Prevent users and apps from accessing dangerous websites
This policy value controls Microsoft Defender Antivirus network protection at the device level.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection\EnableNetworkProtection
This policy value controls Microsoft Defender Antivirus network protection at the device level. Network protection evaluates outbound connection destinations by domain or host reputation and can prevent supported browsers and other applications from accessing malicious or suspicious destinations. Examples include phishing sites, sources of malicious downloads, exploit-hosting sites, and technical-support scam sites.
The following values are defined for EnableNetworkProtection:
0: Network protection is disabled.1: Network protection operates in block mode. Detected connections are prevented and corresponding events are recorded.2: Network protection operates in audit mode. Connections are allowed, but events are recorded when block mode would have prevented them.
Notes
Additional effects
Network protection extends Microsoft Defender SmartScreen web-protection capabilities to supported browsers and processes outside Microsoft Edge. When used with Microsoft Defender for Endpoint, it can also enforce custom indicators for domains, host names, URLs, or IP addresses. It is also a core component of Microsoft Defender for Endpoint web content filtering.
These capabilities depend on the applicable Defender services, licensing, and additional policies. This registry value does not itself define custom indicators or web content-filtering categories.
Security
Block mode reduces the likelihood that users or applications can connect to known malicious or suspicious destinations. It can therefore help disrupt phishing, malware delivery, and connections to known sources of attacks.
Audit mode does not provide this preventive effect. It only records connections that would have been prevented in block mode. Disabling network protection removes this protection layer, although independent controls such as Microsoft Defender SmartScreen might remain active.
Possible side effects
In block mode, applications or websites can become inaccessible when Microsoft classifies the destination as malicious or suspicious, or when a matching custom indicator or content-filtering rule applies. Legitimate business activity can therefore be disrupted if a required destination is misclassified or intentionally restricted by an organization-specific rule.
Notes
Microsoft Defender Antivirus must be running in active mode for network protection to operate on Windows.
On Windows, network protection does not directly monitor Microsoft Edge. Web-protection scenarios in Edge use Microsoft Defender SmartScreen. Network protection applies to other supported browsers and nonbrowser applications, although protocols such as QUIC and encrypted TLS ClientHello data can limit its inspection capabilities.
Microsoft's policy reference lists this device policy for Windows 10, version 1709 and later supported client versions. Windows Server support has additional version-dependent prerequisites and Defender settings.
Microsoft documentation
Microsoft Learn: Defender Policy CSP – EnableNetworkProtection
Microsoft Learn: Use network protection to help prevent connections to malicious or suspicious sites