Spoločnosť Microsoft oznámila nové Centrum zabezpečenia programu Windows Defender počnúc systémom Windows 10 v1703^{(Windows 10 v1703)} , čo uľahčuje prepínanie nastavení zabezpečenia pre naše počítače. V predvolenom nastavení je program Windows Defender^{(Windows Defender)} nastavený v režime nízkej ochrany, pretože nám to uľahčí život zavedením menšieho počtu obmedzení, ale správcovia IT môžu povoliť ochranu v cloude^{(Cloud Protection)} a zmeniť tieto nastavenia skupinovej politiky^{(Group Policy)} – Konfigurovať blokovanie^{(Configure Block)} na prvý pohľad^{(First Sight)} , Konfigurovať^(Configure) prepísanie miestnych nastavení pre hlásenie a pripojte sa k Microsoft MAPS^{(Join Microsoft MAPS)} ( Microsoft Advanced Protection Service ) alebo SpyNet , aby ste mohli nastaviťWindows Defender Antivirus blokuje ochranu na najvyššej úrovni.

Posilnite ochranu programu Windows Defender^{(Harden Windows Defender)} v systéme Windows 10^{(Windows 10)}

Spustením gpedit.msc otvorte Editor^{(Group Policy Editor)} zásad skupiny a prejdite na nasledujúcu cestu:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Maps

Tu uvidíte 4 nastavenia:

• Pripojte sa k Microsoft Maps
• Konfigurácia funkcie Blok^(Block) na prvý pohľad^{(First Sight)}
• Nakonfigurujte^(Configure) prepísanie miestneho nastavenia pre podávanie správ do Microsoft MAPS
• Pošlite^(Send) vzorky súborov, keď je potrebná ďalšia analýza.

Nastavenia programu Windows Defender môžete nakonfigurovať podľa svojich požiadaviek.

1] Pripojte sa k Microsoft Maps

Ak sa chcete pripojiť k službe Microsoft Advanced Protection Service , dvakrát kliknite na Pripojiť sa k Microsoft Maps^{(Join Microsoft Maps)} . V okne Vlastnosti^(Properties) , ktoré sa otvorí, vyberte možnosť „ Povolené^(Enabled) “.

This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you.

Máte tu 3 možnosti – Vypnuté^(Disabled) , Základné^(Basic) členstvo a Pokročilé^(Advanced) členstvo.

2] Konfigurácia funkcie Blok^{(Configure Block)} na prvý pohľad^{(First Sight)}

Po pripojení k MAPS môžete dvakrát kliknúť na položku 0n Block at First Sight a vybrať možnosť Enabled v poli Vlastnosti .^(Properties)

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device.

Táto funkcia vyžaduje, aby boli tieto nastavenia skupinovej politiky^{(Group Policy)} nastavené nasledovne: Musí byť povolená možnosť Pripojiť sa k službe Microsoft MAPS , možnosť ^{(Join Microsoft MAPS)}Odoslať vzorky súborov, keď je potrebná ďalšia analýza^{(Send file samples when further analysis is required)} by mala byť nastavená na možnosť Odoslať bezpečné vzorky^{(Send safe samples)} alebo Odoslať všetky vzorky^{(Send all samples)} , zásada Kontrolovať všetky stiahnuté súbory a prílohy^{(Scan all downloaded files and attachments)} musí byť byť povolené a politika Vypnúť ochranu v reálnom čase^{(Turn off real-time protection)} NESMIE byť povolená.

3] Nakonfigurujte^(Configure) prepísanie miestneho nastavenia pre nahlasovanie do Microsoft MAPS

Nastavenie Konfigurovať lokálne nastavenie pre nahlasovanie do Microsoft MAPS^{(Configure local setting override for reporting to Microsoft MAPS)} umožní používateľom mať prednosť pred skupinovou politikou^{(Group Policy)} , čím im nakoniec umožní prepísať to isté.

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy.

Musíte naň dvakrát kliknúť a v okne Vlastnosti^(Properties) , ktoré sa otvorí, vyberte možnosť Povolené. Keď je táto funkcia povolená, spustí kontroly v reálnom čase a rozhodne, či povolí spustenie obsahu alebo nie.

4] V prípade potreby ďalšej analýzy odošlite^(Send) vzorky súborov

Nastavenie Odoslať vzorky súboru, keď je potrebná ďalšia analýza^{(Send file samples when further analysis is required)} vám umožní automaticky odoslať všetky vzorky spoločnosti Microsoft^(Microsoft) na ďalšiu analýzu.

This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. The possible options are: Always prompt, Send safe samples automatically, Never send and Send all samples automatically.

Musíte naň dvakrát kliknúť a v okne Vlastnosti^(Properties) , ktoré sa otvorí, vyberte možnosť Povolené.

