[{"data":1,"prerenderedAt":278},["ShallowReactive",2],{"doku:en:richtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen":3},{"seite":4,"start":25,"leiste":26,"bereich":224,"zurueck":276,"weiter":277},{"sprache":5,"rel":6,"zu":7,"id":8,"titel":9,"titelHtml":9,"beschreibung":10,"kennzeile":11,"imMenue":12,"html":13,"ueberschriften":14},"en","richtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen","referenz-richtlinien-virenschutz-angriffsflaechen","Virus protection and attack surface","Every setting of the “Virus protection and attack surface” package with its effect, value and recommending sources.","since 0.9.8.11",true,"\u003Ch2 id=\"purpose\">Purpose\u003C\u002Fh2>\n\u003Cp>This page lists every setting of the “Virus protection and attack surface” package: what it does, which value Setup Foundry sets and who recommends it. It is generated from the catalog and never edited by hand.\u003C\u002Fp>\n\u003Cp>37 settings.\u003C\u002Fp>\n\u003Ch2 id=\"notes\">Notes\u003C\u002Fh2>\n\u003Ch3 id=\"e-a3e98b2bc5\">Block Adobe Reader from creating child processes\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>DWORD\u003C\u002Fcode> value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. Value data \u003Ccode>1\u003C\u002Fcode> enables the rule in Block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-a3e98b2bc5d3-7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c\">Block Adobe Reader from creating child processes\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference\">Microsoft Learn: Attack surface reduction rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-7850857c3f\">Block all Office applications from creating child processes\u003C\u002Fh3>\n\u003Cp>This registry value controls the Microsoft Defender attack surface reduction rule identified by \u003Ccode>d4f940ab-401b-4efc-aadc-ad5f3c50688a\u003C\u002Fcode>. It is a \u003Ccode>DWORD\u003C\u002Fcode> value, and value data \u003Ccode>1\u003C\u002Fcode> places this individual rule in Block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\d4f940ab-401b-4efc-aadc-ad5f3c50688a = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-7850857c3f57-d4f940ab-401b-4efc-aadc-ad5f3c50688a\">Block all Office applications from creating child processes\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference\">Microsoft Learn: Attack surface reduction rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-71d4362726\">Block executable content from email client and webmail\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>DWORD\u003C\u002Fcode> value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. A value of \u003Ccode>1\u003C\u002Fcode> places the rule in Block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-71d43627269b-be9ba2d9-53ea-4cdc-84e5-9b1eeee46550\">Block executable content from email client and webmail\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference\">Microsoft Learn: Attack surface reduction (ASR) rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-64c224d029\">Block credential stealing from the Windows local security authority subsystem\u003C\u002Fh3>\n\u003Cp>This registry value controls the attack surface reduction rule that protects the \u003Ccode>lsass.exe\u003C\u002Fcode> process (Local Security Authority Subsystem Service). It is a \u003Ccode>DWORD\u003C\u002Fcode> value, and value data \u003Ccode>1\u003C\u002Fcode> enables the rule in Block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-64c224d029a8-9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2\">Block credential stealing from the Windows local security authority subsystem\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference\">Microsoft Learn: Attack surface reduction (ASR) rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-d20264a392\">Boot-Start Driver Initialization Policy\u003C\u002Fh3>\n\u003Cp>This policy value determines which boot-start drivers Windows initializes after they have been evaluated by an Early Launch Antimalware (ELAM) driver. ELAM runs before other boot-start drivers and classifies each one as Good, Unknown, Bad but Boot Critical, or Bad.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\EarlyLaunch\\DriverLoadPolicy = 3 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-fullarmor-policies-0ef0f32b-7305-4fc7-bbeb-d43dcc622c81-pol-driverloadpolicy-name\">Boot-Start Driver Initialization Policy\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-system#bootstartdriverinitialization\">Microsoft Learn: System Policy CSP – BootStartDriverInitialization\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-fbe1af3d7f\">Configure the 'Block at First Sight' feature\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>REG_DWORD\u003C\u002Fcode> value controls the Microsoft Defender Antivirus Block at First Sight feature. Because the value name begins with \u003Ccode>Disable\u003C\u002Fcode>, its logic is inverted: \u003Ccode>0\u003C\u002Fcode> turns the feature on, whereas \u003Ccode>1\u003C\u002Fcode> turns it off. Consequently, the Enabled state of the associated Group Policy turns on the feature even though it uses the value \u003Ccode>0\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\DisableBlockAtFirstSeen = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-disableblockatfirstseen\">Configure the 'Block at First Sight' feature\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-admx-microsoftdefenderantivirus#disableblockatfirstseen\">Microsoft Learn: ADMX_MicrosoftDefenderAntivirus Policy CSP – DisableBlockAtFirstSeen\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-9945be3648\">Block Office applications from injecting code into other processes\u003C\u002Fh3>\n\u003Cp>This registry value controls the attack surface reduction rule identified by \u003Ccode>75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84\u003C\u002Fcode>. It is a \u003Ccode>DWORD\u003C\u002Fcode> value, and a value of \u003Ccode>1\u003C\u002Fcode> places the rule in Block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-9945be3648bf-75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84\">Block Office applications from injecting code into other processes\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference\">Microsoft Learn: Attack surface reduction rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-a1cfdf1134\">Monitor file and program activity on your computer\u003C\u002Fh3>\n\u003Cp>This machine-wide registry value controls Microsoft Defender Antivirus on-access protection. Defender monitors file and program activity and can inspect files when they are opened, read, written, or modified. This continuous protection complements scheduled and on-demand antivirus scans.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-realtimeprotection-disableonaccessprotection\">Monitor file and program activity on your computer\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-defender#allowonaccessprotection\">Microsoft Learn: Policy CSP – Defender – AllowOnAccessProtection\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-550031a532\">Block persistence through WMI event subscription\u003C\u002Fh3>\n\u003Cp>This registry value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. It is a \u003Ccode>DWORD\u003C\u002Fcode> value, and value data \u003Ccode>1\u003C\u002Fcode> places the rule in block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\e6db77e5-3df2-4cf1-b95a-636979351e5b = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-550031a53268-e6db77e5-3df2-4cf1-b95a-636979351e5b\">Block persistence through WMI event subscription\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference#block-persistence-through-wmi-event-subscription\">Microsoft Learn: ASR rules reference – Block persistence through WMI event subscription\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-645b984fe9\">Configure monitoring for incoming and outgoing file and program activity\u003C\u002Fh3>\n\u003Cp>This integer registry value determines which direction of file and program activity Microsoft Defender Antivirus monitors on NTFS volumes as part of real-time protection:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\RealtimeScanDirection = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-realtimeprotection-realtimescandirection\">Configure monitoring for incoming and outgoing file and program activity\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-defender#realtimescandirection\">Microsoft Learn: Defender Policy CSP – RealTimeScanDirection\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-3a6a6426de\">Turn off routine remediation\u003C\u002Fh3>\n\u003Cp>This machine-wide registry value controls whether Microsoft Defender Antivirus automatically takes remediation action on detected threats.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\DisableRoutinelyTakingAction = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-disableroutinelytakingaction\">Turn off routine remediation\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-admx-microsoftdefenderantivirus#disableroutinelytakingaction\">Microsoft Learn: ADMX_MicrosoftDefenderAntivirus – DisableRoutinelyTakingAction\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-1b79e4daff\">Block Win32 API calls from Office macros\u003C\u002Fh3>\n\u003Cp>This registry value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. DWORD data \u003Ccode>1\u003C\u002Fcode> enables the rule in Block mode. It prevents Visual Basic for Applications (VBA) macros in Microsoft Office from calling Win32 APIs.