Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation · Policy appendix

Virus protection and attack surface

Every setting of the “Virus protection and attack surface” package with its effect, value and recommending sources.

since 0.9.8.11

Purpose

This page lists every setting of the “Virus protection and attack surface” package: what it does, which value Setup Foundry sets and who recommends it. It is generated from the catalog and never edited by hand.

37 settings.

Notes

Block Adobe Reader from creating child processes

This DWORD value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. Value data 1 enables the rule in Block mode.

Block all Office applications from creating child processes

This registry value controls the Microsoft Defender attack surface reduction rule identified by d4f940ab-401b-4efc-aadc-ad5f3c50688a. It is a DWORD value, and value data 1 places this individual rule in Block mode.

Block executable content from email client and webmail

This DWORD value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. A value of 1 places the rule in Block mode.

Block credential stealing from the Windows local security authority subsystem

This registry value controls the attack surface reduction rule that protects the lsass.exe process (Local Security Authority Subsystem Service). It is a DWORD value, and value data 1 enables the rule in Block mode.

Boot-Start Driver Initialization Policy

This policy value determines which boot-start drivers Windows initializes after they have been evaluated by an Early Launch Antimalware (ELAM) driver. ELAM runs before other boot-start drivers and classifies each one as Good, Unknown, Bad but Boot Critical, or Bad.

Configure the 'Block at First Sight' feature

This REG_DWORD value controls the Microsoft Defender Antivirus Block at First Sight feature. Because the value name begins with Disable, its logic is inverted: 0 turns the feature on, whereas 1 turns it off. Consequently, the Enabled state of the associated Group Policy turns on the feature even though it uses the value 0.

Block Office applications from injecting code into other processes

This registry value controls the attack surface reduction rule identified by 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84. It is a DWORD value, and a value of 1 places the rule in Block mode.

Monitor file and program activity on your computer

This machine-wide registry value controls Microsoft Defender Antivirus on-access protection. Defender monitors file and program activity and can inspect files when they are opened, read, written, or modified. This continuous protection complements scheduled and on-demand antivirus scans.

Block persistence through WMI event subscription

This registry value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. It is a DWORD value, and value data 1 places the rule in block mode.

Configure monitoring for incoming and outgoing file and program activity

This integer registry value determines which direction of file and program activity Microsoft Defender Antivirus monitors on NTFS volumes as part of real-time protection:

Turn off routine remediation

This machine-wide registry value controls whether Microsoft Defender Antivirus automatically takes remediation action on detected threats.

Block Win32 API calls from Office macros

This registry value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. DWORD data 1 enables the rule in Block mode. It prevents Visual Basic for Applications (VBA) macros in Microsoft Office from calling Win32 APIs.

Configure real-time protection and Security Intelligence Updates during OOBE

This registry value controls whether Microsoft Defender Antivirus enables real-time protection and Security Intelligence Updates during the Windows Out-of-Box Experience (OOBE).

Turn off real-time protection

This machine-level Group Policy setting is backed by the DisableRealtimeMonitoring REG_DWORD value. When Microsoft Defender Antivirus is active, a value of 1 turns off its real-time monitoring. Files and active operations are no longer continuously examined by this protection function for known or suspected malicious activity.

Use advanced protection against ransomware

This DWORD value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. A value of 1 places the rule in block mode.

Scan all downloaded files and attachments

This value controls whether Microsoft Defender Antivirus scans downloaded files and attachments through IOAV protection. It is a REG_DWORD value with negative logic:

Configure local administrator merge behavior for lists

This machine-level registry value controls whether Microsoft Defender Antivirus combines locally defined list entries with lists managed centrally through Group Policy.

Block abuse of exploited vulnerable signed drivers (Device)

This machine-wide registry value controls the attack surface reduction rule identified by 56a863a9-875e-4185-98a7-b882c64b5ce5. A DWORD value of 1 places the rule in Block mode.

Block Office applications from creating executable content

This registry value controls the corresponding attack surface reduction (ASR) rule in Microsoft Defender Antivirus. A DWORD value of 1 enables the rule in Block mode.

