Detections
Analytics

18.10.43.11.1.1.1 (L2) Ensure 'Configure Brute-Force Protection aggressiveness' is set to 'Enabled: Medium' or higher

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting configures whether Brute-Force Protection in Microsoft Defender Antivirus is enabled. Brute-force protection can detect and block attempts to forcibly sign in to a system.

The recommended state for this setting is: Enabled: Medium . Configuring this setting to High also conforms to the benchmark.

This feature can help reduce the likelihood of a successful brute force attack.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: Medium or higher:

Computer Configuration\Policies\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Brute-Force Protection\Configure Brute-Force Protection aggressiveness

Note: This Group Policy path is provided by the Group Policy template WindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates (or newer).

Impact:

Some legitimate authentication attempts may be blocked. When set to Medium, blocks will occur when the confidence level is above 99%. When set to High, blocks will occur when confidence level is above 90%.

See Also

https://workbench.cisecurity.org/benchmarks/24135

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3, CSCv7|8.1

Plugin: Windows

Control ID: 8591792985056a9af64d49fe426a01d7f7b5d2c391a58a857769034f8133229d