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-1b79e4daff5f-92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b\">Block Win32 API calls from Office macros\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference#block-win32-api-calls-from-office-macros\">Microsoft Learn: Attack surface reduction rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-e12a9ff8c5\">Configure real-time protection and Security Intelligence Updates during OOBE\u003C\u002Fh3>\n\u003Cp>This registry value controls whether Microsoft Defender Antivirus enables real-time protection and Security Intelligence Updates during the Windows Out-of-Box Experience (OOBE).\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\OobeEnableRtpAndSigUpdate = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-e12a9ff8c57b-oobeenablertpandsigupdate\">Configure real-time protection and Security Intelligence Updates during OOBE\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fdefender-csp#configurationoobeenablertpandsigupdate\">Microsoft Learn: Defender CSP – OobeEnableRtpAndSigUpdate\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-4e89b90df5\">Turn off real-time protection\u003C\u002Fh3>\n\u003Cp>This machine-level Group Policy setting is backed by the \u003Ccode>DisableRealtimeMonitoring\u003C\u002Fcode> \u003Ccode>REG_DWORD\u003C\u002Fcode> value. When Microsoft Defender Antivirus is active, a value of \u003Ccode>1\u003C\u002Fcode> turns off its real-time monitoring. Files and active operations are no longer continuously examined by this protection function for known or suspected malicious activity.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-disablerealtimemonitoring\">Turn off real-time protection\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-defender#allowrealtimemonitoring\">Microsoft Learn: Defender Policy CSP – AllowRealtimeMonitoring\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-84da240e0d\">Use advanced protection against ransomware\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>DWORD\u003C\u002Fcode> value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. A value of \u003Ccode>1\u003C\u002Fcode> places the rule in block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\c1db55ab-c21a-4637-bb3f-a12568109d35 = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-84da240e0dd4-c1db55ab-c21a-4637-bb3f-a12568109d35\">Use advanced protection against ransomware\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference\">Microsoft Learn: Attack surface reduction (ASR) rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-bb2fb0ad45\">Scan all downloaded files and attachments\u003C\u002Fh3>\n\u003Cp>This value controls whether Microsoft Defender Antivirus scans downloaded files and attachments through IOAV protection. It is a \u003Ccode>REG_DWORD\u003C\u002Fcode> value with negative logic:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-realtimeprotection-disableioavprotection\">Scan all downloaded files and attachments\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-defender#allowioavprotection\">Microsoft Learn: Defender Policy CSP – AllowIOAVProtection\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-27a41c4cfe\">Configure local administrator merge behavior for lists\u003C\u002Fh3>\n\u003Cp>This machine-level registry value controls whether Microsoft Defender Antivirus combines locally defined list entries with lists managed centrally through Group Policy.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\DisableLocalAdminMerge = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-disablelocaladminmerge\">Configure local administrator merge behavior for lists\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-admx-microsoftdefenderantivirus#disablelocaladminmerge\">Microsoft Learn: ADMX_MicrosoftDefenderAntivirus Policy CSP – DisableLocalAdminMerge\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-d39f92ed7a\">Block abuse of exploited vulnerable signed drivers (Device)\u003C\u002Fh3>\n\u003Cp>This machine-wide registry value controls the attack surface reduction rule identified by \u003Ccode>56a863a9-875e-4185-98a7-b882c64b5ce5\u003C\u002Fcode>. A DWORD value of \u003Ccode>1\u003C\u002Fcode> places the rule in Block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\56a863a9-875e-4185-98a7-b882c64b5ce5 = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-d39f92ed7add-56a863a9-875e-4185-98a7-b882c64b5ce5\">Block abuse of exploited vulnerable signed drivers (Device)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference\">Microsoft Learn: ASR rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-48d1e9a3cf\">Block Office applications from creating executable content\u003C\u002Fh3>\n\u003Cp>This registry value controls the corresponding attack surface reduction (ASR) rule in Microsoft Defender Antivirus. A \u003Ccode>DWORD\u003C\u002Fcode> value of \u003Ccode>1\u003C\u002Fcode> enables the rule in Block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\3b576869-a4ec-4529-8536-b80a7769e899 = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-48d1e9a3cfb7-3b576869-a4ec-4529-8536-b80a7769e899\">Block Office applications from creating executable content\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference#block-office-applications-from-creating-executable-content\">Microsoft Learn: Attack surface reduction (ASR) rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-1581ce2043\">Block Office communication application from creating child processes\u003C\u002Fh3>\n\u003Cp>This registry value controls a Microsoft Defender Antivirus attack surface reduction (ASR) rule. It is a \u003Ccode>DWORD\u003C\u002Fcode> value, and a value of \u003Ccode>1\u003C\u002Fcode> enables the rule in Block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\26190899-1602-49e8-8b27-eb1d0a1ce869 = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-1581ce204398-26190899-1602-49e8-8b27-eb1d0a1ce869\">Block Office communication application from creating child processes\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference\">Microsoft Learn: Attack surface reduction rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-9c86610cfa\">Configure detection for potentially unwanted applications\u003C\u002Fh3>\n\u003Cp>This registry value controls how Microsoft Defender Antivirus handles potentially unwanted applications (PUAs). A PUA is not necessarily classified as malware, but it can exhibit undesirable behavior such as displaying unexpected advertising, bundling additional software, evading security products, or adversely affecting device performance and use.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\PUAProtection = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-root-puaprotection\">Configure detection for potentially unwanted applications\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-defender#puaprotection\">Microsoft Learn: Defender Policy CSP – PUAProtection\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-aaccb5cc30\">Turn on process scanning whenever real-time protection is enabled\u003C\u002Fh3>\n\u003Cp>This machine policy value controls whether Microsoft Defender Antivirus initiates a process scan when real-time protection is turned on. The scan can detect malware that might have started while real-time protection was off.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-realtimeprotection-disablescanonrealtimeenable\">Turn on process scanning whenever real-time protection is enabled\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-admx-microsoftdefenderantivirus\">Microsoft Learn: Policy CSP – ADMX_MicrosoftDefenderAntivirus\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-b5c91cde83\">Configure Attack Surface Reduction rules\u003C\u002Fh3>\n\u003Cp>This machine policy sets the operating mode of individual attack surface reduction (ASR) rules. ASR rules are a Microsoft Defender Antivirus feature that detects specific risky behaviors commonly associated with malware and intrusion activity. The behavior covered by each entry is determined by the rule identified by its GUID.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\ExploitGuard_ASR_Rules = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-exploitguard-asr-rules\">Configure Attack Surface Reduction rules\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-configure\">Microsoft Learn: Configure ASR rules and exclusions\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-28a434d656\">Block JavaScript or VBScript from launching downloaded executable content\u003C\u002Fh3>\n\u003Cp>This registry value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. A \u003Ccode>DWORD\u003C\u002Fcode> value of \u003Ccode>1\u003C\u002Fcode> enables the rule in Block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\d3e037e1-3eb8-44c8-a917-57927947596d = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-28a434d65696-d3e037e1-3eb8-44c8-a917-57927947596d\">Block JavaScript or VBScript from launching downloaded executable content\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference\">Microsoft Learn: ASR rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-507e53d28c\">Turn on script scanning\u003C\u002Fh3>\n\u003Cp>This value controls script scanning in Microsoft Defender Antivirus. It is a \u003Ccode>REG_DWORD\u003C\u002Fcode> value whose name uses inverse logic:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScriptScanning = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-realtimeprotection-disablesriptscanning\">Turn on script scanning\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-defender#allowscriptscanning\">Microsoft Learn: Defender Policy CSP – AllowScriptScanning\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-955305af67\">Configure Windows Defender SmartScreen\u003C\u002Fh3>\n\u003Cp>This computer policy controls Microsoft Defender SmartScreen’s Application Reputation feature, presented in Windows as “Check apps and files.” Windows evaluates programs obtained from the Internet by using security and reputation information. Before an unrecognized or known-malicious program runs, SmartScreen displays a warning. Programs that do not appear suspicious do not produce a SmartScreen dialog.