Configure detection for potentially unwanted applications
This registry value controls how Microsoft Defender Antivirus handles potentially unwanted applications (PUAs).
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\PUAProtection
This registry value controls how Microsoft Defender Antivirus handles potentially unwanted applications (PUAs). A PUA is not necessarily classified as malware, but it can exhibit undesirable behavior such as displaying unexpected advertising, bundling additional software, evading security products, or adversely affecting device performance and use.
PUAProtection is a REG_DWORD value with the following meanings:
0: PUA protection is off. Microsoft Defender Antivirus takes no PUA-specific protective action against detected applications.1: PUA protection operates in block mode. Microsoft Defender Antivirus blocks detected PUA files and attempts to download, move, run, or install them.2: PUA protection operates in audit mode. Potentially unwanted applications are detected and relevant events are recorded, but they are not blocked because of this setting.
Notes
Additional effects
In block mode, blocked PUA files are moved to quarantine and appear in protection history alongside other detections. Unless Defender notifications have been disabled separately, the user can also receive a notification prefixed with PUA:.
Audit mode records events for applications on which block mode would have acted. It does not prevent those applications from running or being installed. Microsoft states that these audit detections can be reviewed in Windows Event Viewer, but not in the Microsoft Defender portal.
Security
Block mode extends Microsoft Defender Antivirus protection to software that is not conventional malware but has unwanted or potentially risky behavior. It can therefore stop software such as adware, bundlers, and evasion software that might increase the likelihood of a malware infection or make malicious activity harder to identify.
Audit mode provides detection information only. A value of 0 provides no PUA-specific protection. Both settings therefore permit activity that block mode would prevent. They do not, by themselves, disable the other antimalware protections provided by Microsoft Defender Antivirus.
Possible side effects
Block mode can prevent the use of software that an organization intentionally relies on if Microsoft classifies that software as potentially unwanted because of its behavior or reputation. Downloads, installations, application launches, or workflows that depend on the affected software can consequently be interrupted.
Notes
This setting applies to PUA protection in Microsoft Defender Antivirus. The separate potentially unwanted app protection in Microsoft Edge is controlled by its own Microsoft Defender SmartScreen and Edge policies.
Microsoft lists the related device policy as applicable to Windows 10, version 1607 and later. The Group Policy setting is included in the Windows 10, version 1809 and later Administrative Templates. Supported Windows Server and onboarding scenarios vary according to the operating-system version and the Microsoft Defender solution in use.
Microsoft documentation
Microsoft Learn: Defender Policy CSP – PUAProtection
Microsoft Learn: Block potentially unwanted applications with Microsoft Defender Antivirus