Harden Microsoft Defender Antivirus beyond the defaults

Microsoft Defender Antivirus runs on every supported Windows client and server unless another antivirus has replaced it. Out of the box it already detects a lot. But several of its strongest features are off, left to local users, or rely on defaults that attackers know how to undo. This guide lists the settings that turn it from "installed" into "hardened", with Group Policy paths, PowerShell for testing and the checks to run afterwards.

All Group Policy settings below are under Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus. The same settings exist in Intune under Endpoint security > Antivirus.

1. Make sure Defender is really running

Before tuning anything, check the state on a sample of machines:

Get-MpComputerStatus | Select-Object AMRunningMode, AMServiceEnabled,
  RealTimeProtectionEnabled, BehaviorMonitorEnabled, IoavProtectionEnabled,
  IsTamperProtected, AntivirusSignatureAge, AMProductVersion

• AMRunningMode should be Normal. Passive Mode means another antivirus is primary and Defender is not blocking.
• AntivirusSignatureAge should be 0 or 1 day.
• AMProductVersion is the platform version; old platforms miss features and fixes, so keep platform updates flowing (they come through Windows Update / WSUS as a separate update category).

2. Cloud-delivered protection and block at first sight

Most of Defender's ability to stop never-seen-before files comes from the cloud. When a suspicious file appears, the client can hold it while the cloud analyses metadata and, if needed, the sample itself.

PowerShell equivalents for a test machine:

Set-MpPreference -MAPSReporting Advanced -SubmitSamplesConsent SendSafeSamples `
  -DisableBlockAtFirstSeen $false -CloudBlockLevel High -CloudExtendedTimeout 50

Block at first sight only works when MAPS reporting and sample submission are both on. "High" cloud blocking is aggressive enough to matter and rarely noisy; High+ and Zero tolerance are for locked-down devices.

3. Tamper Protection

Tamper Protection stops local changes to key Defender settings: turning off real-time protection, behaviour monitoring, cloud protection, removing security intelligence updates. It blocks these even for a local administrator, which is exactly the account an attacker has when they try.

It cannot be enabled by Group Policy. Turn it on through Microsoft Defender for Endpoint / Intune (tenant-wide or per-device profiles) or, on a standalone machine, in Windows Security > Virus & threat protection settings. Verify with IsTamperProtected in Get-MpComputerStatus.

If you manage Defender with Group Policy only, you still benefit from Tamper Protection when it is enabled from Windows Security, but you lose central enforcement. That is a good argument for onboarding at least the Defender configuration to Intune.

4. Real-time, behaviour and script protection

These are on by default. Make sure nothing (old GPO, image build script, third-party tool) turned them off, and lock them:

The last line is important: with merge disabled, exclusions added locally with Add-MpPreference -ExclusionPath by an attacker are ignored, and only centrally managed exclusions apply.

5. Potentially unwanted applications (PUA)

Adware bundlers, cryptominers and "free" remote-access tools are not malware in the strict sense, but they are often how intrusions start or persist.

• GPO: Configure detection for potentially unwanted applications = Enabled, Block.
• PowerShell: Set-MpPreference -PUAProtection Enabled (use AuditMode first if you have a permissive software culture).

Microsoft Edge has its own PUA blocking for downloads under its SmartScreen settings; enable both.

6. Network protection

Network protection extends SmartScreen-style reputation blocking to all processes, not just the browser, so a malicious script or implant calling a known-bad domain or IP is blocked at the connection.

• GPO: Microsoft Defender Exploit Guard > Network Protection > Prevent users and apps from accessing dangerous websites = Enabled, Block (start with Audit Mode).
• PowerShell: Set-MpPreference -EnableNetworkProtection Enabled.
• On Windows Server, network protection must also be explicitly allowed: Set-MpPreference -AllowNetworkProtectionOnWinServer $true.

Audit events are 1125 (would have blocked) and blocks are 1126 in the Defender Operational log.

7. Controlled folder access (selectively)

Controlled folder access protects Documents, Pictures and other folders from modification by untrusted processes, a strong anti-ransomware layer. It also generates support tickets when legitimate apps are blocked from saving. Run it in audit mode (Set-MpPreference -EnableControlledFolderAccess AuditMode), review events 1124, allow trusted apps, and enforce for groups that can tolerate it, such as finance workstations.

8. Scans, updates and remediation

9. Exclusion hygiene

Exclusions are where Defender protection quietly disappears. Audit them:

Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension

Warning signs:

• Whole drives, C:\Windows\Temp, %TEMP%, %APPDATA%, C:\Users, C:\ProgramData.
• Process exclusions for interpreters (powershell.exe, python.exe, cmd.exe).
• Extension exclusions for .exe, .dll, .ps1.

On servers, Defender already applies automatic exclusions for Windows Server roles (for example AD DS database files and SYSVOL on domain controllers). You rarely need the long manual lists from old vendor guides. For third-party applications, ask the vendor for the minimum paths and document an owner and review date for each.

Also hide exclusions with Exclusions > Control whether or not exclusions are visible to Local Users (not configured by default, so set it explicitly), and preferably its stricter sibling Control whether or not exclusions are visible to Local Admins, which denies attackers an easy map of where to drop tools.

10. Monitor

Forward the Defender Operational log to your SIEM and alert on:

Checklist

• Defender in Normal mode everywhere it should be primary
• Advanced MAPS, safe samples, block at first sight, High cloud level, 50 s extended check
• Tamper Protection on (verify IsTamperProtected)
• Local override and local exclusion merge disabled
• PUA and network protection in block mode (after audit)
• Exclusions reviewed, owned and minimal
• Defender events forwarded and alerted

Once the antivirus is solid, layer ASR rules on top and consider application control for systems where "only known software" is realistic.