0

Has anyone noticed that the Windows Defender Network Protection component (part of Exploit Guard) can be REALLY aggressive? Sometimes, in order to use a program, app or else, I need to set it to "Disabled" (even if it's only in "Audit" mode, it can slow down the connection by A LOT, if it doesn't timeout before).

Is there any way to add exceptions to that component? Like, do not filter websites if they are part of the Intranet, or add custom URLs, IPs, domains, etc. to ignore? I researched it for a bit, and it looks like you have 2 options: Block or Disable (because putting it in "Audit" mode has the same effect as "Block" since the connections will still go through it, it's just that they won't be explicitely blocked if they are malicious).

Thank you.

3
  • See this page...docs.microsoft.com/en-us/windows/security/threat-protection/…
    – Moab
    Jan 24, 2019 at 20:41
  • @Moab This article is for the ASR component (which is also part of Exploit Guard). Exploit Guard has 4 components: ASR, Controlled Folder Access, Anti-Exploit and Network Protection. There are no options in the Network Protection tab in SCCM, or the GPOs section of Network Protection to address exclusions.
    – Aura
    Jan 24, 2019 at 20:52
  • Strange, there seems to be no provision for exclusions to Network Protection. Absolutely nothing mentioned in the documentation and nothing in the user interface.
    – harrymc
    Jan 24, 2019 at 21:20

1 Answer 1

1

Forgot about this question.

For anyone reading it, apparently, the whitelist/blacklist functionnality is only available in MDATP (Microsoft Defender Advanced Threat Protection), which requires a Windows 10 E5 licence (at least) to access. This comes from a Microsoft Support Engineer I worked with and to who I asked about this.

So as of today, the only options for Network Protection is Windows Defender via SCCM, PowerShell, GPO and Intune is: Block (Enabled), Audit (Enabled) and Disable (Disabled).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .