Detections
Analytics

18.10.42.8.1 Ensure 'Convert warn verdict to block' is set to 'Enabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting controls whether Microsoft Defender Antivirus network protection will display a warning, or block network traffic.

The recommended state for this setting is: Enabled.

Potentially suspicious network traffic should be blocked until it has been reviewed, and an exception has been granted.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled :

Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Network Inspection System\Convert warn verdict to block

Note: This Group Policy path is provided by the Group Policy template WindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates (or newer).

Impact:

Legitimate network traffic could be blocked by Microsoft Defender Antivirus network protection.

See Also

https://workbench.cisecurity.org/benchmarks/25733

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3, CSCv7|8.1

Plugin: Windows

Control ID: 768dbc9195ed06557bfc0ceec6a42bba2aaa10774c80f3c8127b8b2467798735