Turn on real-time protection
Description
This status indicates that Microsoft Defender Antivirus real-time protection is disabled.
Potential risk
Not having real-time protection enabled will cause important AV functionalities to not work.
Remediation options
Set the following Group Policy:
Computer Configuration\Administrative Templates\Windows Components\(Windows|Microsoft) Defender Antivirus\Real-time Protection\Turn off real-time protection
To one of the following values: Disabled or Not Configured
Enable scanning of removable drives during a full scan
Description
This setting controls whether or not to scan for malicious software and unwanted software in the contents of removable drives, such as USB flash drives, when running a full scan.
This security control is only applicable for machines with Windows 10, version 1709 or later.
Potential risk
Scanning removable drives is extremely important, as they are more likely to contain malicious software and files brought into the enterprise managed environment from an external, unmanaged environment.
Remediation options
Set the following Group Policy:
Computer Configuration\Policies\Administrative Templates\Windows Components\(Windows|Microsoft) Defender Antivirus\Scan\Scan removable drives
To the following value: Enabled
Enable Microsoft Defender Antivirus real-time behavior monitoring
Description
Determines whether Microsoft Defender Antivirus monitors file processes, file and registry changes, and other events on your endpoints for suspicious and known malicious activity.
Potential risk
Disabling behavior monitoring will reduce your ability to detect suspicious activity that could indicate a breach.
Remediation options
Set the following Group Policy:
Computer Configuration\Administrative Templates\Windows Components\(Windows|Microsoft) Defender Antivirus\Real-time Protection\Turn on behavior monitoring
To the following value: Enabled
Turn on PUA protection in block mode
Description
Enabling Potentially Unwanted Application (PUA) protection in block mode will block and automatically quarantine potentially unwanted applications. PUA protection blocking takes effect on endpoint clients after the next signature update or computer restart.
Potential risk
Not having PUA in Block mode enabled leaves your machines vulnerable to unwanted applications with potentially malicious behavior.
Remediation options
Enable PUA protection in Block mode using one of the methods described in this documentation.
Turn on Microsoft Defender Antivirus
Description
Determines whether Microsoft Defender Antivirus is configured to run and scan for malware and other potentially unwanted software.
Potential risk
Not having a current, updated antivirus product scanning each computer for malicious file activity exposes the organization to malware or other potentially unwanted software.
Remediation options
Ensure that Microsoft Defender Antivirus is enabled using one of the methods described here.
EireaNet 