Microsoft annoncerede et nyt Windows Defender Security Center, der starter fra Windows 10 v1703, og dette gør det nemmere at skifte mellem sikkerhedsindstillingerne for vores pc'er. Som standard er Windows Defender indstillet i en lav beskyttelsestilstand, da dette vil gøre vores liv nemmere ved at pålægge færre begrænsninger, men it-administratorer kan aktivere Cloud Protection og ændre disse gruppepolitikindstillinger^{(Group Policy)} – Konfigurer blokering^{(Configure Block)} ved første blik^{(First Sight)} , Konfigurer^(Configure) tilsidesættelse af lokale indstillinger til rapportering , og Tilmeld dig Microsoft MAPS^{(Join Microsoft MAPS)} ( Microsoft Advanced Protection Service ) eller SpyNet for at indstilleWindows Defender Antivirus blokerende beskyttelse til højeste niveauer.

Hærd Windows Defender-^{(Harden Windows Defender)} beskyttelse i Windows 10

Kør gpedit.msc for at åbne Group Policy Editor og naviger til følgende sti:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Maps

Her vil du se 4 indstillinger:

• Tilmeld dig Microsoft Maps
• Konfigurer blok^(Block) ved første blik^{(First Sight)} -funktionen
• Konfigurer^(Configure) tilsidesættelse af lokale indstillinger for rapportering til Microsoft MAPS
• Send filprøver, når yderligere analyse er påkrævet.

Du kan konfigurere Windows Defender-indstillinger i henhold til dine krav.

1] Tilmeld dig Microsoft Maps

For at tilmelde dig Microsoft Advanced Protection Service skal^(,) du dobbeltklikke på Join Microsoft Maps . I boksen Egenskaber^(Properties) , der åbnes, skal du vælge " Aktiveret^(Enabled) ".

This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you.

Du har 3 muligheder her – Deaktiveret^(Disabled) , Grundlæggende^(Basic) medlemskab og Avanceret^(Advanced) medlemskab.

2] Konfigurer blok^{(Configure Block)} ved første blik^{(First Sight)} -funktionen

Når du har tilmeldt dig MAPS , kan du dobbeltklikke på 0n Bloker ved første blik^{(Block at First Sight)} og vælge Aktiveret i dens egenskabsboks^(Properties) .

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device.

Denne funktion kræver, at disse gruppepolitikindstillinger^{(Group Policy)} indstilles som følger: Deltag i Microsoft MAPS^{(Join Microsoft MAPS)} skal være aktiveret, Send filprøver, når yderligere analyse er påkrævet^{(Send file samples when further analysis is required)} , skal indstilles til Send sikre prøver^{(Send safe samples)} eller Send alle prøver^{(Send all samples)} , politikken Scan alle downloadede filer og vedhæftede filer^{(Scan all downloaded files and attachments)} skal være aktiveret, og politikken Slå fra realtidsbeskyttelse^{(Turn off real-time protection)} bør IKKE være aktiveret.

3] Konfigurer^(Configure) tilsidesættelse af lokale indstillinger for rapportering til Microsoft MAPS

Indstillingen Konfigurer lokal indstilling tilsidesættelse for rapportering til Microsoft MAPS^{(Configure local setting override for reporting to Microsoft MAPS)} giver brugerne forrang frem for gruppepolitikken,^{(Group Policy)} hvilket til sidst giver dem mulighed for at tilsidesætte den samme.

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy.

Du skal dobbeltklikke på den og vælge Aktiveret i boksen Egenskaber^(Properties) , som åbnes. Når denne funktion er aktiveret, vil den køre kontroller i realtid og beslutte, om indholdet skal køres eller ej.

4] Send filprøver, når yderligere analyse er påkrævet

Indstillingen Send filprøver, når yderligere analyse er påkrævet^{(Send file samples when further analysis is required)} , giver dig mulighed for automatisk at sende alle prøverne til Microsoft for yderligere analyse.

This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. The possible options are: Always prompt, Send safe samples automatically, Never send and Send all samples automatically.

Du skal dobbeltklikke på den og vælge Aktiveret i boksen Egenskaber^(Properties) , som åbnes.

