Configure network protection in Microsoft Defender Antivirus

Network protection helps prevent apps from connecting to dangerous domains that might host phishing scams, exploits, and other malicious content on the internet. Security administrators can configure network protection by using Microsoft Intune, the Microsoft Defender portal, mobile device management (MDM), Microsoft Configuration Manager, Group Policy, or PowerShell.

Before you enable network protection in block mode, use audit mode in a test environment to identify apps that would be blocked.

Before you begin, review the supported operating systems and Microsoft Defender Antivirus requirements in Prerequisites.

Prerequisites

Supported operating systems

The procedures in this article apply to the following operating systems:

• Windows 10, version 1709 or later, or Windows 11 (Pro or Enterprise).
• Windows Server 2012 R2, Windows Server 2016, or Windows Server, version 1803 or later.

Network protection is also supported on other platforms. For platform-specific instructions, see Network protection for Linux and Network protection for macOS.

Microsoft Defender Antivirus requirements

Network protection requires Microsoft Defender Antivirus in active mode with real-time protection enabled.

• On Windows 10, Windows 11, and Windows Server, version 1803 or later, turn on real-time protection, behavior monitoring, and cloud-delivered protection.
• On Windows Server 2012 R2 and Windows Server 2016 with the modern unified solution, use Microsoft Defender Antivirus platform update version 4.18.2001.x.x or later.

Windows Server requirements

Configure network protection in Microsoft Intune

Microsoft Intune is the recommended tool for configuring and distributing Defender for Endpoint features to devices. However, Intune is a separate product that isn't part of Defender for Endpoint, and it isn't included in all subscriptions. To use Intune, you need a subscription that includes it, or you can buy it separately as a standalone subscription or add-on. If you don't have Intune, you can use any of the other methods in this article. For more information, see Microsoft Intune licensing.

You can enable network protection in Microsoft Intune by using an antivirus policy or a security baseline.

Configure network protection in Intune using endpoint security policies

To configure network protection by using a Microsoft Intune endpoint security Antivirus policy, see Create endpoint security policies or Modify existing policies (links open new tabs in the Intune documentation).

When you create the policy, use these specific settings:

• Policy type: Go to Manage > Antivirus on the Endpoint security | Overview page at https://intune.microsoft.com/#view/Microsoft_Intune_Workflows/SecurityManagementMenu/~/overview.
• Platform: Select Windows.
• Profile: Select Microsoft Defender Antivirus.

When you create or modify the policy, use these specific settings on the Configuration settings tab:

• Enable network protection in the Defender section: Select one of the following values:
  • Enabled (block mode): Blocks connections to malicious or suspicious domains.
  • Enabled (audit mode): Records network protection events without blocking connections.
  • Disabled: Turns off network protection.
  • Not configured: Leaves the setting unmanaged by the policy.

For more information about Microsoft Defender Antivirus profiles in Intune, see Antivirus policy for endpoint security in Intune.

Configure network protection in Intune using a security baseline

To configure network protection as part of a security baseline in Microsoft Intune, see Create a profile for a security baseline or Edit a security baseline (links open new tabs in the Intune documentation).

When you create the profile, select Microsoft Defender for Endpoint Security Baseline.

When you create or modify the profile, use these specific settings on the Configuration settings tab:

• Enable Network Protection in the Defender section: Select Enabled (block mode) or Enabled (audit mode).

For more information about security baselines in Microsoft Intune, see Learn about Intune security baselines for Windows devices.

Configure network protection in the Microsoft Defender portal

If your organization manages endpoint security policies in the Microsoft Defender portal, use a Microsoft Defender Antivirus policy to configure network protection.

For detailed instructions, see Create an endpoint security policy or Edit an endpoint security policy (links open new tabs).

When you create the policy on the Endpoint security policies page in the Microsoft Defender portal at https://security.microsoft.com/policy-inventory, use these specific settings:

• Select platform: Select Windows.
• Select template: Select Microsoft Defender Antivirus.

When you create or modify the policy, configure Enable network protection in the Defender section on the Configuration settings tab:

• Enabled (block mode): Blocks connections to malicious or suspicious domains. Block mode is required for IP address and URL indicators and web content filtering.
• Enabled (audit mode): Records network protection events without blocking connections.
• Disabled (Default): Turns off network protection.
• Not configured: Leaves the setting unmanaged by the policy.

For Windows Server 2016 and Windows Server 2012 R2, also set Allow Network Protection Down Level in the Threat Severity Default Action section to Network protection will be enabled downlevel.

The policy also contains the following optional network protection settings:

• Allow Datagram Processing On Win Server: For server roles that generate high volumes of UDP traffic, select Datagram processing on Windows Server is disabled (Default). Examples include domain controllers, DNS servers, file servers, SQL Server, and Exchange Server.
• Disable DNS over TCP parsing: Select whether DNS over TCP parsing is enabled or disabled.
• Disable HTTP parsing: Select whether HTTP parsing is enabled or disabled.
• Disable SSH parsing: Select whether SSH parsing is enabled or disabled.
• Disable TLS parsing: Select whether TLS parsing is enabled or disabled.
• [Deprecated] Enable DNS Sinkhole: Select whether DNS sinkhole is enabled or disabled.

Configure network protection in any MDM solution using the Policy CSP

The Policy configuration service provider (CSP) enables organizations to configure policies on Windows devices by using any mobile device management (MDM) solution, not just Microsoft Intune. For more information, see Policy CSP.

Configure network protection by using the EnableNetworkProtection CSP with the following settings:

OMA-URI path: ./Device/Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection
Data type: Integer
Value:

• 0: Network protection is disabled.
• 1: Network protection is enabled in block mode.
• 2: Network protection is enabled in audit mode.

