Skip to content
WindowsHardening

Area 04 / 12

Microsoft Defender

Microsoft Defender Antivirus ships with every supported Windows release, but its defaults are tuned for compatibility, not resistance. This area enables cloud-delivered protection and block at first sight, locks settings with Tamper Protection, adds network protection and PUA blocking, and audits the exclusions attackers love to plant.

Start the path

Learning path

0/4 done
  1. 01Harden Microsoft Defender Antivirus beyond the defaultsConfigure Microsoft Defender Antivirus for resistance, not just compatibility: cloud-delivered protection, block at first sight, Tamper Protection, PUA, network protection and exclusion hygiene.
  2. 02Audit and minimise Microsoft Defender exclusionsFind every Microsoft Defender exclusion across GPO, Intune and local config, justify or remove it, narrow the rest, hide them from admins and monitor changes.
  3. 03Controlled folder access: ransomware protection that worksRoll out Defender controlled folder access against ransomware: audit mode, events 1123 and 1124, allowing apps, adding protected folders and enforcing by ring.
  4. 04EDR in block mode, passive mode and third-party AVHow Defender Antivirus behaves next to another antivirus: active, passive and EDR in block mode, forcing passive mode on servers, what you lose, how to verify.