[{"data":1,"prerenderedAt":295},["ShallowReactive",2],{"doku:en:richtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-root-puaprotection":3},{"seite":4,"start":40,"leiste":41,"bereich":294,"zurueck":294,"weiter":294},{"sprache":5,"rel":6,"zu":7,"id":8,"titel":9,"titelHtml":9,"beschreibung":10,"kennzeile":11,"imMenue":12,"html":13,"ueberschriften":14},"en","richtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-root-puaprotection","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-root-puaprotection","referenz-hilfe-microsoft-policies-windowsdefender-root-puaprotection","Configure detection for potentially unwanted applications","This registry value controls how Microsoft Defender Antivirus handles potentially unwanted applications (PUAs).","since 0.9.8.11",false,"\u003Ch2 id=\"purpose\">Purpose\u003C\u002Fh2>\n\u003Cdetails class=\"doku-klappbox\">\u003Csummary>Show registry keys (1)\u003C\u002Fsummary>\u003Cdiv class=\"doku-klappbox-inhalt\">\n\u003Cul>\n\u003Cli>\u003Ccode>HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\PUAProtection\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fdiv>\u003C\u002Fdetails>\n\u003Cp>This registry value controls how Microsoft Defender Antivirus handles potentially unwanted applications (PUAs). A PUA is not necessarily classified as malware, but it can exhibit undesirable behavior such as displaying unexpected advertising, bundling additional software, evading security products, or adversely affecting device performance and use.\u003C\u002Fp>\n\u003Cp>\u003Ccode>PUAProtection\u003C\u002Fcode> is a \u003Ccode>REG_DWORD\u003C\u002Fcode> value with the following meanings:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ccode>0\u003C\u002Fcode>: PUA protection is off. Microsoft Defender Antivirus takes no PUA-specific protective action against detected applications.\u003C\u002Fli>\n\u003Cli>\u003Ccode>1\u003C\u002Fcode>: PUA protection operates in block mode. Microsoft Defender Antivirus blocks detected PUA files and attempts to download, move, run, or install them.\u003C\u002Fli>\n\u003Cli>\u003Ccode>2\u003C\u002Fcode>: PUA protection operates in audit mode. Potentially unwanted applications are detected and relevant events are recorded, but they are not blocked because of this setting.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"notes\">Notes\u003C\u002Fh2>\n\u003Ch3 id=\"additional-effects\">Additional effects\u003C\u002Fh3>\n\u003Cp>In block mode, blocked PUA files are moved to quarantine and appear in protection history alongside other detections. Unless Defender notifications have been disabled separately, the user can also receive a notification prefixed with \u003Ccode>PUA:\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Cp>Audit mode records events for applications on which block mode would have acted. It does not prevent those applications from running or being installed. Microsoft states that these audit detections can be reviewed in Windows Event Viewer, but not in the Microsoft Defender portal.\u003C\u002Fp>\n\u003Ch3 id=\"security\">Security\u003C\u002Fh3>\n\u003Cp>Block mode extends Microsoft Defender Antivirus protection to software that is not conventional malware but has unwanted or potentially risky behavior. It can therefore stop software such as adware, bundlers, and evasion software that might increase the likelihood of a malware infection or make malicious activity harder to identify.\u003C\u002Fp>\n\u003Cp>Audit mode provides detection information only. A value of \u003Ccode>0\u003C\u002Fcode> provides no PUA-specific protection. Both settings therefore permit activity that block mode would prevent. They do not, by themselves, disable the other antimalware protections provided by Microsoft Defender Antivirus.\u003C\u002Fp>\n\u003Ch3 id=\"possible-side-effects\">Possible side effects\u003C\u002Fh3>\n\u003Cp>Block mode can prevent the use of software that an organization intentionally relies on if Microsoft classifies that software as potentially unwanted because of its behavior or reputation. Downloads, installations, application launches, or workflows that depend on the affected software can consequently be interrupted.\u003C\u002Fp>\n\u003Ch3 id=\"notes-1\">Notes\u003C\u002Fh3>\n\u003Cp>This setting applies to PUA protection in Microsoft Defender Antivirus. The separate potentially unwanted app protection in Microsoft Edge is controlled by its own Microsoft Defender SmartScreen and Edge policies.\u003C\u002Fp>\n\u003Cp>Microsoft lists the related device policy as applicable to Windows 10, version 1607 and later. The Group Policy setting is included in the Windows 10, version 1809 and later Administrative Templates. Supported Windows Server and onboarding scenarios vary according to the operating-system version and the Microsoft Defender solution in use.