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System\\EnableSmartScreen = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-smartscreen-shellconfiguresmartscreen\">Configure Windows Defender SmartScreen\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Foperating-system-security\u002Fvirus-and-threat-protection\u002Fmicrosoft-defender-smartscreen\u002Favailable-settings\">Microsoft Learn: Available Microsoft Defender SmartScreen settings\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-e488d68a9b\">Block untrusted and unsigned processes that run from USB\u003C\u002Fh3>\n\u003Cp>This computer-scoped registry value controls the Microsoft Defender ASR rule identified by \u003Ccode>b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4\u003C\u002Fcode>. A \u003Ccode>DWORD\u003C\u002Fcode> value of \u003Ccode>1\u003C\u002Fcode> places the rule in Block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-e488d68a9b4d-b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4\">Block untrusted and unsigned processes that run from USB\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference\">Microsoft Learn: Attack surface reduction rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-174e0109d9\">Turn on behavior monitoring\u003C\u002Fh3>\n\u003Cp>This computer policy controls behavior monitoring in Microsoft Defender Antivirus. Behavior monitoring observes process, file, and service activity in real time. It uses known behavioral patterns and anomaly detection to identify and respond to suspicious activity, including threats that do not match known malware signatures.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-realtimeprotection-disablebehaviormonitoring\">Turn on behavior monitoring\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fbehavior-monitor\">Microsoft Learn: Behavior monitoring in Microsoft Defender Antivirus\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-b848b5f284\">Block execution of potentially obfuscated scripts\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>DWORD\u003C\u002Fcode> value controls the Microsoft Defender attack surface reduction rule identified by \u003Ccode>5beb7efe-fd9a-4556-801d-275e5ffc04cc\u003C\u002Fcode>. A value of \u003Ccode>1\u003C\u002Fcode> enables the rule in Block mode.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules\\5beb7efe-fd9a-4556-801d-275e5ffc04cc = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-b848b5f284b7-5beb7efe-fd9a-4556-801d-275e5ffc04cc\">Block execution of potentially obfuscated scripts\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference\">Microsoft Learn: Attack surface reduction (ASR) rules reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-023c464af8\">Control whether or not exclusions are visible to Local Admins\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>REG_DWORD\u003C\u002Fcode> value controls whether local administrators can view the exclusion list enforced by Microsoft Defender Antivirus.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\HideExclusionsFromLocalAdmins = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-hideexclusionsfromlocaladmins\">Control whether or not exclusions are visible to Local Admins\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fdefender-csp#configurationhideexclusionsfromlocaladmins\">Microsoft Learn: Defender CSP – HideExclusionsFromLocalAdmins\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-7e61312e10\">Scan removable drives\u003C\u002Fh3>\n\u003Cp>This value controls whether Microsoft Defender Antivirus includes removable media, such as USB flash drives, in full scans. It is a \u003Ccode>REG_DWORD\u003C\u002Fcode> value:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Scan\\DisableRemovableDriveScanning = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-scan-disableremovabledrivescanning\">Scan removable drives\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-defender#allowfullscanremovabledrivescanning\">Microsoft Learn: Defender Policy CSP – AllowFullScanRemovableDriveScanning\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-c90015b2b5\">Prevent users and apps from accessing dangerous websites\u003C\u002Fh3>\n\u003Cp>This policy value controls Microsoft Defender Antivirus network protection at the device level. Network protection evaluates outbound connection destinations by domain or host reputation and can prevent supported browsers and other applications from accessing malicious or suspicious destinations. Examples include phishing sites, sources of malicious downloads, exploit-hosting sites, and technical-support scam sites.