Enable exploit protection

Exploit protection applies mitigation techniques to the operating system and individual apps to help protect Windows devices from malware that uses exploits. Security administrators can configure system-level and app-level mitigations by using Microsoft Intune, mobile device management (MDM), Microsoft Configuration Manager, Group Policy, PowerShell, or the Windows Security app.

Windows enables several exploit protection mitigations by default in Windows 10 and Windows 11. You can turn each mitigation on or off, or use its default value. Some mitigations also support audit mode, which lets you evaluate compatibility without affecting normal device use.

You can export the exploit protection mitigation settings as an XML file and deploy the configuration to other devices.

Prerequisites

Before you deploy exploit protection, prepare the following monitoring and testing capabilities:

• Monitoring for application crashes (Event ID 1000 or Event ID 1001) and hangs (Event ID 1002).
• Full user-mode dump collection.
• An inventory of apps compiled with Control Flow Guard (CFG). To verify that a binary contains CFG data, use dumpbin /headers /loadconfig.
• A device group for testing exploit protection changes before broad deployment.

Safe deployment practices

Safe deployment practices (SDP) help you manage the risk of app compatibility and user productivity issues. Start with a small group of Windows devices, and test the mitigations with the apps you plan to protect. Disable incompatible mitigations for the affected apps, and then repeat the testing.

After you validate the policy, deploy it to a user acceptance testing (UAT) group that includes IT administrators, security administrators, and help desk personnel. Expand the deployment in stages based on the results from each group.

Enable exploit protection by using Microsoft Intune

Microsoft Intune is the recommended tool for configuring and distributing Defender for Endpoint features to devices. However, Intune is a separate product that isn't part of Defender for Endpoint, and it isn't included in all subscriptions. To use Intune, you need a subscription that includes it, or you can buy it separately as a standalone subscription or add-on. If you don't have Intune, you can use any of the other methods in this article. For more information, see Microsoft Intune licensing.

To configure exploit protection in Microsoft Intune, use an endpoint security Attack surface reduction policy. For detailed instructions, see Create endpoint security policies or Modify existing policies (links open new tabs in the Intune documentation).

When you create the policy, use these specific settings:

• Policy type: Go to Manage > Attack surface reduction on the Endpoint security | Overview page at https://intune.microsoft.com/#view/Microsoft_Intune_Workflows/SecurityManagementMenu/~/overview.
• Platform: Select Windows.
• Profile: Select Exploit Protection.

When you create or modify the policy, use these specific settings on the Configuration settings tab:

• Exploit protection settings in the Exploit guard section: Slide the toggle to Configured.
• Next to the box that appears, select Open file and then find and select your exploit protection XML file.

For more information about creating an exploit protection XML file, see Import, export, and deploy exploit protection configurations.

For more information about attack surface reduction policies in Microsoft Intune, see Attack surface reduction policy for endpoint security in Intune.

Enable exploit protection by using an MDM solution

The Policy configuration service provider (CSP) enables organizations to configure policies on Windows devices by using any MDM solution, not just Microsoft Intune. For more information, see Policy CSP.

Configure exploit protection by using the ExploitProtectionSettings CSP with the following settings:

OMA-URI path: ./Device/Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings
Data type: String
Value: The contents of your exploit protection XML file.

System-level settings require a device restart. App-level settings don't require a restart. For information about creating the XML file, see Import, export, and deploy exploit protection configurations.

Enable exploit protection by using Microsoft Configuration Manager

In Microsoft Configuration Manager, configure exploit protection in a Windows Defender Exploit Guard policy. For instructions, see Create and deploy an Exploit Guard policy.

When you create the policy, use these specific settings:

• Exploit Guard components: Select Exploit protection.
• Exploit protection XML: Select Browse, and then select the XML file that contains your system-level and app-level mitigation settings.

Enable exploit protection by using Group Policy

To configure exploit protection through Group Policy, follow these steps:

1. In a domain environment, open the Group Policy Management Console (GPMC) on your Group Policy management computer.

2. In the GPMC console tree, expand Group Policy Objects in the forest and domain that contain the Group Policy object (GPO) you want to edit.

3. Right-click the GPO, and then select Edit.

4. In the Group Policy Management Editor, go to Computer configuration > Administrative templates > Windows components > Microsoft Defender Exploit Guard > Exploit Protection.

   Note

   Group Policy paths before Windows 10, version 2004 (May 2020) might use Windows Defender Exploit Guard instead of Microsoft Defender Exploit Guard. Both names refer to the same policy location.

5. In the Exploit Protection details pane, open the Use a common set of exploit protection settings setting by using one of the following methods:

   • Double-click the setting.
   • Right-click the setting, and then select Edit.
   • Select the setting, and then select Action > Edit.