Når du har gjort dette, kan du gå videre til at indstille skybeskyttelsesniveauet for Windows Defender.^{(Having done this, you can move on to set the Cloud protection level for Windows Defender.)}

5] Vælg Cloud Protection^{(Select Cloud Protection)} -niveau i Windows Defender

Skybeskyttelsesniveauet kan også aktiveres ved at bruge gruppepolitikken^{(Group Policy)} ved at besøge følgende sti:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MpEngine

I højre rude vil du se Vælg beskyttelsesniveau^{(Select protection level)} . Dobbeltklik på den for at åbne dens egenskabsboks^(Properties) , og vælg derefter Aktiveret^(Enabled) . Du vil se to muligheder:

1. Standard blokeringsniveau for Windows Defender Antivirus
2. Højt blokeringsniveau

Vælg Højt blokeringsniveau,^{(High blocking level)} og klik på Anvend.

This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency.

Læs^(Read) : Sådan aktiverer og konfigurerer du Ransomware-beskyttelse i Windows Defender^{(Ransomware Protection in Windows Defender)} .

6] Konfigurer udvidet skykontrol

Under MpEngine- indstillingerne vil du også se en  Konfigurer udvidet^{(Configure extended cloud check)} skykontrolindstilling . Hvis du ønsker det, kan du også aktivere denne indstilling

This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it’s safe. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds.

TIP : Få også Windows Defender til at beskytte dig mod potentielt uønskede programmer^{(Make Windows Defender protect you against Potentially Unwanted Programs too)} .

7 ] Aktiver^{(] Enable)} og indstil Cloud Protection -niveauet til Højt^(High) ved hjælp af registreringsdatabasen^(Registry)

Hvis du er en bruger af Windows 10 Home , så kan du bruge Windows-registreringsdatabasen^{(Windows Registry)} og justere nogle indstillinger. For at gøre dette skal du skrive regedit.exe i Start søgning^{(Start Search)} og trykke på Enter for at åbne registreringseditoren^{(Registry Editor)} . Naviger nu til følgende nøgle:

HKEY_LOCAL_Machine\Software\Policies\Microsoft\Windows Defender

I venstre side skal du højreklikke på Windows Defender, vælge Ny > Nøgle og navngive nøglen Spynet . Højreklik på Spynet og vælg igen New > Dword (32-bit) og navngiv det SpynetReporting. Indstil dens værdi til 2 for at indstille den til avanceret niveau.

Højreklik nu igen på Windows Defender - tasten, som vises i venstre side, og vælg New > Key . Denne gang navngive nøglen som MpEngine . Højreklik derefter på MpEngine - nøglen og vælg New > Dword -værdi (32-bit). Navngiv nøglen som MpCloudBlockLevel og giv den en værdi på 2 for at sætte den på Højt blokniveau.

Værktøjer, der kan hjælpe dig:^{(Tools that may help you:)}

1. ConfigureDefender hjælper dig med at ændre Windows-sikkerhedsindstillinger^{(Windows Security)} med det samme
2. WinDefThreatsView- værktøjet lader dig indstille standardhandlinger for Windows Defender - trusler.

Harden Windows Defender protection to the highest levels on Windows 10

Mіcrosoft announced a new Windows Dеfender Sеcurіty Center starting from the Windows 10 v1703 and this makes it easier to toggle the security settings for our PCs. By default, Windows Defender is set in a low protection mode since this will make our lives easy by imposing fewer restrictions, but IT administrators can enable Cloud Protection and change these Group Policy settings – Configure Block at First Sight, Configure local setting override for reporting, and Join Microsoft MAPS (Microsoft Advanced Protection Service) or SpyNet, to set Windows Defender Antivirus blocking protection to highest levels.

Harden Windows Defender protection in Windows 10

Run gpedit.msc to open the Group Policy Editor and navigate to the following path:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Maps

Here you will see 4 settings:

• Join Microsoft Maps
• Configure Block at First Sight feature
• Configure local setting override for reporting to Microsoft MAPS
• Send file samples when further analysis is required.

You can configure Windows Defender settings according to your requirements.

1] Join Microsoft Maps

To join Microsoft Advanced Protection Service, double-click on Join Microsoft Maps. In the Properties box which opens, select “Enabled.”

This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you.

You have 3 options here – Disabled, Basic membership and Advanced membership.

2] Configure Block at First Sight feature

After joining MAPS, you can double-click 0n Block at First Sight and select Enabled in its Properties box..

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device.

