configuring-windows-defender-advanced-settings

# Configuring Windows Defender Advanced Settings ## When to Use Use this skill when: - Configuring Microsoft Defender for Endpoint (MDE) beyond default settings for enhanced protection - Implementing Attack Surface Reduction (ASR) rules to block common attack techniques - Enabling controlled folder access for ransomware protection - Configuring network protection and exploit protection features - Deploying Defender settings via Intune, SCCM, or Group Policy at enterprise scale **Do not use** this skill for third-party EDR deployment (CrowdStrike, SentinelOne) or for Microsoft Defender for Cloud (Azure workload protection). ## Prerequisites - Windows 10/11 Enterprise with Microsoft Defender Antivirus enabled - Microsoft 365 E5 or Microsoft Defender for Endpoint Plan 2 license (for full MDE features) - Microsoft Intune or SCCM for enterprise policy deployment - Microsoft 365 Defender portal access (security.microsoft.com) - Endpoints not running third-party AV in active mode (Defender enters passive mode) ## Workflow ### Step 1: Configure Attack Surface Reduction (ASR) Rules ASR rules block specific behaviors commonly used by malware and attackers: ```powershell # Enable ASR rules via PowerShell (or deploy via Intune/GPO) # Mode: 0=Disabled, 1=Block, 2=Audit, 6=Warn # Block executable content from email client and webmail Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 ` -AttackSurfaceReductionRules_Actions 1 # Block all Offic...