Controlled Folder Access

Controlled Folder Access is a ransomware protection feature that prevents unauthorized applications from making changes to files in protected folders. When enabled, only applications on the allowed list can write to, modify, or delete files in designated directories.

This is one of the most effective defenses against ransomware. Even if malware manages to execute on your system, it cannot encrypt files in protected folders because the operating system blocks the write attempt at the kernel level.

Enabling Controlled Folder Access

Via PowerShell (as Administrator):

# Enable Controlled Folder Access
Set-MpPreference -EnableControlledFolderAccess Enabled

# Check current status
Get-MpPreference | Select-Object EnableControlledFolderAccess

Managing Protected Folders

By default, Controlled Folder Access protects the Documents, Pictures, Videos, Music, Desktop, and Favorites folders. You can add additional folders:

# Add a custom protected folder
Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\ImportantData"

# View all protected folders
Get-MpPreference | Select-Object -ExpandProperty ControlledFolderAccessProtectedFolders

Allowing Applications Through

Legitimate applications may be blocked from writing to protected folders. When this happens, you will receive a notification. To allow a specific application:

# Allow an application through Controlled Folder Access
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\MyApp\myapp.exe"

# View allowed applications
Get-MpPreference | Select-Object -ExpandProperty ControlledFolderAccessAllowedApplications

Exploit Protection

Exploit Protection applies mitigation techniques to individual applications and to the operating system as a whole. These mitigations make it significantly harder for attackers to exploit software vulnerabilities, even when patches are not yet available (zero-day attacks).

System-Level Settings

Key system-level mitigations and what they do:

Per-Application Settings

The Program settings tab lets you apply or override mitigations for specific executables. This is useful when a system-level mitigation causes compatibility issues with certain software.

# Export current exploit protection settings to XML
Get-ProcessMitigation -RegistryConfigFilePath settings.xml

# Import exploit protection settings from XML
Set-ProcessMitigation -PolicyFilePath settings.xml

# View mitigations for a specific process
Get-ProcessMitigation -Name "chrome.exe"

Network Protection

Network Protection extends SmartScreen filtering to all outbound HTTP and HTTPS traffic on the system, not just web browsers. It blocks connections to domains known to host phishing scams, malware distribution, exploit kits, and command-and-control servers.

This is particularly valuable because many malware families communicate with remote servers after initial infection. Network Protection can cut off this communication even if the malware itself evades detection.

Enabling Network Protection

Network Protection is not enabled by default on consumer editions of Windows. You must enable it through PowerShell or Group Policy:

# Enable Network Protection (Block mode)
Set-MpPreference -EnableNetworkProtection Enabled

# Enable in Audit mode (logs events without blocking - good for testing)
Set-MpPreference -EnableNetworkProtection AuditMode

# Disable Network Protection
Set-MpPreference -EnableNetworkProtection Disabled

# Check current status
Get-MpPreference | Select-Object EnableNetworkProtection

Attack Surface Reduction Rules

Attack Surface Reduction (ASR) rules target specific behaviors commonly used by malware and exploits. Unlike traditional antivirus which looks for known malicious files, ASR rules block suspicious behaviors regardless of whether the file itself is recognized as malicious.

For example, an ASR rule can block Microsoft Office applications from creating child processes. Legitimate Office usage rarely requires this, but macro-based malware relies on it to execute payloads. The rule stops the behavior without needing to know about the specific malware variant.

Important ASR Rules

Enabling ASR Rules via PowerShell

# Enable a single ASR rule in Block mode
# Example: Block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled

# Enable in Audit mode (recommended first)
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions AuditMode

# Enable multiple rules at once
Set-MpPreference -AttackSurfaceReductionRules_Ids `
    d4f940ab-401b-4efc-aadc-ad5f3c50688a, `
    75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84, `
    d3e037e1-3eb8-44c8-a917-57927947596d `
    -AttackSurfaceReductionRules_Actions Enabled, Enabled, Enabled

# View current ASR rule status
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions

SmartScreen Configuration

Microsoft Defender SmartScreen protects against phishing websites, malicious downloads, and potentially unwanted applications. It works by checking URLs and file hashes against Microsoft's cloud-based reputation database.