Configure network protection in Microsoft Configuration Manager

To configure network protection in Microsoft Configuration Manager, use a Windows Defender Exploit Guard policy. For detailed instructions, see Create and deploy an Exploit Guard policy.

When you create or modify the policy, use these specific settings:

• Exploit Guard components (new policies only): Select Network protection.
• Configure network protection (new and existing policies): Select Block, Audit, or Disabled.

Remove Configuration Manager Exploit Guard settings

When you deploy an Exploit Guard policy by using Configuration Manager, the settings remain on the client if you remove the deployment. The client records Delete not supported in the ExploitGuardHandler.log file.

To remove the Exploit Guard settings, run the following PowerShell script in the SYSTEM context. The script clears the Defender and Exploit Guard MDM policy values, including attack surface reduction rules, controlled folder access, and network protection:

$defenderObject = Get-WmiObject -Namespace "root/cimv2/mdm/dmmap" -Class "MDM_Policy_Config01_Defender02" -Filter "InstanceID='Defender' and ParentID='./Vendor/MSFT/Policy/Config'"

$defenderObject.AttackSurfaceReductionRules = $null

$defenderObject.AttackSurfaceReductionOnlyExclusions = $null

$defenderObject.EnableControlledFolderAccess = $null

$defenderObject.ControlledFolderAccessAllowedApplications = $null

$defenderObject.ControlledFolderAccessProtectedFolders = $null

$defenderObject.EnableNetworkProtection = $null

$defenderObject.Put()

$exploitGuardObject = Get-WmiObject -Namespace "root/cimv2/mdm/dmmap" -Class "MDM_Policy_Config01_ExploitGuard02" -Filter "InstanceID='ExploitGuard' and ParentID='./Vendor/MSFT/Policy/Config'"

$exploitGuardObject.ExploitProtectionSettings = $null

$exploitGuardObject.Put()

Configure network protection by using Group Policy

To configure network protection in a domain environment, follow these steps:

1. Open the Group Policy Management Console (GPMC) on your Group Policy management computer.

2. In the GPMC console tree, expand Group Policy Objects in the forest and domain that contain the Group Policy object (GPO) you want to edit.

3. Right-click the GPO, and then select Edit.

4. In the Group Policy Management Editor, go to Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Network protection.

   Note

   Group Policy paths on older versions of Windows might use Windows Defender Antivirus instead of Microsoft Defender Antivirus. Both names refer to the same policy location.

5. In the Network protection details pane, open Prevent users and apps from accessing dangerous websites.

6. Select Enabled, and then select one of the following options:

   • Block: Blocks access to malicious IP addresses and domains.
   • Disable (Default): Turns off network protection.
   • Audit Mode: Records an event when a user visits a malicious IP address or domain without blocking access.

   Select OK.

Configure network protection by using PowerShell

To configure network protection in PowerShell on Windows clients, use the following syntax in an elevated PowerShell session (a PowerShell prompt you opened by selecting Run as administrator):

Set-MpPreference -EnableNetworkProtection <Disabled | Enabled | AuditMode>

• Disabled: Turns off network protection.
• Enabled: Turns on network protection in block mode, which prevents connections to malicious or suspicious domains.
• AuditMode: Turns on network protection in audit mode, which records events for connections to malicious domains without blocking them.

To configure network protection in PowerShell on Windows servers, use the following syntax in an elevated PowerShell session:

• Windows Server 2019 or later:

  Set-MpPreference -AllowNetworkProtectionOnWinServer $true [-AllowDatagramProcessingOnWinServer $false] -EnableNetworkProtection <Disabled | Enabled | AuditMode>
  

• Windows Server 2016 or Windows Server 2012 R2 with the modern unified solution for Microsoft Defender for Endpoint:

  Set-MpPreference -AllowNetworkProtectionDownLevel $true -AllowNetworkProtectionOnWinServer $true [-AllowDatagramProcessingOnWinServer $false] -EnableNetworkProtection <Disabled | Enabled | AuditMode>
  

For detailed syntax and parameter information, see Set-MpPreference.

Verify network protection settings on devices

Use one of the following methods to verify the network protection settings on a device:

• PowerShell:

  Run the following command in PowerShell:

  Get-MpPreference | Select-Object EnableNetworkProtection, AllowNetworkProtectionOnWinServer, AllowNetworkProtectionDownLevel, AllowDatagramProcessingOnWinServer
  

  • EnableNetworkProtection:
    • 0: Network protection is off.
    • 1: Network protection is on in Block mode.
    • 2: Network protection is on in Audit mode.
  • AllowNetworkProtectionOnWinServer: On Windows servers, the value should be True.
  • AllowNetworkProtectionDownLevel: On Windows Server 2016 and Windows Server 2012 R2 with the unified agent, the value should be True.
  • AllowDatagramProcessingOnWinServer: On server roles that generate high volumes of UDP traffic, the value should be False.

• Registry Editor:

  1. Open Registry Editor. For example, run regedit.exe.

  2. Go to HKEY_LOCAL_MACHINE > SOFTWARE > Policies > Microsoft > Windows Defender > Policy Manager.

     If that path doesn't exist, go to HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows Defender > Windows Defender Exploit Guard > Network Protection.

  3. Select EnableNetworkProtection to see the current state of network protection on the device:

     • 0: Network protection is off.
     • 1: Network protection is on in Block mode.
     • 2: Network protection is on in Audit mode.

     

Related content

• Network protection
• Network protection for Linux
• Network protection for macOS
• Network protection and the TCP three-way handshake
• Evaluate network protection
• Troubleshoot network protection