Potom môžete prejsť na nastavenie úrovne cloudovej ochrany pre program Windows Defender.^{(Having done this, you can move on to set the Cloud protection level for Windows Defender.)}

5] Vyberte^{(Select Cloud Protection)} úroveň ochrany cloudu v programe Windows Defender^{(Windows Defender)}

Úroveň cloudovej ochrany je možné povoliť aj pomocou skupinovej politiky^{(Group Policy)} na nasledujúcej ceste:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MpEngine

V pravej časti okna uvidíte položku Vybrať úroveň ochrany^{(Select protection level)} . Dvojitým kliknutím naň otvorte jeho pole Vlastnosti^(Properties) a potom vyberte možnosť Povolené^(Enabled) . Uvidíte dve ponúkané možnosti:

1. Predvolená úroveň blokovania antivírusového programu Windows Defender^{(Windows Defender Antivirus)}
2. Vysoká úroveň blokovania

Vyberte Vysoká úroveň blokovania^{(High blocking level)} a kliknite na Použiť.

This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency.

Prečítajte si^(Read) : Ako povoliť a nakonfigurovať ochranu pred ransomvérom v programe Windows Defender^{(Ransomware Protection in Windows Defender)} .

6] Nakonfigurujte rozšírenú kontrolu cloudu

V nastaveniach MpEngine uvidíte^(MpEngine) aj nastavenie  Konfigurovať rozšírenú kontrolu cloudu^{(Configure extended cloud check)} . Ak chcete, môžete toto nastavenie tiež povoliť

This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it’s safe. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds.

TIP : Nechajte Windows Defender chrániť vás aj pred potenciálne nežiaducimi programami^{(Make Windows Defender protect you against Potentially Unwanted Programs too)} .

7 ] Povoľte^{(] Enable)} a nastavte úroveň ochrany cloudu na ^{(Cloud Protection)}Vysoká^(High) pomocou databázy Registry^(Registry)

Ak ste používateľom systému Windows 10 Home , môžete použiť register systému Windows^{(Windows Registry)} a upraviť niektoré nastavenia. Ak to chcete urobiť, zadajte príkaz regedit.exe^{(regedit.exe)} do poľa Spustiť vyhľadávanie^{(Start Search)} a stlačením klávesu Enter^(Enter) otvorte Editor databázy Registry^{(Registry Editor)} . Teraz prejdite na nasledujúci kľúč:

HKEY_LOCAL_Machine\Software\Policies\Microsoft\Windows Defender

Na ľavej strane kliknite pravým tlačidlom myši na Windows Defender, vyberte Nový > Kľúč a pomenujte kľúč Spynet . Kliknite pravým tlačidlom myši na Spynet a znova vyberte New > Dword (32-bit) a pomenujte ho SpynetReporting. Nastavte jej hodnotu na 2 , aby ste ju nastavili na pokročilú úroveň.

Teraz znova kliknite pravým tlačidlom myši na kláves Windows Defender , ktorý sa zobrazí na ľavej strane, a vyberte položku New > Key . Tentoraz pomenujte kľúč ako MpEngine . Potom kliknite pravým tlačidlom myši na kľúč MpEngine a vyberte New > Dword Hodnota Dword (32-bit). Pomenujte kľúč ako MpCloudBlockLevel a dajte mu hodnotu 2 , aby ste ho nastavili na vysokú úroveň bloku.

Nástroje, ktoré vám môžu pomôcť:^{(Tools that may help you:)}

1. ConfigureDefender vám pomôže okamžite zmeniť nastavenia zabezpečenia systému Windows^{(Windows Security)}
2. Nástroj WinDefThreatsView^{(WinDefThreatsView)} vám umožňuje nastaviť predvolené akcie pre hrozby programu Windows Defender .^{(Windows Defender)}

Harden Windows Defender protection to the highest levels on Windows 10

Microsoft announced a new Windows Defender Security Centеr ѕtarting from the Windows 10 v1703 and this makes it easier to toggle the security settings for our PCs. By default, Windows Defender is set in a low protection mode since this will make our lives easy by imposing fewer restrictions, but IT administrators can enable Cloud Protection and change these Group Policy settings – Configure Block at First Sight, Configure local setting override for reporting, and Join Microsoft MAPS (Microsoft Advanced Protection Service) or SpyNet, to set Windows Defender Antivirus blocking protection to highest levels.

Harden Windows Defender protection in Windows 10

Run gpedit.msc to open the Group Policy Editor and navigate to the following path:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Maps

Here you will see 4 settings:

• Join Microsoft Maps
• Configure Block at First Sight feature
• Configure local setting override for reporting to Microsoft MAPS
• Send file samples when further analysis is required.

You can configure Windows Defender settings according to your requirements.