SmartScreen for Microsoft Edge

SmartScreen for Other Browsers

SmartScreen for Microsoft Edge is built in, but other browsers have their own protective systems. Google Chrome and Brave use Google Safe Browsing, and Firefox uses a combination of Google Safe Browsing and its own threat lists. The "Check apps and files" setting in Windows Security still applies system-wide to downloaded executables regardless of which browser downloaded them.

PowerShell Defender Management

PowerShell provides comprehensive access to every Defender setting. This is essential for automation, scripting consistent configurations across machines, and accessing settings not exposed in the Windows Security graphical interface.

Essential PowerShell Commands

# View complete Defender configuration
Get-MpPreference

# View current threat status and statistics
Get-MpComputerStatus

# View detected threats
Get-MpThreat

# View threat detection history
Get-MpThreatDetection

# Remove an active threat (by ThreatID from Get-MpThreat)
Remove-MpThreat

Configuring Protection Levels

# Set cloud protection level (0=Default, 1=Moderate, 2=High, 4=High+, 6=Zero tolerance)
Set-MpPreference -CloudBlockLevel 2

# Set cloud check timeout (seconds to wait for cloud verdict)
Set-MpPreference -CloudExtendedTimeout 50

# Enable Potentially Unwanted Application protection
Set-MpPreference -PUAProtection Enabled

# Enable behavior monitoring
Set-MpPreference -DisableBehaviorMonitoring $false

# Enable scanning of all downloaded files and attachments
Set-MpPreference -DisableIOAVProtection $false

Creating a Security Audit Script

The following script checks the status of all major Defender features and reports any that are not configured optimally:

# Defender Security Audit Script
$status = Get-MpComputerStatus
$prefs = Get-MpPreference

Write-Host "=== Windows Defender Security Audit ===" -ForegroundColor Cyan
Write-Host ""

# Core protection
$checks = @(
    @{ Name = "Antivirus Enabled"; Value = $status.AntivirusEnabled; Expected = $true },
    @{ Name = "Real-time Protection"; Value = $status.RealTimeProtectionEnabled; Expected = $true },
    @{ Name = "Behavior Monitoring"; Value = -not $prefs.DisableBehaviorMonitoring; Expected = $true },
    @{ Name = "IOAV Protection"; Value = -not $prefs.DisableIOAVProtection; Expected = $true },
    @{ Name = "Network Protection"; Value = ($prefs.EnableNetworkProtection -eq 1); Expected = $true },
    @{ Name = "PUA Protection"; Value = ($prefs.PUAProtection -eq 1); Expected = $true },
    @{ Name = "Controlled Folder Access"; Value = ($prefs.EnableControlledFolderAccess -eq 1); Expected = $true }
)

foreach ($check in $checks) {
    $icon = if ($check.Value -eq $check.Expected) { "[OK]" } else { "[!!]" }
    $color = if ($check.Value -eq $check.Expected) { "Green" } else { "Red" }
    Write-Host "$icon $($check.Name): $($check.Value)" -ForegroundColor $color
}

# Signature age
$sigAge = (Get-Date) - $status.AntivirusSignatureLastUpdated
Write-Host ""
if ($sigAge.TotalHours -gt 48) {
    Write-Host "[!!] Signatures are $([math]::Round($sigAge.TotalHours)) hours old" -ForegroundColor Red
} else {
    Write-Host "[OK] Signatures updated $([math]::Round($sigAge.TotalHours)) hours ago" -ForegroundColor Green
}

Summary

In this tutorial, you learned how to configure advanced Defender features:

• Controlled Folder Access to protect against ransomware encrypting your files
• Exploit Protection mitigations to harden the OS and individual applications
• Network Protection to block malicious domain connections system-wide
• Attack Surface Reduction rules to prevent common malware behaviors
• SmartScreen configuration for reputation-based protection
• PowerShell commands for comprehensive Defender management and auditing