Block Office communication application from creating child processes

This registry value controls a Microsoft Defender Antivirus attack surface reduction (ASR) rule. It is a DWORD value, and a value of 1 enables the rule in Block mode.

Configure detection for potentially unwanted applications

This registry value controls how Microsoft Defender Antivirus handles potentially unwanted applications (PUAs). A PUA is not necessarily classified as malware, but it can exhibit undesirable behavior such as displaying unexpected advertising, bundling additional software, evading security products, or adversely affecting device performance and use.

Turn on process scanning whenever real-time protection is enabled

This machine policy value controls whether Microsoft Defender Antivirus initiates a process scan when real-time protection is turned on. The scan can detect malware that might have started while real-time protection was off.

Configure Attack Surface Reduction rules

This machine policy sets the operating mode of individual attack surface reduction (ASR) rules. ASR rules are a Microsoft Defender Antivirus feature that detects specific risky behaviors commonly associated with malware and intrusion activity. The behavior covered by each entry is determined by the rule identified by its GUID.

Block JavaScript or VBScript from launching downloaded executable content

This registry value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. A DWORD value of 1 enables the rule in Block mode.

Turn on script scanning

This value controls script scanning in Microsoft Defender Antivirus. It is a REG_DWORD value whose name uses inverse logic:

Configure Windows Defender SmartScreen

This computer policy controls Microsoft Defender SmartScreen’s Application Reputation feature, presented in Windows as “Check apps and files.” Windows evaluates programs obtained from the Internet by using security and reputation information. Before an unrecognized or known-malicious program runs, SmartScreen displays a warning. Programs that do not appear suspicious do not produce a SmartScreen dialog.

Block untrusted and unsigned processes that run from USB

This computer-scoped registry value controls the Microsoft Defender ASR rule identified by b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4. A DWORD value of 1 places the rule in Block mode.

Turn on behavior monitoring

This computer policy controls behavior monitoring in Microsoft Defender Antivirus. Behavior monitoring observes process, file, and service activity in real time. It uses known behavioral patterns and anomaly detection to identify and respond to suspicious activity, including threats that do not match known malware signatures.

Block execution of potentially obfuscated scripts

This DWORD value controls the Microsoft Defender attack surface reduction rule identified by 5beb7efe-fd9a-4556-801d-275e5ffc04cc. A value of 1 enables the rule in Block mode.

Control whether or not exclusions are visible to Local Admins

This REG_DWORD value controls whether local administrators can view the exclusion list enforced by Microsoft Defender Antivirus.

Scan removable drives

This value controls whether Microsoft Defender Antivirus includes removable media, such as USB flash drives, in full scans. It is a REG_DWORD value:

Prevent users and apps from accessing dangerous websites

This policy value controls Microsoft Defender Antivirus network protection at the device level. Network protection evaluates outbound connection destinations by domain or host reputation and can prevent supported browsers and other applications from accessing malicious or suspicious destinations. Examples include phishing sites, sources of malicious downloads, exploit-hosting sites, and technical-support scam sites.

Configure Watson events

This machine-level registry value controls whether Microsoft Defender Antivirus sends Watson events to Microsoft. These are product diagnostic or error-reporting events.

Disable infection reporting by the Windows Malicious Software Removal Tool

The DontReportInfectionInformation value is a REG_DWORD. When its value data is 1, it disables the infection-reporting component of the Windows Malicious Software Removal Tool (MSRT). The tool consequently does not report infection information to Microsoft.

Always install with elevated privileges

This policy directs Windows Installer to install Windows Installer packages with elevated system privileges. It consequently allows non-administrative users to install packages that need to modify protected directories or registry keys.

Allow user control over installs

This per-machine REG_DWORD value controls which public Windows Installer properties a non-administrative user can influence during a managed installation running with elevated privileges.

Remote WSH

Remote WSH allows a local Windows script to be executed on another computer through the WshController and WshRemote objects. It uses DCOM to transfer and control the script, which is then run by Windows Script Host on the target computer.

See also