Its important that Windows devices are abiding by endpoint protection schemes now that so many more people are working remotely. It can also be hard to enforce standards around removable devices.
That’s why we use the following to ensure the proper configurations are in place for Windows Defender (see comments for details on each item):
#To enable real-time monitoring:
Set-MpPreference -DisableRealtimeMonitoring $false
#Making sure to catch removable USB drives as scan-able:
Set-MpPreference -DisableRemovableDriveScanning $false
#Making sure that email scanning (attachments) is enabled
Set-MpPreference -DisableEmailScanning $false
#Disable the scan of network files, which can cause issues remotely
Set-MpPreference -DisableScanningNetworkFiles $false
#Making sure to scan scripts as well
Set-MpPreference -DisableScriptScanning $false
#Make it so that before a scan runs Defender checks for new/the latest threat signatures
Set-MpPreference -CheckForSignaturesBeforeRunningScan $true
Feel free to comment out the ones you don’t want for your threat model 🙂