1] Join Microsoft Maps

To join Microsoft Advanced Protection Service, double-click on Join Microsoft Maps. In the Properties box which opens, select “Enabled.”

This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you.

You have 3 options here – Disabled, Basic membership and Advanced membership.

2] Configure Block at First Sight feature

After joining MAPS, you can double-click 0n Block at First Sight and select Enabled in its Properties box..

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device.

This feature requires these Group Policy settings to be set as follows: Join Microsoft MAPS must be enabled, the Send file samples when further analysis is required should be set to Send safe samples or Send all samples, the Scan all downloaded files and attachments policy must be enabled and the Turn off real-time protection policy should NOT be enabled.

3] Configure local setting override for reporting to Microsoft MAPS

The Configure local setting override for reporting to Microsoft MAPS setting will let users take precedence over the Group Policy thus eventually allowing them to override the same.

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy.

You need to double-click on it and select Enabled in the Properties box which opens. Once this feature is enabled it will run checks in real-time and will decide on whether to allow the content to run or not.

4] Send file samples when further analysis is required

The Send file samples when further analysis is required setting will let you send all the samples automatically to Microsoft for further analysis.

This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. The possible options are: Always prompt, Send safe samples automatically, Never send and Send all samples automatically.

You need to double-click on it and select Enabled in the Properties box which opens.

Having done this, you can move on to set the Cloud protection level for Windows Defender.

5] Select Cloud Protection level in Windows Defender

The cloud protection level too can be enabled by using the Group Policy by visiting the following path:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MpEngine

In the right pane, you will see Select protection level. Double-click on it to open its Properties box and then choose Enabled. You will see two options offered:

1. Default Windows Defender Antivirus blocking level
2. High blocking level

Select High blocking level and click on Apply.

This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency.

Read: How to enable and configure Ransomware Protection in Windows Defender.

6] Configure extended cloud check

Under the MpEngine settings, you will also see a Configure extended cloud check setting. If you wish, you may also Enable this setting

This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it’s safe. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds.

TIP: Make Windows Defender protect you against Potentially Unwanted Programs too.

7] Enable & set Cloud Protection level to High using Registry

If you are a user of Windows 10 Home, then you can use the Windows Registry and tweak some settings. To do this, type regedit.exe in Start Search and hit Enter to open the Registry Editor. Now navigate to the following key:

HKEY_LOCAL_Machine\Software\Policies\Microsoft\Windows Defender

In the left side, right-click on Windows Defender, select New > Key and name the key Spynet. Right-click on Spynet and again select New > Dword (32-bit) and name it SpynetReporting. Set its value to 2 to set it at Advanced level.

Now, again right-click on the Windows Defender key which appears on the left side and select New > Key. This time name the key as MpEngine. Next right-click on the MpEngine key and select New > Dword (32-bit) value. Name the key as MpCloudBlockLevel and give it a value of 2 to set it at High block level.

Tools that may help you:

1. ConfigureDefender helps you change Windows Security settings instantly
2. WinDefThreatsView tool lets you set default actions for Windows Defender threats.

Related posts

• Čo je Control Flow Guard v systéme Windows 10 – ako ho zapnúť alebo vypnúť

• Chyba 0x800106ba, aplikáciu Windows Defender sa nepodarilo inicializovať

• Váš správca IT zakázal zabezpečenie systému Windows

• Kde sú uložené protokoly kontroly offline v programe Windows Defender?

• Povoľte a nakonfigurujte ochranu pred ransomvérom v programe Windows Defender

• Čo je ochrana pred vírusmi a hrozbami v systéme Windows? Ako to skryť?

• Zabráňte používateľom upravovať ochranu pred zneužitím v Zabezpečení systému Windows

• Oprava Nedá sa zapnúť program Windows Defender

• Nakonfigurujte program Microsoft Defender na skenovanie súborov .zip .rar .cab v systéme Windows 11/10

• Windows Defender sa nevypne; Nedá sa vypnúť program Windows Defender

• Povoľte ochranu potenciálne nechcených aplikácií v systéme Windows 11/10

• Odstráňte ikonu upozornenia programu Windows Defender v systéme Windows 10

• Službu nebolo možné spustiť, chyba 0x80070422 v programe Windows Defender

• Windows Defender sa v systéme Windows 11/10 neaktualizuje automaticky

• Opravte chybu programu Windows Defender 0x8007139f v systéme Windows 11/10

• Oprava Služba hrozieb sa v programe Windows Defender zastavila

• Okamžite zmeňte nastavenia zabezpečenia systému Windows pomocou programu ConfigureDefender

• Spravujte položky v karanténe, vylúčenia v programe Windows Defender

• Opravte chybu Windows Defender 0x800b0100 v systéme Windows 11/10

• Čo je ovládanie aplikácií a prehliadača v systéme Windows 10 a ako ho skryť