When it comes to defining a correct malware protection strategy,
at times the configuration can become daunting.
You may be wondering, what should I enable?
What do I need to look out for?
How do I protect certain things?
And so forth.
Fortunately,
we have Microsoft Defender Antivirus as the default malware
protection platform on Windows Server.
By making use of Microsoft Defender Antivirus,
we can really enhance the protection of our server,
and we can use a Group Policy to further configure and enforce
the protections across all of our servers.
So I have gone and created a Group Policy called Malware Protection.
Let's go ahead and modify this Group Policy,
where we're going to go and actually configure various settings that
we need to have in order to protect our servers.
So I've opened up my Group Policy Editor,
and in order to configure Microsoft Defender Antivirus,
we need to expand Computer Configuration,
Policies, Administrative Templates, Windows Components,
and as you scroll down, you will find Microsoft Defender Antivirus.
Now as you can see,
there are a lot of configuration items that you can actually
configure and enforce from a Group Policy perspective.
All right,
so before we dive into the different categories of the configuration items,
let's look at the first batch of settings that we have available right here.
The first thing that I'm going to look at is the ability to
turn off Microsoft Defender Antivirus.
Now in order to understand the settings is that if I enable this,
it means that if another antivirus program is installed,
Microsoft Defender Antivirus will essentially be disabled,
allowing the third‑party antivirus to take priority.
However, if I set this to Disabled,
it means that irrespective of which antivirus software is installed,
Microsoft Defender Antivirus will continue to run.
So I'm going to go ahead and disable this and click on OK.
The next configuration item that I'm going to leverage is the
detection for potentially unwanted applications.
Now, if you think about your servers,
essentially you wouldn't want any type of unwanted
applications to be run on your server.
So I'm going to go ahead and enable this policy,
and I can either set it to Audit Mode,
if I wanted to gain insight into the various types of
applications that have been installed; however,
I can also set it to Block mode.
So depending on how you configure your servers,
if it's a new server, you could initially block any unwanted applications,
or if it's a server that you already have in production,
you may want to run it in audit mode as a start.
So I'm going to set it to Block and I'll click on OK.
All right, so the next batch of settings that I'm going to look at is MAPS.
MAPS relates to Microsoft Active Protection Service.
So within the MAPS configuration, there are a few things that we can configure,
the first being the Block at First Sight feature.
The way this feature works is that if you get some type of new
malware that is seen in your enterprise,
the first machine that sees it will send telemetry data to Microsoft Cloud,
allowing the next batch of machines to automatically block that malware.
So, I'm going to turn this on.
The next configuration item that I want to leverage is the ability
for Defender to actually communicate with MAPS.
So I'll enable this, and then under the Join MAPS configuration,
I'm going to set this to Advanced.
Now you can read about the differences between the two in
the help section on the right‑hand side.
Another good configuration option to set is the ability to send
file samples to Microsoft for further analysis.
Now, there are a few options that you can do.
You can either set it to prompt, never send,
or just automatically send all samples.
You can also set it to send safe samples automatically.
So,
you might need to look at what you want to set this up as
because there could be some compliance issues,
depending on your country's regulations and so forth,
in the event that any type of sample that gets sent
actually might contain personal data.
So for the sake of the demonstration, I'm going to set this to Always prompt.
All right,
so the next section that we have is the Microsoft Defender Exploit Guard.
Now within Exploit Guard, you can configure Attack Surface Reduction rules,
Controlled Folder Access, and Network Protection.
We'll start with Attack Surface Reduction rules.
Now essentially these reduction rules are a defined set of rules that
can be deployed to your servers where Microsoft Defender Antivirus will
actually govern the actions of the rules.
Now when you go into the configuration setting,
there is a bit of a caveat because it's not very straightforward.
So you can enable it,
but you need to go and set the state for each of these rules.
You need to know the name of the rule and the value that it should be set as.
Now the value name is actually the GUID of the rule,
and the value that you would need to set is either a 1 or a 0,
turning it on or off.
The link on your screen will take you to the reference guide for the
various type of Attack Surface Reduction rules that you can use as a
reference to populate this Group Policy.
So to give you an example of how to configure this,
I'm going to use the GUID for a rule which relates to the block
execution of potentially obfuscated scripts,
and I'm going to give it a value of one.
So as you work through the reference guide,
you will be able to populate this list with additional Attack
Surface Reduction rules that you would like to use.
Now in conjunction with the Attack Surface Reduction rules,
you can also define paths that you would like to exclude,
and this relates to files as well.
So for example,
if you know that you've got an application which will
trigger an Attack Surface Reduction rule,
then you can go ahead and exclude it from that specific rule.
All right, so moving onto Controlled Folder Access,
this is where you can actually define that you would
like Microsoft Defender to protect.
This is a good way to protect different types of folders against any type
of ransomware that might try to encrypt that folder.
And then as you move to network protection,
you have network protection capabilities where you can prevent
users and apps from accessing dangerous websites.
So that's one of the settings that I'm actually going to enable,
and I can again set this to Block, or I can audit the actions.
The next component that we need to look at is the MpEngine.
Now here, we can actually set our cloud protection level.
So when I go into the cloud protection level setting and enable this,
we have a number of different blocking levels.
Now, as you look under help on the right‑hand side,
you'll see what the possible options are and how
aggressive the blocking would be.
So you could either set this to be very aggressive or moderately aggressive.
So I'm going to go and leave this as the default for now, and apply.
So looking at the Real‑time Protection, now essentially,
when you've got a malware protection solution,
essentially you would not want anyone or any
application to turn off the protection, especially on your servers.
And,
you would also like to hard code different types of actions
that this Real‑time Protection would take.
So for example, if we look at Turn on script scanning,
on a server you generally might run different types of scripts.
Now,
you would like to ensure that those scripts are actually scanned
by Defender to ensure that it's not malicious.
Another option that you can look at is turning off the
possibility to turn off real protection.
Now it sounds like a bit of a tongue twister,
but essentially what you are doing is disabling the
ability to turn off Real‑time Protection.
And then you can also go ahead and enable scanning for
all downloaded files and attachments.
Now by hard coding this on the Group Policy,
Defender for Antivirus will actually go and perform these actions.
Now another component that you can also look at is the scan functionality.
Now here there are a number of different
configuration items that you can work with,
but for example, if you think of a server,
sometimes you would plug in a removable drive.
So you can actually go ahead and hard code the ability to scan any type of
removable drive when it is inserted into the server.
Now as I conclude this video,
there has been a number of settings which I have not focused on,
and of course, if we had to go through every single setting,
this video would be pretty long.
So I encourage you to take a look at the more
information section of this course,
where I have a link to a dedicated course that looks at
protecting your endpoints with Microsoft 365 Defender.
But as a side note,
remember that a lot of these configuration items are already set up
to offer the best protection in its default state.
By hard coding it in a Group Policy,
we are ensuring that those actions are actually hard coded,
and that that will be the action that will be taken, and that it cannot be modified.