **Basics**, provide a name for your profile, and then select **Next**.
150
+
5. Go to **Endpoint protection** > **Basics**, provide a name for your profile, and then select **Next**.
145
151
146
-
5. In the **Configuration settings** section, go to **Microsoft Defender Exploit Guard** > **Network filtering** > **Network protection** > **Enable** or **Audit**. Select **Next**.
152
+
6. In the **Configuration settings** section, go to **Microsoft Defender Exploit Guard** > **Network filtering** > **Network protection** > **Enable** or **Audit**. Select **Next**.
147
153
148
-
6. Select the appropriate **Scope tags**, **Assignments**, and **Applicability rules** as required by your organization. Admins can set more requirements.
154
+
7. Select the appropriate **Scope tags**, **Assignments**, and **Applicability rules** as required by your organization. Admins can set more requirements.
149
155
150
-
7. Review all the information, and then select **Create**.
156
+
8. Review all the information, and then select **Create**.
151
157
152
158
### Group Policy
153
159
@@ -163,8 +169,7 @@ Use the following procedure to enable network protection on domain-joined comput
163
169
164
170
3. Expand the tree to **Windows components**\>**Microsoft Defender Antivirus**\>**Microsoft Defender Exploit Guard**\>**Network protection**.
165
171
166
-
> [!NOTE]
167
-
> On older versions of Windows, the group policy path may say "Windows Defender Antivirus" instead of "Microsoft Defender Antivirus."
172
+
Note that on older versions of Windows, the Group Policy path might have *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus*.
168
173
169
174
4. Double-click the **Prevent users and apps from accessing dangerous websites** setting and set the option to **Enabled**. In the options section, you must specify one of the following options:
170
175
@@ -175,8 +180,7 @@ Use the following procedure to enable network protection on domain-joined comput
175
180
> [!IMPORTANT]
176
181
> To fully enable network protection, you must set the Group Policy option to **Enabled** and also select **Block** in the options drop-down menu.
177
182
178
-
> [!NOTE]
179
-
> Optional: Follow the steps in [Check if network protection is enabled](#check-if-network-protection-is-enabled) to verify that your Group Policy settings are correct.
183
+
5. (This step is optional.) Follow the steps in [Check if network protection is enabled](#check-if-network-protection-is-enabled) to verify that your Group Policy settings are correct.
180
184
181
185
### Microsoft Configuration Manager
182
186
@@ -199,38 +203,34 @@ Use the following procedure to enable network protection on domain-joined comput
199
203
200
204
7. From the ribbon, select **Deploy** to deploy the policy to a collection.
201
205
202
-
> [!IMPORTANT]
203
-
> Once you deploy an Exploit Guard policy from Configuration Manager, the Exploit Guard settings will not be removed from the clients if you remove the deployment. `Delete not supported` is recorded in the Configuration Manager client's ExploitGuardHandler.log if you remove the client's Exploit Guard deployment. <!--CMADO8538577-->
204
-
> The following PowerShell script can be run under SYSTEM context to remove these settings:<!--CMADO9907132-->
#### Important information about removing Exploit Guard settings from a device
207
+
208
+
Once an Exploit Guard policy is deployed using Configuration Manager, Exploit Guard settings aren't removed from the clients if you remove the deployment. Furthermore, if you remove the client's Exploit Guard deployment, `Delete not supported` is recorded in the client's `ExploitGuardHandler.log` in Configuration Manager. <!--CMADO8538577-->
209
+
210
+
Use the following PowerShell script in the SYSTEM context to remove Exploit Guard settings correctly:<!--CMADO9907132-->
0 commit comments