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection\\EnableNetworkProtection = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-exploitguard-enablenetworkprotection\">Prevent users and apps from accessing dangerous websites\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-defender#enablenetworkprotection\">Microsoft Learn: Defender Policy CSP – EnableNetworkProtection\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fenable-network-protection\">Microsoft Learn\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-240cad1d73\">Configure Watson events\u003C\u002Fh3>\n\u003Cp>This machine-level registry value controls whether Microsoft Defender Antivirus sends Watson events to Microsoft. These are product diagnostic or error-reporting events.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Reporting\\DisableGenericRePorts = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsdefender-reporting-disablegenericreports\">Configure Watson events\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-admx-microsoftdefenderantivirus#reporting_disablegenericreports\">Microsoft Learn: ADMX_MicrosoftDefenderAntivirus Policy CSP\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: Setup Foundry\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-c23c38f690\">Disable infection reporting by the Windows Malicious Software Removal Tool\u003C\u002Fh3>\n\u003Cp>The \u003Ccode>DontReportInfectionInformation\u003C\u002Fcode> value is a \u003Ccode>REG_DWORD\u003C\u002Fcode>. When its value data is \u003Ccode>1\u003C\u002Fcode>, it disables the infection-reporting component of the Windows Malicious Software Removal Tool (MSRT). The tool consequently does not report infection information to Microsoft.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-c23c38f690dd-dontreportinfectioninformation\">Disable infection reporting by the Windows Malicious Software Removal Tool\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fprivacy\u002Fmanage-connections-from-windows-operating-system-components-to-microsoft-services\">Microsoft Learn: Manage connections from Windows operating system components to Microsoft services\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: Setup Foundry\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-f7b176b279\">Always install with elevated privileges\u003C\u002Fh3>\n\u003Cp>This policy directs Windows Installer to install Windows Installer packages with elevated system privileges. It consequently allows non-administrative users to install packages that need to modify protected directories or registry keys.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Installer\\AlwaysInstallElevated = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-msi-alwaysinstallelevated\">Always install with elevated privileges\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fmsi\u002Falwaysinstallelevated\">Microsoft Learn: AlwaysInstallElevated\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-0a24fb877a\">Allow user control over installs\u003C\u002Fh3>\n\u003Cp>This per-machine \u003Ccode>REG_DWORD\u003C\u002Fcode> value controls which public Windows Installer properties a non-administrative user can influence during a managed installation running with elevated privileges.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Installer\\EnableUserControl = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-msi-enableusercontrol\">Allow user control over installs\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fmsi\u002Fenableusercontrol\">Microsoft Learn: EnableUserControl\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-10493b5e31\">Remote WSH\u003C\u002Fh3>\n\u003Cp>Remote WSH allows a local Windows script to be executed on another computer through the \u003Ccode>WshController\u003C\u002Fcode> and \u003Ccode>WshRemote\u003C\u002Fcode> objects. It uses DCOM to transfer and control the script, which is then run by Windows Script Host on the target computer.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Script Host\\Settings\\Remote = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#virenschutz-angriffsflaechen\">Policies › Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-10493b5e3162-remote\">Remote WSH\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Farchive\u002Fmsdn-magazine\u002F2002\u002Fmay\u002Fscripting-windows-script-host-5-6-boasts-windows-xp-integration-security-new-object-model\">Microsoft Learn: Windows Script Host 5.6 Boasts Windows XP Integration, Security, New Object Model\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.bsi.bund.de\u002FSharedDocs\u002FDownloads\u002FDE\u002FBSI\u002FCyber-Sicherheit\u002FSiSyPHus\u002FWorkpackage11_Empfehlung_Haertung.pdf?