6. In the setting window that opens, configure the following options:

   1. Select Enabled.
   2. In the Options section, enter the local path, Universal Naming Convention (UNC) path, or URL of the exploit protection XML file.

   When you're finished, select OK.

Configure exploit protection by using PowerShell

Use the Get-ProcessMitigation and Set-ProcessMitigation cmdlets to review and configure exploit protection mitigations. The cmdlets require an elevated PowerShell session, which is a PowerShell window opened by selecting Run as administrator.

For guidance about configuring individual mitigations, see Configure and audit exploit protection mitigations.

• Process mitigations:

  • To review the mitigation policy stored in the registry for a specific executable name, use the following syntax:

    Get-ProcessMitigation -Name <ProcessPathAndFilename.exe>
    

    For example:

    Get-ProcessMitigation -Name testing.exe
    

    Add the RunningProcesses parameter to retrieve the current settings from running instances of the executable. Mitigations that haven't been configured have the status value NOTSET, which means that Windows applies the system-level value.

  • To configure mitigations for a specific process, use the following syntax:

    Set-ProcessMitigation -Name <ProcessPathAndFilename.exe> [-Remove] <-Enable | -Disable> Mitigation1,Mitigation2,...MitigationN
    

    This example enables data execution prevention (DEP) with ATL thunk emulation and blocks child-process creation for the specified process:

    Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP,EmulateAtlThunks,DisallowChildProcessCreation
    

    To disable the same mitigations for the specified app, use -Disable instead of -Enable.

  • This example removes an app-specific DEP override and restores the system-level value:

    Set-Processmitigation -Name c:\apps\lob\tests\testing.exe -Remove -Disable DEP
    

• System-level mitigations:

  • To review the process mitigations configured at the system level, use the following syntax:

    Get-ProcessMitigation -System
    

    The status value NOTSET means that Windows applies the default value for the mitigation.

    You can view the default value for each system-level mitigation in the Windows Security app.

  • To enable or disable mitigations at the system level, use the following syntax:

    Set-Processmitigation -System [-Remove] <-Enable | -Disable> Mitigation1,Mitigation2,...MitigationN
    

    This example enables DEP at the system level:

    Set-Processmitigation -System -Enable DEP
    

    To disable a mitigation, use -Disable instead of -Enable.

  • This example removes the system-level DEP override and restores the default value:

    Set-ProcessMitigation -System -Remove -Disable DEP
    

Enable exploit protection by using the Windows Security app

You can use the Windows Security app on individual devices to configure exploit protection mitigations.

Use the following steps to configure exploit protection mitigations in the Windows Security app:

1. In the Windows security app on the device, go to App & browser control.
2. In the App & browser control pane, in the Exploit protection section, select Exploit protection settings.
3. The Exploit protection pane that opens has two tabs:

   • Program settings tab: Choose the app you want to apply mitigations to.

     • If the app you want to configure is already listed, select it, and then select Edit.
     • If the app isn't listed, select Add program to customize at the top of the tab and then choose how you want to add the app:
       • Select Add by program name to have the mitigation applied to any running process with that name. Specify a filename and file extension (test.exe) or a full path to the file (c:\test\test.exe) to limit the mitigation to that specific file. When you're finished, select Add.
       • Select Choose exact file path to find and select the file.

     A Program settings: <app> window opens with the mitigations that can be applied. Select Override system settings, and then configure the individual settings available for the mitigation. If the mitigation supports audit mode, select Audit only to evaluate the mitigation without enforcing it.

     

     When you're finished, select Apply. You're notified if you need to restart the process or app, or if you need to restart Windows.

     Repeat the app-level configuration for all the apps and mitigations you want to configure.

   • System settings tab: Find the mitigation you want to configure, and then specify one of the following settings. Apps without an app-specific override for a mitigation use the corresponding system-level setting.

     • On by default: The mitigation is enabled for apps that don't have an app-specific override.
     • Off by default: The mitigation is disabled for apps that don't have an app-specific override.
     • Use default (On | Off): The mitigation is either enabled or disabled, depending on the default configuration that's set by Windows. The default value On or Off is specified after the Use default label for each mitigation.

     Repeat the system-level configuration for all the mitigations you want to configure. Select Apply when you're finished.

For each mitigation, the configuration on the Program settings tab takes precedence only when Override system settings is selected. If Override system settings isn't selected, the app uses the configuration on the System settings tab. If the system-level configuration is Use default (On | Off), the Windows default shown in parentheses applies.

Customize exploit protection notifications

For information about customizing the notification when a rule is triggered and an app or file is blocked, see Windows Security.

Remove exploit protection mitigations

To reset (undo or remove) exploit protection mitigations, see Reset or remove exploit protection mitigations.

Related content

• Evaluate exploit protection
• Configure and audit exploit protection mitigations
• Import, export, and deploy exploit protection configurations