This feature requires these Group Policy settings to be set as follows: Join Microsoft MAPS must be enabled, the Send file samples when further analysis is required should be set to Send safe samples or Send all samples, the Scan all downloaded files and attachments policy must be enabled and the Turn off real-time protection policy should NOT be enabled.

3] Configure local setting override for reporting to Microsoft MAPS

The Configure local setting override for reporting to Microsoft MAPS setting will let users take precedence over the Group Policy thus eventually allowing them to override the same.

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy.

You need to double-click on it and select Enabled in the Properties box which opens. Once this feature is enabled it will run checks in real-time and will decide on whether to allow the content to run or not.

4] Send file samples when further analysis is required

The Send file samples when further analysis is required setting will let you send all the samples automatically to Microsoft for further analysis.

This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. The possible options are: Always prompt, Send safe samples automatically, Never send and Send all samples automatically.

You need to double-click on it and select Enabled in the Properties box which opens.

Having done this, you can move on to set the Cloud protection level for Windows Defender.

5] Select Cloud Protection level in Windows Defender

The cloud protection level too can be enabled by using the Group Policy by visiting the following path:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MpEngine

In the right pane, you will see Select protection level. Double-click on it to open its Properties box and then choose Enabled. You will see two options offered:

1. Default Windows Defender Antivirus blocking level
2. High blocking level

Select High blocking level and click on Apply.

This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency.

Read: How to enable and configure Ransomware Protection in Windows Defender.

6] Configure extended cloud check

Under the MpEngine settings, you will also see a Configure extended cloud check setting. If you wish, you may also Enable this setting

This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it’s safe. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds.

TIP: Make Windows Defender protect you against Potentially Unwanted Programs too.

7] Enable & set Cloud Protection level to High using Registry

If you are a user of Windows 10 Home, then you can use the Windows Registry and tweak some settings. To do this, type regedit.exe in Start Search and hit Enter to open the Registry Editor. Now navigate to the following key:

HKEY_LOCAL_Machine\Software\Policies\Microsoft\Windows Defender

In the left side, right-click on Windows Defender, select New > Key and name the key Spynet. Right-click on Spynet and again select New > Dword (32-bit) and name it SpynetReporting. Set its value to 2 to set it at Advanced level.

Now, again right-click on the Windows Defender key which appears on the left side and select New > Key. This time name the key as MpEngine. Next right-click on the MpEngine key and select New > Dword (32-bit) value. Name the key as MpCloudBlockLevel and give it a value of 2 to set it at High block level.

Tools that may help you:

1. ConfigureDefender helps you change Windows Security settings instantly
2. WinDefThreatsView tool lets you set default actions for Windows Defender threats.

Related posts

• Hvad er Control Flow Guard i Windows 10 - Sådan slår du den til eller fra

• Fejl 0x800106ba, Windows Defender-applikationen kunne ikke initialiseres

• Din it-administrator har deaktiveret Windows-sikkerhed

• Hvor er Windows Defender Offline scanningslogfiler gemt?

• Aktiver og konfigurer Ransomware Protection i Windows Defender

• Aktiver eller deaktiver kerneisolering og hukommelsesintegritet i Windows 11/10

• Skift Windows-sikkerhedsindstillinger øjeblikkeligt med ConfigureDefender

• WinDefThreatsView - Indstil standardhandlinger for Windows Defender-trusler

• Sådan aktiverer du periodisk scanning af Windows Defender i Windows 11/10

• Sådan udelukker du en mappe fra Windows Defender-scanning i Windows 11/10

• Hvad er WDAGUtilityAccount i Windows 11/10? Skal jeg slette den?

• Hvad er virus- og trusselsbeskyttelse i Windows? Hvordan skjuler man det?

• Tilføj et ekskluderingselement til Windows Defender-kontekstmenuen

• Opdater Windows Defender-definitioner ved hjælp af PowerShell

• Opdater Windows Defender, når Automatiske opdateringer er deaktiveret

• Fjern Windows Defender-meddelelsesikon i Windows 10

• Ret Windows Defender-fejl 0x8007139f på Windows 11/10

• Hvad er App & Browser Control i Windows 10, og hvordan man skjuler det

• Kan ikke aktivere Windows Defender i Windows 11/10

• Slå TIL eller FRA Omdømmebaserede beskyttelsesindstillinger i Windows 11/10