Access Deny
Defender Mastery
Configure Microsoft Defender Antivirus and Firewall to detect and block real threats—without slowing your PC.
Covers: Windows 11 (23H2+) and Windows 10 (22H2)
Quick Wins (5 minutes)
- Windows Security → App & browser control → Reputation-based protection → Turn on SmartScreen and PUA blocking.
- Windows Security → Virus & threat protection → Manage settings → Cloud-delivered protection: On.
- Automatic sample submission: On.
- Windows Security → Firewall & network protection → Public network: On (Block inbound), notifications enabled.
- Use a standard user for everyday work; admin only for installs/changes.
Want a hands-on walkthrough? See the Step-by-Step Practical Guide.
Defender Basics: What to turn on
1) Real-time protections
- Real-time protection: On
- Cloud-delivered protection: On
- Automatic sample submission: On
- Potentially unwanted apps (PUA) blocking: On
Why: These block the majority of everyday threats (malicious downloads, suspicious installers, drive-by payloads) with negligible impact on performance.
2) SmartScreen reputation
- Windows Security → App & browser control → Reputation-based protection settings → Turn everything On.
- In Microsoft Edge: Settings → Privacy, search, and services → Microsoft Defender SmartScreen: On.
3) Tamper Protection
- Windows Security → Virus & threat protection → Manage settings → Tamper Protection: On.
Tamper Protection stops malware or misconfigurations from silently weakening Defender.
Ransomware Protection
Turn on Controlled Folder Access (CFA) to stop untrusted apps from modifying protected folders.
- Windows Security → Virus & threat protection → Ransomware protection → Manage ransomware protection → Controlled folder access: On.
- Use “Protected folders” to ensure Documents, Pictures, Desktop (and any work folders) are covered.
- Use “Allow an app through Controlled folder access” if a known‑good app is blocked.
Tip: If you do heavy media/dev work, add only the specific, trusted editor/tool—not entire drives—as allowed apps. Keep the protection surface small.
Firewall: Profiles that make sense
- Public network: Firewall On, Block inbound, File & Printer Sharing Off.
- Private (Home/Work): Firewall On, Block unsolicited inbound unless needed (e.g., a LAN media server) and scoped to your subnet.
- Domain (business PCs): Usually managed by policy—keep Defender Firewall On unless your security team dictates otherwise.
RDP? If you must allow Remote Desktop, scope the rule to trusted IPs, enable NLA, and use MFA on your accounts.
Performance: Stay fast and safe
- Exclusions (sparingly): Only exclude large, trusted build folders (e.g., node_modules, VM image folders) if scans cause noticeable slowdowns. Never exclude Downloads, Temp, or entire drives.
- Schedule: Defender runs maintenance-aware scans automatically. Manual Full Scan occasionally; Quick Scan weekly is fine for most users.
Advanced: ASR and PowerShell
Attack Surface Reduction (ASR) rules can block specific high‑risk behaviors (e.g., Office spawning child processes). They’re powerful but can affect workflows. Best practice:
- Enable Audit first, use your PC normally for a few days.
- Review logs, then switch non‑disruptive rules to Block.
| Rule (short name) | GUID | What it does |
|---|---|---|
| Block Office child processes | {D4F940AB-401B-4EFC-AADC-AD5F3C50688A} |
Stops Office apps (Word, Excel, etc.) from spawning child processes often abused by malware. |
| Block Office creating executables | {3B576869-A4EC-4529-8536-B80A7769E899} |
Prevents Office from writing/creating executable files. |
| Block Office injecting code | {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84} |
Prevents Office from injecting code into other processes. |
| Block Win32 API calls from macros | {92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B} |
Blocks Office macros from calling risky Win32 APIs. |
| Block executable content via email/webmail | {BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550} |
Blocks launching executables that arrive through email or webmail clients. |
| Block JS/VBS launching downloaded EXEs | {D3E037E1-3EB8-44C8-A917-57927947596D} |
Stops scripts from launching executables that were downloaded. |
| Block executable unless prevalence/age criteria | {01443614-CD74-433A-B99E-2ECDC07BFC25} |
Allows only known-prevalent/trusted binaries; blocks low-reputation binaries. |
| Advanced ransomware protection | {C1DB55AB-C21A-4637-BB3F-A12568109D35} |
Heuristic protection designed to reduce ransomware impact. |
| Block credential stealing from LSASS | {9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2} |
Prevents techniques used to dump LSASS memory for credentials. |
| Block process creation via PSExec/WMI | {D1E49AAC-8F56-4280-B9BA-993A6D77406C} |
Blocks lateral movement techniques using PSExec and WMI. |
Run PowerShell as Administrator.
# Enable a rule (Block mode) — example: Block Office child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
-AttackSurfaceReductionRules_Actions Enabled
# Start in Audit mode (recommended), then switch to Block after review
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
-AttackSurfaceReductionRules_Actions AuditMode
# Disable a rule
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
-AttackSurfaceReductionRules_Actions Disabled
# List current ASR settings
Get-MpPreference | Select-Object -Expand AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions
# Remove a specific ASR rule entry if added via Add-MpPreference
Remove-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A
Actions: Enabled (block), AuditMode (log only), Disabled. Some rules or SKUs may require enterprise licensing—see Microsoft’s reference for availability.
PowerShell examples (advanced)
Open PowerShell as Administrator and run:
# Enable PUA (Potentially Unwanted App) protection Set-MpPreference -PUAProtection Enabled # Turn on Controlled Folder Access (CFA) Set-MpPreference -EnableControlledFolderAccess Enabled # Add a protected folder (example) Add-MpPreference -ControlledFolderAccessProtectedFolders "C:\Work\Projects" # Allow a known-good app through CFA (example) Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\TrustedApp\TrustedApp.exe" # View Defender status/preferences Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled Get-MpPreference | Select-Object PUAProtection,EnableControlledFolderAccess
Note: ASR rules are configurable via Set-MpPreference/Add-MpPreference using rule GUIDs and actions. Start in Audit. Refer to Microsoft’s official ASR rule list to avoid mistakes and ensure SKU support.
Validate Your Setup
- Windows Security dashboard shows no warnings.
- Quick Scan completes without errors.
- Firewall profiles are On; Public is blocking inbound.
Test Your Setup (safe demos)
- AMTSO Security Features Check: Verify phishing, PUA, cloud lookup and more — amtso.org/security-features-check
- EICAR test file: Confirm real-time detection — eicar.org/download-anti-malware-testfile
- Microsoft SmartScreen demo: See browser warnings for unsafe content — demo.smartscreen.msft.net
Want screenshots and click‑paths? Open the Practical Step-by-Step Guide.
FAQ
Will exclusions make me vulnerable?
They can if misused. Only exclude specific, trusted folders that truly need it. Never exclude common malware landing zones (Downloads, Temp, Desktop).
Do I need a paid antivirus?
For most home and small-business users, properly configured Microsoft Defender is enough. Paid tools may add management features or VPNs, but focus first on core protections and backups.
Where do I see what Defender blocked?
Windows Security → Virus & threat protection → Protection history. For firewall blocks: Event Viewer → Applications and Services Logs → Microsoft → Windows → Windows Firewall With Advanced Security.