Configure the 'Block at First Sight' feature
This `REG_DWORD` value controls the Microsoft Defender Antivirus Block at First Sight feature.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Spynet\DisableBlockAtFirstSeen
This REG_DWORD value controls the Microsoft Defender Antivirus Block at First Sight feature. Because the value name begins with Disable, its logic is inverted: 0 turns the feature on, whereas 1 turns it off. Consequently, the Enabled state of the associated Group Policy turns on the feature even though it uses the value 0.
When the feature is active, Microsoft Defender Antivirus consults the cloud protection service before allowing suspicious, previously unseen content from the Internet or Internet zone to run or be accessed. It can apply to executable files and nonportable executable content such as JavaScript, VBScript, and macros. For executable files, Defender can initially submit the file hash for a cloud-based assessment.
If the cloud service can't reach a verdict, Microsoft Defender Antivirus temporarily locks the file and can upload a copy for further analysis. The resulting verdict determines whether the file is allowed or blocked as a threat.
Notes
Additional effects
Block at First Sight can substantially shorten the time required to detect and block new malware compared with relying only on locally available security intelligence. The value doesn't independently change cloud protection or sample-submission settings. In particular, setting DisableBlockAtFirstSeen to 1 doesn't automatically turn off those separate capabilities.
Security
With DisableBlockAtFirstSeen = 1, the additional cloud check before first use of affected content doesn't occur. This lowers protection against new threats that local security intelligence doesn't yet recognize. The value by itself doesn't completely disable Defender real-time protection or cloud protection.
When the feature is active, file hashes and, where further analysis is required, copies of files can be sent to Microsoft's cloud service. The separate sample-submission policy determines which samples may be submitted automatically.
Possible side effects
Suspicious but legitimate files that haven't been seen before can remain temporarily unavailable while cloud analysis is in progress. The delay depends in part on the configured cloud-block timeout and the availability of the cloud protection service.
Notes
The feature depends on several other protection components. Cloud protection or MAPS membership and real-time protection must be active, and scanning of downloaded files and attachments must be enabled.
For sample submission, values 1 (Send safe samples) and 3 (Send all samples) support full operation. Value 0 (Always prompt) lowers the device's protection state, while value 2 (Never send) prevents Block at First Sight from functioning.
Changes to this policy setting might not be applied while tamper protection is enabled.
Microsoft documentation
Microsoft Learn: ADMX_MicrosoftDefenderAntivirus Policy CSP – DisableBlockAtFirstSeen
Microsoft Learn: Configure block at first sight in Microsoft Defender Antivirus