Detections
Analytics

18.10.42.11.1.1.1 Ensure 'Configure Brute-Force Protection aggressiveness' is set to 'Enabled: Medium' or higher

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting configures whether Brute-Force Protection in Microsoft Defender Antivirus is enabled. Brute-force protection can detect and block attempts to forcibly sign in to a system.

The recommended state for this setting is: Enabled: Medium . Configuring this setting to Enabled: High also conforms to the benchmark.

This feature can help reduce the likelihood of a successful brute force attack.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: Medium or Enabled: High :

Computer Configuration\Policies\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Brute-Force Protection\Configure Brute-Force Protection aggressiveness

Note: This Group Policy path is provided by the Group Policy template WindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates (or newer).

Impact:

Some legitimate authentication attempts may be blocked. When set to Medium, blocks will occur when the confidence level is above 99%. When set to High, blocks will occur when confidence level is above 90%.

See Also

https://workbench.cisecurity.org/benchmarks/25733

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3, CSCv7|8.1

Plugin: Windows

Control ID: 0f942ed1bafde59672e527f7c7af12721ad1ba3e27418cbce749b8975e6650d1