skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

configuring-windows-defender-advanced-settings

Configures Microsoft Defender for Endpoint ASR rules, controlled folder access, network protection, and exploit protection.

954|172|Updated Mar 13, 2026
Search Tags:#endpoint security#powerShell#intune#MDE#asr rules#windows defender#ransomware protection
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill configuring-windows-defender-advanced-settings
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: configuring-windows-defender-advanced-settings
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/endpoint-security/configuring-windows-defender-advanced-settings
Command: npx skills add https://github.com/xalgord/xalgorix --skill configuring-windows-defender-advanced-settings

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Default Microsoft Defender settings leave endpoints exposed to common attack techniques like LSASS credential dumping, malicious Office macros, and ransomware. This Skill guides you through hardening Windows endpoints with advanced Defender for Endpoint protections and verifying they actually block attacks.

Core Features & Use Cases

  • Attack Surface Reduction Rules: Deploy ASR rules in Block mode via PowerShell, Intune, or Group Policy to stop credential theft, Office child processes, and obfuscated scripts.
  • Ransomware and Network Protection: Enable Controlled Folder Access and Network Protection with proper audit-mode rollout and exclusions.
  • Exploit and Cloud Protection: Configure per-application mitigations (DEP, CFG, SEHOP), cloud-delivered protection, and Block at First Sight.
  • Use Case: A security engineer needs to meet compliance requirements across a Windows fleet. Use this Skill to deploy ASR rules in audit mode, validate with Atomic Red Team tests, then enforce Block mode via Intune.

Quick Start

Configure Microsoft Defender ASR rules in block mode on my Windows endpoints and verify the LSASS protection rule triggers with an atomic test.

Frequently Asked Questions about configuring-windows-defender-advanced-settings

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable ASR rules in Microsoft Defender?▼

Enable ASR rules with Set-MpPreference by specifying the rule GUID and an action value: 1 for Block, 2 for Audit, 0 for Disabled. For enterprise deployment, create an Attack Surface Reduction profile in Intune under Endpoint Security.

How to configure Controlled Folder Access for ransomware protection?▼

Enable Controlled Folder Access with Set-MpPreference -EnableControlledFolderAccess Enabled, then add custom protected folders and allowed applications. Start in AuditMode and review Event ID 1124 to identify legitimate apps needing exclusions.

Should I deploy ASR rules in audit mode or block mode first?▼

Deploy ASR rules in Audit mode first and monitor for 2-4 weeks, since some rules cause false positives with legitimate Office macros and admin scripts. Review Event ID 1122 detections before switching rules to Block mode.

Does Microsoft Defender work alongside third-party antivirus?▼

Defender enters passive mode when a third-party AV is present, disabling real-time protection. You can run Defender in EDR-only mode for endpoint detection while keeping the third-party AV, or remove the other AV to restore full Defender functionality.

Why is tamper protection important for Defender settings?▼

Without tamper protection, malware or insiders can disable Defender via PowerShell commands like Set-MpPreference -DisableRealtimeMonitoring. Enable tamper protection through the Microsoft 365 Defender portal under Settings, Endpoints, Advanced features.

How do I verify ASR rules are actually blocking attacks?▼

Run an Atomic Red Team test such as T1003.001 for LSASS dumping and confirm Event ID 1121 (block) appears in the Windows Defender Operational log, not just Event ID 1122 (audit). Also check Advanced Hunting for AsrLsassCredentialTheftBlocked DeviceEvents.

Related Skills

Explore More Software Engineering Skills→
tomztomz

azure-security

Provide Azure security hardening guidance for identity, access, secrets, and policy enforcement.

Community
Advanced
NCLGISANCLGISA

microsoft-defender

Manage Microsoft Defender XDR, Endpoint, and Sentinel security operations.

Official
Advanced
AcczdyAcczdy
2

executing-red-team-exercise

Plan red-team exercises by mapping adversary techniques to actionable tasks.

Community
Intermediate
rjonhaasrjonhaas
1

EDR Telemetry & Live Hunt Collections

Analyze EDR exports and Velociraptor ZIPs to extract suspicious processes and persistence signals.

Community
Advanced