Has anyone noticed that the Windows Defender Network Protection component (part of Exploit Guard) can be REALLY aggressive? Sometimes, in order to use a program, app or else, I need to set it to "Disabled" (even if it's only in "Audit" mode, it can slow down the connection by A LOT, if it doesn't timeout before).

Is there any way to add exceptions to that component? Like, do not filter websites if they are part of the Intranet, or add custom URLs, IPs, domains, etc. to ignore? I researched it for a bit, and it looks like you have 2 options: Block or Disable (because putting it in "Audit" mode has the same effect as "Block" since the connections will still go through it, it's just that they won't be explicitely blocked if they are malicious).

Thank you.

  • @Moab This article is for the ASR component (which is also part of Exploit Guard). Exploit Guard has 4 components: ASR, Controlled Folder Access, Anti-Exploit and Network Protection. There are no options in the Network Protection tab in SCCM, or the GPOs section of Network Protection to address exclusions. – Aura Jan 24 at 20:52
  • Strange, there seems to be no provision for exclusions to Network Protection. Absolutely nothing mentioned in the documentation and nothing in the user interface. – harrymc Jan 24 at 21:20

Forgot about this question.

For anyone reading it, apparently, the whitelist/blacklist functionnality is only available in MDATP (Microsoft Defender Advanced Threat Protection), which requires a Windows 10 E5 licence (at least) to access. This comes from a Microsoft Support Engineer I worked with and to who I asked about this.

So as of today, the only options for Network Protection is Windows Defender via SCCM, PowerShell, GPO and Intune is: Block (Enabled), Audit (Enabled) and Disable (Disabled).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.