__blob=publicationFile&v=2\">BSI SiSyPHuS Win10, Arbeitspaket 11: Konfigurationsempfehlungen zur Härtung von Windows 10 mit Bordmitteln, Abschnitt 5.5.2.3\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"see-also\">See also\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien\">Policy reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-edge-internet-explorer\">Edge and Internet Explorer\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-netzwerk-freigaben\">Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n",[15,19,22],{"ebene":16,"id":17,"text":18},2,"purpose","Purpose",{"ebene":16,"id":20,"text":21},"notes","Notes",{"ebene":16,"id":23,"text":24},"see-also","See also","\u002Fen\u002Fdocumentation",[27,47,59,67,115,135,151,167,191,207,223],{"titel":28,"pfad":29,"seiten":30},"Getting started","erste-schritte",[31,35,39,43],{"rel":32,"titel":33,"zu":34},"erste-schritte\u002Fwas-ist-setup-foundry","Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fwas-ist-setup-foundry",{"rel":36,"titel":37,"zu":38},"erste-schritte\u002Finstallation","Installing Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Finstallation",{"rel":40,"titel":41,"zu":42},"erste-schritte\u002Fschnellstart","Quick start","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fschnellstart",{"rel":44,"titel":45,"zu":46},"erste-schritte\u002Fablauf","How it works","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fablauf",{"titel":48,"pfad":49,"seiten":50},"Setup","wizard",[51,55],{"rel":52,"titel":53,"zu":54},"wizard\u002Fuebersicht","The setup wizard","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fuebersicht",{"rel":56,"titel":57,"zu":58},"wizard\u002Fsystemanforderungen","System requirements","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fsystemanforderungen",{"titel":60,"pfad":61,"seiten":62},"Setup in detail","einrichtung-detail",[63],{"rel":64,"titel":65,"zu":66},"einrichtung-detail\u002Fwindows-quelle","Import an ISO","\u002Fen\u002Fdocumentation\u002Feinrichtung-detail\u002Fwindows-quelle",{"titel":68,"pfad":69,"seiten":70},"Foundry","konfiguration",[71,75,79,83,87,91,95,99,103,107,111],{"rel":72,"titel":73,"zu":74},"konfiguration\u002Fprofile","Profiles","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fprofile",{"rel":76,"titel":77,"zu":78},"konfiguration\u002Fquellen","Sources","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fquellen",{"rel":80,"titel":81,"zu":82},"konfiguration\u002Fbenutzer","Configuring users","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbenutzer",{"rel":84,"titel":85,"zu":86},"konfiguration\u002Fbilder","Background picture and logo","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbilder",{"rel":88,"titel":89,"zu":90},"konfiguration\u002Fwindows-bereinigen","Cleaning up Windows","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fwindows-bereinigen",{"rel":92,"titel":93,"zu":94},"konfiguration\u002Fapps-entfernen","Removing apps","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fapps-entfernen",{"rel":96,"titel":97,"zu":98},"konfiguration\u002Fauswaehlen","Selecting applications","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fauswaehlen",{"rel":100,"titel":101,"zu":102},"konfiguration\u002Frichtlinien","Policies","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien",{"rel":104,"titel":105,"zu":106},"konfiguration\u002Fpc-informationen","PC information","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fpc-informationen",{"rel":108,"titel":109,"zu":110},"konfiguration\u002Fnamensschema","Naming scheme","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fnamensschema",{"rel":112,"titel":113,"zu":114},"konfiguration\u002Finstall-assist-gestalten","Design the Install Assist","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Finstall-assist-gestalten",{"titel":116,"pfad":117,"seiten":118},"Installation","installationsmedien",[119,123,127,131],{"rel":120,"titel":121,"zu":122},"installationsmedien\u002Fusb-stick","Create a USB drive","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fusb-stick",{"rel":124,"titel":125,"zu":126},"installationsmedien\u002Fiso-erstellen","Creating an ISO","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fiso-erstellen",{"rel":128,"titel":129,"zu":130},"installationsmedien\u002Fvhd-erstellen","Create VHD","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fvhd-erstellen",{"rel":132,"titel":133,"zu":134},"installationsmedien\u002Finstall-assist","Install Assist on the target computer","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Finstall-assist",{"titel":136,"pfad":137,"seiten":138},"Machines","pruefmaschine",[139,143,147],{"rel":140,"titel":141,"zu":142},"pruefmaschine\u002Fhyper-v-berechtigungen","Hyper-V permissions","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fhyper-v-berechtigungen",{"rel":144,"titel":145,"zu":146},"pruefmaschine\u002Fverwenden","Use the test machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fverwenden",{"rel":148,"titel":149,"zu":150},"pruefmaschine\u002Ferstellen","Create a machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Ferstellen",{"titel":152,"pfad":153,"seiten":154},"Editions","editionen",[155,159,163],{"rel":156,"titel":157,"zu":158},"editionen\u002Fvergleich","Editions at a glance","\u002Fen\u002Fdocumentation\u002Feditionen\u002Fvergleich",{"rel":160,"titel":161,"zu":162},"editionen\u002Flizenz-aktivieren","Activate a license","\u002Fen\u002Fdocumentation\u002Feditionen\u002Flizenz-aktivieren",{"rel":164,"titel":165,"zu":166},"editionen\u002Faktivierungen-zuruecksetzen","Reset activations","\u002Fen\u002Fdocumentation\u002Feditionen\u002Faktivierungen-zuruecksetzen",{"titel":168,"pfad":169,"seiten":170},"Troubleshooting","fehler",[171,175,179,183,187],{"rel":172,"titel":173,"zu":174},"fehler\u002Fusb","USB drive problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fusb",{"rel":176,"titel":177,"zu":178},"fehler\u002Fiso","ISO import problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fiso",{"rel":180,"titel":181,"zu":182},"fehler\u002Fhyperv","Hyper-V problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fhyperv",{"rel":184,"titel":185,"zu":186},"fehler\u002Finstall-assist","When Setup fails on the target computer","\u002Fen\u002Fdocumentation\u002Ffehler\u002Finstall-assist",{"rel":188,"titel":189,"zu":190},"fehler\u002Fantwortdatei","The answer file","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fantwortdatei",{"titel":192,"pfad":193,"seiten":194},"Reference","referenz",[195,199,203],{"rel":196,"titel":197,"zu":198},"referenz\u002Fbekannte-probleme","Known issues","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fbekannte-probleme",{"rel":200,"titel":201,"zu":202},"referenz\u002Fdiagnose-und-protokolle","Diagnostics and logs","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fdiagnose-und-protokolle",{"rel":204,"titel":205,"zu":206},"referenz\u002Fglossar","Glossary","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fglossar",{"titel":208,"pfad":209,"seiten":210},"Windows appendix","windows-anhang",[211,215,219],{"rel":212,"titel":213,"zu":214},"windows-anhang\u002Fdienste","Services","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fdienste",{"rel":216,"titel":217,"zu":218},"windows-anhang\u002Faufgaben","Scheduled tasks","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Faufgaben",{"rel":220,"titel":221,"zu":222},"windows-anhang\u002Fapps","App packages","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fapps",{"titel":224,"pfad":225,"seiten":226},"Policy appendix","richtlinien-anhang",[227,231,235,239,240,244,248,252,256,260,264,268,272],{"rel":228,"titel":229,"zu":230},"richtlinien-anhang\u002Frichtlinien","Policy reference","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien",{"rel":232,"titel":233,"zu":234},"richtlinien-anhang\u002Frichtlinien-office-haertung","Office hardening","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-office-haertung",{"rel":236,"titel":237,"zu":238},"richtlinien-anhang\u002Frichtlinien-edge-internet-explorer","Edge and Internet Explorer","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-edge-internet-explorer",{"rel":6,"titel":9,"zu":7},{"rel":241,"titel":242,"zu":243},"richtlinien-anhang\u002Frichtlinien-netzwerk-freigaben","Network and file sharing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-netzwerk-freigaben",{"rel":245,"titel":246,"zu":247},"richtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie","Privacy and telemetry","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie",{"rel":249,"titel":250,"zu":251},"richtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung","Logging and auditing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung",{"rel":253,"titel":254,"zu":255},"richtlinien-anhang\u002Frichtlinien-anmeldung-konten","Sign-in and accounts","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-anmeldung-konten",{"rel":257,"titel":258,"zu":259},"richtlinien-anhang\u002Frichtlinien-geraete-wechselmedien","Devices and removable media","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-geraete-wechselmedien",{"rel":261,"titel":262,"zu":263},"richtlinien-anhang\u002Frichtlinien-kernschutz","Kernel protection","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-kernschutz",{"rel":265,"titel":266,"zu":267},"richtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung","Drive encryption","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung",{"rel":269,"titel":270,"zu":271},"richtlinien-anhang\u002Frichtlinien-windows-update","Windows Update","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-windows-update",{"rel":273,"titel":274,"zu":275},"richtlinien-anhang\u002Frichtlinien-grundeinstellungen","Defaults and privacy settings","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-grundeinstellungen",{"titel":237,"zu":238},{"titel":242,"zu":243},1793199133830]