Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection. Use when hardening Windows endpoints beyond default Defender settings, deploying enterprise-grade endpoint protection, or meeting compliance requirements for advanced malware defense. Activates for requests involving Windows Defender configuration, ASR rules, MDE tuning, or Microsoft endpoint security.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection. Use when hardening Windows endpoints beyond default Defender settings, deploying enterprise-grade endpoint protection, or meeting compliance requirements for advanced malware defense. Activates for requests involving Windows Defender configuration, ASR rules, MDE tuning, or Microsoft endpoint security.
Configuring Microsoft Defender for Endpoint (MDE) beyond default settings for enhanced protection
Implementing Attack Surface Reduction (ASR) rules to block common attack techniques
Enabling controlled folder access for ransomware protection
Configuring network protection and exploit protection features
Deploying Defender settings via Intune, SCCM, or Group Policy at enterprise scale
Do not use this skill for third-party EDR deployment (CrowdStrike, SentinelOne) or for Microsoft Defender for Cloud (Azure workload protection).
Common Misconfigurations & Verification
ASR rules left in Audit (2) instead of Block (1):Get-MpPreference | Select AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions — an action of 2 (audit) or 6 (warn) logs Event ID 1122 but never blocks. The LSASS-theft rule 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 and the Office child-process rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A are the ones most often stuck in audit.
Exclusions that gut coverage: broad Get-MpPreference | Select Exclusion* entries (e.g. C:\, *.exe, or whole user profiles) silently exempt malware paths. Scope exclusions to specific signed binaries.
Tamper Protection off: without it, Set-MpPreference -DisableRealtimeMonitoring $true succeeds and quietly disables protection. Confirm Get-MpComputerStatus | Select IsTamperProtected returns True.
Controlled Folder Access / Network Protection stuck in AuditMode: verify EnableControlledFolderAccess and EnableNetworkProtection equal 1 (Enabled), not 2 (Audit).
Verify with an atomic test: run Atomic Red Team T1003.001 (LSASS dump via comsvcs/procdump) or T1566 (Office spawns cmd) and confirm Event ID 1121 (block) — not just 1122 (audit) — appears in Microsoft-Windows-Windows Defender/Operational, and an AsrLsassCredentialTheftBlocked DeviceEvents row lands in Advanced Hunting.
Prerequisites
Windows 10/11 Enterprise with Microsoft Defender Antivirus enabled
Microsoft 365 E5 or Microsoft Defender for Endpoint Plan 2 license (for full MDE features)
Microsoft Intune or SCCM for enterprise policy deployment
Microsoft 365 Defender portal access (security.microsoft.com)
Endpoints not running third-party AV in active mode (Defender enters passive mode)
# Enable cloud-delivered protection (real-time threat intelligence)
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendAllSamples
# Enable Block at First Sight (BAFS)
# Requires: Cloud protection enabled + sample submission enabled
Set-MpPreference -DisableBlockAtFirstSeen $false
# Set cloud block timeout to maximum (60 seconds)
Set-MpPreference -CloudBlockLevel High
Set-MpPreference -CloudExtendedTimeout 50
# Enable potentially unwanted application (PUA) protection
Set-MpPreference -PUAProtection Enabled
Step 6: Configure Scan and Update Settings
# Configure real-time protection
Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -DisableBehaviorMonitoring $false
Set-MpPreference -DisableIOAVProtection $false
Set-MpPreference -DisableScriptScanning $false
# Configure scheduled scan
Set-MpPreference -ScanScheduleQuickScanTime 12:00:00
Set-MpPreference -ScanParameters QuickScan
Set-MpPreference -ScanScheduleDay 0 # Every day
Set-MpPreference -RemediationScheduleDay 0
# Configure signature updates
Set-MpPreference -SignatureUpdateInterval 1 # Check every hour
Set-MpPreference -SignatureFallbackOrder "MicrosoftUpdateServer|MMPC"
# Enable tamper protection (prevents unauthorized changes to Defender settings)
# Managed via Microsoft 365 Defender portal:
# Settings → Endpoints → Advanced features → Tamper Protection: On
Step 7: Deploy via Intune (Enterprise)
Intune Deployment Path:
1. Endpoint Security → Attack Surface Reduction → Create Profile
- Platform: Windows 10 and later
- Profile: Attack surface reduction rules
- Configure each ASR rule to Block or Audit
2. Endpoint Security → Antivirus → Create Profile
- Microsoft Defender Antivirus
- Configure: Cloud protection, PUA, real-time protection
3. Endpoint Security → Antivirus → Create Profile
- Microsoft Defender Antivirus Exclusions
- Add path/process/extension exclusions for LOB apps
4. Devices → Configuration profiles → Create profile
- Endpoint protection → Microsoft Defender Exploit Guard
- Configure: Controlled Folder Access, Network Protection
Step 8: Monitor in Microsoft 365 Defender Portal
Dashboard monitoring:
1. security.microsoft.com → Reports → Endpoints
- Device health: Protection status across fleet
- ASR rule detections: Which rules are triggering
- Vulnerable devices: Missing security updates
2. Threat analytics:
- Active threat campaigns and Defender coverage
- Recommended security actions
3. Advanced hunting (KQL):
DeviceEvents
| where ActionType startswith "Asr"
| summarize Count=count() by ActionType, FileName
| sort by Count desc
DeviceEvents
| where ActionType == "ControlledFolderAccessViolationBlocked"
| project Timestamp, DeviceName, FileName, FolderPath
Key Concepts
Term
Definition
ASR Rules
Attack Surface Reduction rules that block specific high-risk behaviors at the endpoint level
Controlled Folder Access
Ransomware protection feature that prevents unauthorized applications from modifying files in protected folders
Network Protection
Blocks outbound connections to low-reputation or known-malicious domains using SmartScreen intelligence
Exploit Protection
System and per-application memory mitigations (DEP, ASLR, CFG) to prevent exploitation
BAFS (Block at First Sight)
Cloud-based zero-day protection that holds suspicious files for cloud analysis before allowing execution
Tamper Protection
Prevents unauthorized changes to Defender security settings, even by local administrators
Tools & Systems
Microsoft 365 Defender Portal: security.microsoft.com for centralized management and reporting
Microsoft Intune: Cloud-based endpoint management for Defender policy deployment
PowerShell (Set-MpPreference): Local configuration of Defender settings
WDAC (Windows Defender Application Control): Complementary application control technology
Microsoft Defender for Endpoint API: REST API for automation and custom integrations
Common Pitfalls
Enabling all ASR rules in Block mode immediately: Some ASR rules cause false positives with legitimate software (Office macros, admin scripts). Always deploy in Audit mode first and monitor for 2-4 weeks.
Not configuring Controlled Folder Access exclusions: Backup software, database applications, and development tools may be blocked from writing to protected folders. Add exclusions proactively.
Ignoring tamper protection: Without tamper protection, malware or insiders can disable Defender via PowerShell or registry edits. Enable tamper protection through the M365 Defender portal.
Running Defender alongside third-party AV: Defender enters passive mode when third-party AV is present. Ensure you are using the intended AV solution and configure Defender appropriately (EDR-only mode if keeping third-party AV).
Forgetting cloud connectivity requirements: Cloud-delivered protection and BAFS require endpoints to reach Microsoft cloud services. Verify proxy/firewall rules allow Defender cloud traffic.
