We'll start with exploit protection, and going further,
I want to define what an exploit is.
Look in the corner of my sides when I need to provide an attribution,
that's where I'll put it.
An exploit is a software tool designed to take advantage of
a vulnerability in a computer system, typically for malicious purposes,
such as installing malware or malicious software.
Now, let's not split hairs arguing over tool.
That's not really the point.
The exploit could be a script, it could be a binary application,
it's just the idea is if your Windows Server has an
unpatched vulnerability or weakness,
the idea is eventually somebody is going to see that and
develop some software that's the exploit that can open
that door a little bit wider, or in some cases,
a great deal wider, again for malicious purposes.
So obviously,
we want to keep our Windows Server production systems as
secure as possible to prevent against these exploits and to
close any vulnerability holes.
Now, of course,
we're not Windows engineers at Microsoft so we don't
have access to Windows source code.
Windows is not an open source operating system,
so it's on us as hybrid cloud administrators to take advantage of well,
tools that can help remediate some of these problems.
Now, Windows Defender Exploit Guard,
it replaces what Microsoft used to call EMET,
the Enhanced Mitigation Experience Toolkit,
and what Exploit Guard is, it's built into Windows Server and Windows Client.
It's a host‑based intrusion prevention solution that uses
Microsoft's Intelligent Security Graph, or ISG.
This is Microsoft's artificial intelligence backend where based on machine
learning models that Microsoft trains up I'm sure every day,
the engine there is able to look at traffic on your system,
particularly looking at the state of your hardware and the interaction
of hardware and software on your system and make a prediction whether
you may be subject to an attack right now.
So what Exploit Guard unlocks is it gives you some additional attack,
surface reduction, or ASR,
for Windows concerning a handful of what Microsoft is identified is the
most common hardware‑based malware attack vectors.
Now, for the AC‑801,
you don't need to know details about every single mitigation.
Just know that Exploit Guard has a preselected collection of
mitigations that if you need to disable them,
you can,
but they're meant to provide protection of your system at the hardware level.
Alright.
And specifically,
you configure Exploit Guard either on a host‑by‑host basis using the
security app or centrally you can use Group Policy. Again, that's a theme that we'll see throughout this course.