Chapter 8 – Windows Defender & Microsoft Defender Antivirus Policies

-

 Windows Server Group Policy (GPO) Master Handbook

Chapter 8 – Windows Defender & Microsoft Defender Antivirus Policies

Learning Objectives

Learn how to manage Microsoft Defender Antivirus through Group Policy, secure Windows endpoints, configure enterprise protection, and troubleshoot Defender issues.

1. GPO Path

Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus

2. Microsoft Defender Overview

Microsoft Defender Antivirus is the built-in endpoint protection platform for Windows Server and Windows 10/11. It provides real-time malware protection, cloud intelligence, exploit mitigation, and integration with Microsoft Defender for Endpoint.

3. Core Policies

Enable real-time protection, cloud-delivered protection, automatic sample submission, scheduled scans, behavior monitoring, network protection, SmartScreen, and Controlled Folder Access.

4. Recommended Enterprise Configuration

Real-time Protection: Enabled
Cloud Protection: Enabled
Automatic Sample Submission: Send safe samples automatically
Behavior Monitoring: Enabled
PUA Protection: Enabled
Network Protection: Enabled
Tamper Protection: Manage centrally where supported.

5. Exclusions

Configure file, folder, process, and extension exclusions only when required by supported business applications such as SQL Server, Oracle Database, Exchange Server, Hyper-V, or backup software.

6. Attack Surface Reduction (ASR)

Use ASR rules to block Office macros, executable content from email, credential theft, script abuse, and ransomware behavior. Test in Audit mode before enabling Block mode.

7. Controlled Folder Access

Protect important folders from unauthorized modification. Add trusted applications where necessary after testing.

8. Microsoft Defender Firewall

Manage inbound and outbound firewall rules through Group Policy. Use separate profiles for Domain, Private, and Public networks.

9. Monitoring & Event Logs

Review Windows Security, Microsoft-Windows-Windows Defender/Operational logs, Windows Security Center, and Microsoft Defender portal (if integrated).

10. PowerShell Commands

Get-MpComputerStatus
Get-MpPreference
Set-MpPreference
Start-MpScan -ScanType QuickScan
Update-MpSignature

11. Troubleshooting

Verify the Defender service is running, confirm no third-party antivirus has disabled Defender, run gpupdate /force, check Event Viewer, review Get-MpComputerStatus, update signatures, and confirm GPO precedence.

12. Best Practices

Enable cloud protection, keep signatures updated, minimize exclusions, enable ASR rules gradually, audit changes, and review Defender alerts regularly.

13. Interview Questions

What is Microsoft Defender Antivirus? Explain Tamper Protection. What are ASR rules? What is Controlled Folder Access? How do you verify Defender status using PowerShell?

14. Practical Lab

Create a GPO to enable Defender real-time protection and cloud protection, force a policy update, verify with Get-MpComputerStatus, and perform a quick scan.

Common Defender Policies

Policy

Recommended

GPO Category

Real-time Protection

Enabled

Microsoft Defender Antivirus

Cloud-delivered Protection

Enabled

MAPS

Behavior Monitoring

Enabled

Real-time Protection

PUA Protection

Enabled

Microsoft Defender Antivirus

Controlled Folder Access

Enabled (Test First)

Windows Security

Network Protection

Enabled

Microsoft Defender Exploit Guard

Automatic Signature Updates

Enabled

Security Intelligence

Scheduled Scan

Daily

Scan

Microsoft Learn References

Microsoft Defender Antivirus

Defender Antivirus Group Policy

Attack Surface Reduction Rules

Microsoft Defender for Endpoint

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

IIS Self Signed

-
Image
  Securing the server with SSL Now we want to secure the cats by adding a SSL certificate to our Server. In your IIS Manager go to your server (The top of the tree to the left)  ➜  Scroll down and double-click Server Certificates. (If your self-signed certificate is already here, jump ahead to the bindings steps) We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import… Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK Your certificate is now added Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-)) So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop do...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more