Guides tagged
Roll out Defender controlled folder access against ransomware: audit mode, events 1123 and 1124, allowing apps, adding protected folders and enforcing by ring.
Find every Microsoft Defender exclusion across GPO, Intune and local config, justify or remove it, narrow the rest, hide them from admins and monitor changes.
How Defender Antivirus behaves next to another antivirus: active, passive and EDR in block mode, forcing passive mode on servers, what you lose, how to verify.
Configure Microsoft Defender Antivirus for resistance, not just compatibility: cloud-delivered protection, block at first sight, Tamper Protection, PUA, network protection and exclusion hygiene.
A practical reference to Microsoft Defender ASR rules: what each rule blocks, its GUID, which to enforce first, audit-mode rollout, event IDs and exclusions that don't gut protection.