\u003C\u002Fp>\n\u003Ch3 id=\"microsoft-documentation\">Microsoft documentation\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-defender#puaprotection\">Microsoft Learn: Defender Policy CSP – PUAProtection\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fdetect-block-potentially-unwanted-apps-microsoft-defender-antivirus\">Microsoft Learn: Block potentially unwanted applications with Microsoft Defender Antivirus\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch2 id=\"see-also\">See also\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen#e-9c86610cfa\">Entry in the reference\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n",[15,19,22,26,29,32,34,37],{"ebene":16,"id":17,"text":18},2,"purpose","Purpose",{"ebene":16,"id":20,"text":21},"notes","Notes",{"ebene":23,"id":24,"text":25},3,"additional-effects","Additional effects",{"ebene":23,"id":27,"text":28},"security","Security",{"ebene":23,"id":30,"text":31},"possible-side-effects","Possible side effects",{"ebene":23,"id":33,"text":21},"notes-1",{"ebene":23,"id":35,"text":36},"microsoft-documentation","Microsoft documentation",{"ebene":16,"id":38,"text":39},"see-also","See also","\u002Fen\u002Fdocumentation",[42,62,74,82,130,150,166,182,206,222,238],{"titel":43,"pfad":44,"seiten":45},"Getting started","erste-schritte",[46,50,54,58],{"rel":47,"titel":48,"zu":49},"erste-schritte\u002Fwas-ist-setup-foundry","Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fwas-ist-setup-foundry",{"rel":51,"titel":52,"zu":53},"erste-schritte\u002Finstallation","Installing Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Finstallation",{"rel":55,"titel":56,"zu":57},"erste-schritte\u002Fschnellstart","Quick start","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fschnellstart",{"rel":59,"titel":60,"zu":61},"erste-schritte\u002Fablauf","How it works","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fablauf",{"titel":63,"pfad":64,"seiten":65},"Setup","wizard",[66,70],{"rel":67,"titel":68,"zu":69},"wizard\u002Fuebersicht","The setup wizard","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fuebersicht",{"rel":71,"titel":72,"zu":73},"wizard\u002Fsystemanforderungen","System requirements","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fsystemanforderungen",{"titel":75,"pfad":76,"seiten":77},"Setup in detail","einrichtung-detail",[78],{"rel":79,"titel":80,"zu":81},"einrichtung-detail\u002Fwindows-quelle","Import an ISO","\u002Fen\u002Fdocumentation\u002Feinrichtung-detail\u002Fwindows-quelle",{"titel":83,"pfad":84,"seiten":85},"Foundry","konfiguration",[86,90,94,98,102,106,110,114,118,122,126],{"rel":87,"titel":88,"zu":89},"konfiguration\u002Fprofile","Profiles","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fprofile",{"rel":91,"titel":92,"zu":93},"konfiguration\u002Fquellen","Sources","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fquellen",{"rel":95,"titel":96,"zu":97},"konfiguration\u002Fbenutzer","Configuring users","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbenutzer",{"rel":99,"titel":100,"zu":101},"konfiguration\u002Fbilder","Background picture and logo","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbilder",{"rel":103,"titel":104,"zu":105},"konfiguration\u002Fwindows-bereinigen","Cleaning up Windows","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fwindows-bereinigen",{"rel":107,"titel":108,"zu":109},"konfiguration\u002Fapps-entfernen","Removing apps","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fapps-entfernen",{"rel":111,"titel":112,"zu":113},"konfiguration\u002Fauswaehlen","Selecting applications","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fauswaehlen",{"rel":115,"titel":116,"zu":117},"konfiguration\u002Frichtlinien","Policies","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien",{"rel":119,"titel":120,"zu":121},"konfiguration\u002Fpc-informationen","PC information","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fpc-informationen",{"rel":123,"titel":124,"zu":125},"konfiguration\u002Fnamensschema","Naming scheme","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fnamensschema",{"rel":127,"titel":128,"zu":129},"konfiguration\u002Finstall-assist-gestalten","Design the Install Assist","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Finstall-assist-gestalten",{"titel":131,"pfad":132,"seiten":133},"Installation","installationsmedien",[134,138,142,146],{"rel":135,"titel":136,"zu":137},"installationsmedien\u002Fusb-stick","Create a USB drive","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fusb-stick",{"rel":139,"titel":140,"zu":141},"installationsmedien\u002Fiso-erstellen","Creating an ISO","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fiso-erstellen",{"rel":143,"titel":144,"zu":145},"installationsmedien\u002Fvhd-erstellen","Create VHD","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fvhd-erstellen",{"rel":147,"titel":148,"zu":149},"installationsmedien\u002Finstall-assist","Install Assist on the target computer","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Finstall-assist",{"titel":151,"pfad":152,"seiten":153},"Machines","pruefmaschine",[154,158,162],{"rel":155,"titel":156,"zu":157},"pruefmaschine\u002Fhyper-v-berechtigungen","Hyper-V permissions","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fhyper-v-berechtigungen",{"rel":159,"titel":160,"zu":161},"pruefmaschine\u002Fverwenden","Use the test machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fverwenden",{"rel":163,"titel":164,"zu":165},"pruefmaschine\u002Ferstellen","Create a machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Ferstellen",{"titel":167,"pfad":168,"seiten":169},"Editions","editionen",[170,174,178],{"rel":171,"titel":172,"zu":173},"editionen\u002Fvergleich","Editions at a glance","\u002Fen\u002Fdocumentation\u002Feditionen\u002Fvergleich",{"rel":175,"titel":176,"zu":177},"editionen\u002Flizenz-aktivieren","Activate a license","\u002Fen\u002Fdocumentation\u002Feditionen\u002Flizenz-aktivieren",{"rel":179,"titel":180,"zu":181},"editionen\u002Faktivierungen-zuruecksetzen","Reset activations","\u002Fen\u002Fdocumentation\u002Feditionen\u002Faktivierungen-zuruecksetzen",{"titel":183,"pfad":184,"seiten":185},"Troubleshooting","fehler",[186,190,194,198,202],{"rel":187,"titel":188,"zu":189},"fehler\u002Fusb","USB drive problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fusb",{"rel":191,"titel":192,"zu":193},"fehler\u002Fiso","ISO import problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fiso",{"rel":195,"titel":196,"zu":197},"fehler\u002Fhyperv","Hyper-V problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fhyperv",{"rel":199,"titel":200,"zu":201},"fehler\u002Finstall-assist","When Setup fails on the target computer","\u002Fen\u002Fdocumentation\u002Ffehler\u002Finstall-assist",{"rel":203,"titel":204,"zu":205},"fehler\u002Fantwortdatei","The answer file","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fantwortdatei",{"titel":207,"pfad":208,"seiten":209},"Reference","referenz",[210,214,218],{"rel":211,"titel":212,"zu":213},"referenz\u002Fbekannte-probleme","Known issues","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fbekannte-probleme",{"rel":215,"titel":216,"zu":217},"referenz\u002Fdiagnose-und-protokolle","Diagnostics and logs","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fdiagnose-und-protokolle",{"rel":219,"titel":220,"zu":221},"referenz\u002Fglossar","Glossary","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fglossar",{"titel":223,"pfad":224,"seiten":225},"Windows appendix","windows-anhang",[226,230,234],{"rel":227,"titel":228,"zu":229},"windows-anhang\u002Fdienste","Services","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fdienste",{"rel":231,"titel":232,"zu":233},"windows-anhang\u002Faufgaben","Scheduled tasks","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Faufgaben",{"rel":235,"titel":236,"zu":237},"windows-anhang\u002Fapps","App packages","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fapps",{"titel":239,"pfad":240,"seiten":241},"Policy appendix","richtlinien-anhang",[242,246,250,254,258,262,266,270,274,278,282,286,290],{"rel":243,"titel":244,"zu":245},"richtlinien-anhang\u002Frichtlinien","Policy reference","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien",{"rel":247,"titel":248,"zu":249},"richtlinien-anhang\u002Frichtlinien-office-haertung","Office hardening","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-office-haertung",{"rel":251,"titel":252,"zu":253},"richtlinien-anhang\u002Frichtlinien-edge-internet-explorer","Edge and Internet Explorer","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-edge-internet-explorer",{"rel":255,"titel":256,"zu":257},"richtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen","Virus protection and attack surface","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen",{"rel":259,"titel":260,"zu":261},"richtlinien-anhang\u002Frichtlinien-netzwerk-freigaben","Network and file sharing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-netzwerk-freigaben",{"rel":263,"titel":264,"zu":265},"richtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie","Privacy and telemetry","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie",{"rel":267,"titel":268,"zu":269},"richtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung","Logging and auditing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung",{"rel":271,"titel":272,"zu":273},"richtlinien-anhang\u002Frichtlinien-anmeldung-konten","Sign-in and accounts","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-anmeldung-konten",{"rel":275,"titel":276,"zu":277},"richtlinien-anhang\u002Frichtlinien-geraete-wechselmedien","Devices and removable media","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-geraete-wechselmedien",{"rel":279,"titel":280,"zu":281},"richtlinien-anhang\u002Frichtlinien-kernschutz","Kernel protection","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-kernschutz",{"rel":283,"titel":284,"zu":285},"richtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung","Drive encryption","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung",{"rel":287,"titel":288,"zu":289},"richtlinien-anhang\u002Frichtlinien-windows-update","Windows Update","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-windows-update",{"rel":291,"titel":292,"zu":293},"richtlinien-anhang\u002Frichtlinien-grundeinstellungen","Defaults and privacy settings","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-grundeinstellungen",null,1793199131854]