Windows 10 22H2 · 1.0

This policy setting turns off [removed: Windows Defender. ][added: Microsoft Defender Antivirus. ]If you enable this policy setting, [removed: Windows][added: Microsoft] Defender [added: Antivirus ]does not run, and [removed: computers are not scanned][added: will not scan computers] for malware or other potentially unwanted software. If you disable [removed: or][added: this policy setting, Microsoft Defender Antivirus will run regardless of any other installed antivirus product. If you] do not configure this policy setting, [removed: by default][added: Windows will internally manage Microsoft Defender Antivirus. If you install another antivirus program,] Windows [added: automatically disables Microsoft ]Defender [removed: runs and computers are scanned][added: Antivirus. Otherwise, Microsoft Defender Antivirus will scan your computers] for malware and other potentially unwanted software.[added: Enabling or disabling this policy may lead to unexpected or unsupported behavior. It is recommended that you leave this policy setting unconfigured.]

[added: ]Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off.[added: Disabled (Default): Microsoft Defender will exclude pre-defined list of paths from the scan to improve performance. Enabled: Microsoft Defender will not exclude pre-defined list of paths from scans. This can impact machine performance in some scenarios. Not configured: Same as Disabled. ]

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device.[removed: ][added: ]Enabled – The Block at First Sight setting is turned on.[removed: ][added: ]Disabled – The Block at First Sight setting is turned off.[removed: ][added: ]This feature requires these Group Policy settings to be set as follows:[removed: ][added: ]MAPS -> The “Join Microsoft MAPS” must be enabled or the “Block at First Sight” feature will not function.[removed: ][added: ]MAPS -> The “Send file samples when further analysis is required” should be set to 1 (Send safe samples) or 3 (Send all samples). Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the “Block at First Sight” feature will not function.[removed: ][added: ]Real-time Protection -> The “Scan all downloaded files and attachments” policy must be enabled or the “Block at First Sight” feature will not function.[removed: ][added: ]Real-time Protection -> Do not enable the “Turn off real-time protection” policy or the “Block at First Sight” feature will not function.

This policy setting turns off real-time protection prompts for known malware detection. [removed: Windows][added: Microsoft] Defender [added: Antivirus ]alerts you when malware or potentially unwanted software attempts to install itself or to run on your computer. If you enable this policy setting, [removed: Windows][added: Microsoft] Defender [added: Antivirus ]will not prompt users to take actions on malware detections. If you disable or do not configure this policy setting, [removed: Windows][added: Microsoft] Defender[added: Antivirus] will prompt users to take actions on malware detections.

This policy setting allows you to configure whether [removed: Windows][added: Microsoft] Defender [added: Antivirus ]automatically takes action on all detected threats. The action to be taken on a particular threat is determined by the combination of the policy-defined action, user-defined action, and the signature-defined action. If you enable this policy setting, [removed: Windows][added: Microsoft] Defender [added: Antivirus ]does not automatically take action on the detected threats, but prompts users to choose from the actions available for each threat. If you disable or do not configure this policy setting, [removed: Windows][added: Microsoft] Defender[added: Antivirus] automatically takes action on all detected threats after a nonconfigurable delay of approximately five seconds.

This policy setting allows you to configure definition retirement for network protection against exploits of known vulnerabilities. Definition retirement checks to see if a computer has the required security updates necessary to protect it against a particular vulnerability. If the system is not vulnerable to the exploit detected by a definition, then that definition is "retired". If all [removed: definitions][added: security intelligence] for a given protocal are retired then that protocol is no longer parsed. Enabling this feature helps to improve performance. On a computer that is up-to-date with all the latest security updates, network protection will have no impact on network performance. If you enable or do not configure this setting, definition retirement will be enabled. If you disable this setting, definition retirement will be disabled.

This policy setting defines additional definition sets to enable for network traffic inspection. Definition set GUIDs should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a definition set GUID. As an example, the definition set GUID to enable test [removed: definitions][added: security intelligence] is defined as: “{b54b6ac9-a737-498e-9120-6616ad3bf590}”. The value is not used and it is recommended that this be set to 0.

This policy setting defines the URL of a proxy .pac file that should be used when the client attempts to connect the network for [removed: definition][added: security intelligence] updates and MAPS reporting. If the proxy auto-config fails or if there is no proxy auto-config specified, the client will fall back to the alternative options (in order): 1. Proxy server (if specified) 2. Proxy .pac URL (if specified) 3. None 4. Internet Explorer proxy settings 5. Autodetect If you enable this setting, the proxy setting will be set to use the specified proxy .pac according to the order specified above. If you disable or do not configure this setting, the proxy will skip over this fallback step according to the order specified above.

This policy setting allows you to configure the named proxy that should be used when the client attempts to connect to the network for [removed: definition][added: security intelligence] updates and MAPS reporting. If the named proxy fails or if there is no proxy specified, the client will fall back to the alternative options (in order): 1. Proxy server (if specified) 2. Proxy .pac URL (if specified) 3. None 4. Internet Explorer proxy settings 5. Autodetect If you enable this setting, the proxy will be set to the specified URL according to the order specified above. The URL should be proceeded with either http:// or https://. If you disable or do not configure this setting, the proxy will skip over this fallback step according to the order specified above.

This policy setting allows you to enable or disable randomization of the scheduled scan start time and the scheduled [removed: definition][added: security intelligence] update start time. This setting is used to distribute the resource impact of scanning. For example, it could be used in guest virtual machines sharing a host, to prevent multiple guest virtual machines from undertaking a disk-intensive operation at the same time. If you enable or do not configure this setting, scheduled tasks will begin at a random time within an interval of 30 minutes before and after the specified start time. If you disable this setting, scheduled tasks will begin at the specified start time.