Detections
Analytics

18.10.43.11.1.1.1 (L2) Ensure 'Configure Brute-Force Protection aggressiveness' is set to 'Enabled: Medium' or higher

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting configures whether Brute-Force Protection in Microsoft Defender Antivirus is enabled. Brute-force protection can detect and block attempts to forcibly sign in to a system.

The recommended state for this setting is: Enabled: Medium . Configuring this setting to High also conforms to the benchmark.

This feature can help reduce the likelihood of a successful brute force attack.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: Medium or higher:

 Computer Configuration\Policies\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Brute-Force Protection\Configure Brute-Force Protection aggressiveness

 Note: This Group Policy path is provided by the Group Policy template WindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates (or newer).

Impact:

Some legitimate authentication attempts may be blocked. When set to Medium, blocks will occur when the confidence level is above 99%. When set to High, blocks will occur when confidence level is above 90%.

See Also

https://workbench.cisecurity.org/benchmarks/22481

Item Details

References: CSCv7|8.1

Plugin: Windows

Control ID: 959b4786bfcc8e4c9a9d9e0556781fc6166dd5e1cd6f3998c1f380b83d3affbd