0

Has anyone noticed that the Windows Defender Network Protection component (part of Exploit Guard) can be REALLY aggressive? Sometimes, in order to use a program, app or else, I need to set it to "Disabled" (even if it's only in "Audit" mode, it can slow down the connection by A LOT, if it doesn't timeout before).

Is there any way to add exceptions to that component? Like, do not filter websites if they are part of the Intranet, or add custom URLs, IPs, domains, etc. to ignore? I researched it for a bit, and it looks like you have 2 options: Block or Disable (because putting it in "Audit" mode has the same effect as "Block" since the connections will still go through it, it's just that they won't be explicitely blocked if they are malicious).

Thank you.

1

Forgot about this question.

For anyone reading it, apparently, the whitelist/blacklist functionnality is only available in MDATP (Microsoft Defender Advanced Threat Protection), which requires a Windows 10 E5 licence (at least) to access. This comes from a Microsoft Support Engineer I worked with and to who I asked about this.

So as of today, the only options for Network Protection is Windows Defender via SCCM, PowerShell, GPO and Intune is: Block (Enabled), Audit (Enabled) and Disable (Disabled).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.