Group Policy Management
body { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; } .head { font-weight:bold; font-size:160%; font-family:MS Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding-left:8px; height:24px; } .path { margin-left: 10px; margin-top: 10px; margin-bottom:5px;width:100%; } .info { padding-left:10px;width:100%; } table { font-size:100%; width:100%; border:1px solid #999999; } th { border-bottom:1px solid #999999; text-align:left; padding-left:10px; height:24px; } td { background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; } .btn { width:100%; text-align:right; margin-top:16px; } .hdr { font-weight:bold; border:1px solid #999999; text-align:left; padding-top: 4px; padding-left:10px; height:24px; margin-bottom:-1px; width:100%; } .bdy { width:100%; height:182px; display:block; overflow:scroll; z-index:2; background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; border:1px solid #999999; } button { width:6.9em; height:2.1em; font-size:100%; font-family:MS Shell Dlg; margin-right:15px; } @media print { .bdy { display:block; overflow:visible; } button { display:none; } .head { color:#000000; background:#FFFFFF; border:1px solid #000000; } }
Setting Path:
Explanation
No explanation is available for this setting.
Supported On:
Not available

DoD Microsoft Defender Antivirus STIG Computer v2r9
Data collected on: 7/10/2026 11:14:10 AM |

General
Details

Domain | security.local
Owner | SECURITY\Domain Admins
Created | 7/10/2026 8:21:30 AM
Modified | 7/10/2026 8:21:48 AM
User Revisions | 1 (AD), 1 (SYSVOL)
Computer Revisions | 1 (AD), 1 (SYSVOL)
Unique ID | {C49142C4-9238-49A5-83B0-86ED4D6D3F26}
GPO Status | User settings disabled

Links

Location | Enforced | Link Status | Path
--- | --- | --- | ---
None

This list only includes links in the domain of the GPO.
Security Filtering
The settings in this GPO can only apply to the following groups, users, and computers:

Name
NT AUTHORITY\Authenticated Users

Delegation
These groups and users have the specified permission for this GPO

Name | Allowed Permissions | Inherited
--- | --- | ---
NT AUTHORITY\Authenticated Users | Read (from Security Filtering) | No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS | Read | No
NT AUTHORITY\SYSTEM | Edit settings, delete, modify security | No
SECURITY\Domain Admins | Edit settings, delete, modify security | No
SECURITY\Enterprise Admins | Edit settings, delete, modify security | No

Computer Configuration (Enabled)
Policies
Administrative Templates
Policy definitions (ADMX files) retrieved from the local computer.
Windows Components/Microsoft Defender Antivirus

Policy | Setting | Comment
--- | --- | ---
Configure detection for potentially unwanted applications | Enabled |
Policy | Setting | Comment
Configure local administrator merge behavior for lists | Enabled |
Control whether or not exclusions are visible to Local Admins | Enabled |
Randomize scheduled task times | Enabled |

Windows Components/Microsoft Defender Antivirus/Exclusions

Policy | Setting | Comment
--- | --- | ---
Turn off Auto Exclusions | Disabled |

Windows Components/Microsoft Defender Antivirus/Features

Policy | Setting | Comment
--- | --- | ---
Enable EDR in block mode | Enabled |

Windows Components/Microsoft Defender Antivirus/MAPS

Policy | Setting | Comment
--- | --- | ---
Configure the 'Block at First Sight' feature | Enabled |
Join Microsoft MAPS | Enabled |
Join Microsoft MAPS | Advanced MAPS
Policy | Setting | Comment
Send file samples when further analysis is required | Enabled |
Send file samples when further analysis is required |

Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard/Attack Surface Reduction

Policy | Setting | Comment
--- | --- | ---
Configure Attack Surface Reduction rules | Enabled |
Set the state for each ASR rule: |
--- | ---
BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 | 1
D4F940AB-401B-4EFC-AADC-AD5F3C50688A | 1
3B576869-A4EC-4529-8536-B80A7769E899 | 1
75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 | 1
D3E037E1-3EB8-44C8-A917-57927947596D | 1
5BEB7EFE-FD9A-4556-801D-275E5FFC04CC | 1
92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B | 1
01443614-cd74-433a-b99e-2ecdc07bfc25 | 2
7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c | 1
9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 | 1
b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 | 1
c1db55ab-c21a-4637-bb3f-a12568109d35 | 1
d1e49aac-8f56-4280-b9ba-993a6d77406c | 2
e6db77e5-3df2-4cf1-b95a-636979351e5b | 2
26190899-1602-49e8-8b27-eb1d0a1ce869 | 1
56a863a9-875e-4185-98a7-b882c64b5ce5 | 1

Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard/Network Protection

Policy | Setting | Comment
--- | --- | ---
Prevent users and apps from accessing dangerous websites | Enabled |
Policy | Setting | Comment
This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server. | Enabled |

Windows Components/Microsoft Defender Antivirus/MpEngine

Policy | Setting | Comment
--- | --- | ---
Configure extended cloud check | Enabled |
Specify the extended cloud check time in seconds | 50
Policy | Setting | Comment
Enable file hash computation feature | Enabled |
Select cloud protection level | Enabled |
Select cloud blocking level | High blocking level

Windows Components/Microsoft Defender Antivirus/Network Inspection System

Policy | Setting | Comment
--- | --- | ---
Convert warn verdict to block | Enabled |
Turn on asynchronous inspection | Enabled |

Windows Components/Microsoft Defender Antivirus/Real-time Protection

Policy | Setting | Comment
--- | --- | ---
Configure monitoring for incoming and outgoing file and program activity | Enabled |
Configure monitoring for incoming and outgoing file and program activity | bi-directional (full on-access)
Policy | Setting | Comment
Configure real-time protection and Security Intelligence Updates during OOBE | Enabled |
Turn on script scanning | Enabled |

Windows Components/Microsoft Defender Antivirus/Reporting

Policy | Setting | Comment
--- | --- | ---
Configure whether to report Dynamic Signature dropped events | Enabled |

Windows Components/Microsoft Defender Antivirus/Scan

Policy | Setting | Comment
--- | --- | ---
Scan excluded files and directories during quick scans | Enabled |
Policy | Setting | Comment
Scan packed executables | Enabled |
Scan removable drives | Enabled |
Specify the day of the week to run a scheduled scan | Enabled |
Specify the day of the week to run a scheduled scan | Every Day
Policy | Setting | Comment
Turn on e-mail scanning | Enabled |
Turn on heuristics | Enabled |

Windows Components/Microsoft Defender Antivirus/Security Intelligence Updates

Policy | Setting | Comment
--- | --- | ---
Define the number of days before spyware security intelligence is considered out of date | Enabled |
Define the number of days before spyware security intelligence is considered out of date | 7
Policy | Setting | Comment
Define the number of days before virus security intelligence is considered out of date | Enabled |
Define the number of days before virus security intelligence is considered out of date | 7
Policy | Setting | Comment
Specify the day of the week to check for security intelligence updates | Enabled |
Specify the day of the week to check for security intelligence updates | Every Day

Windows Components/Microsoft Defender Antivirus/Threats

Policy | Setting | Comment
--- | --- | ---
Specify threat alert levels at which default action should not be taken when detected | Enabled |
Specify threat alert levels at which default action should not be taken when detected |
--- | ---
5 | 2
4 | 2
2 | 2
1 | 2

Windows Components/Windows Security/Family options

Policy | Setting | Comment
--- | --- | ---
Hide the Family options area | Enabled |

User Configuration (Disabled)
No settings defined.