How to Turn On or Off Windows Defender Block Suspicious Behaviors in Windows 10
Starting with Windows 10 build 17704, you can enable a new protection setting, Block suspicious behaviors, which brings the Windows Defender Exploit Guard attack surface reduction technology to all users.
You can turn on Block suspicious behaviors to prevent behavior by an app or file that might infect your device.
This tutorial will show you how to turn on or off the Block suspicious behaviors feature of Windows Defender Exploit Guard attack surface reduction for all users in Windows 10.
You must be signed in as an administrator to turn on or off "Block suspicious behaviors".
Note
From Microsoft:
Thank you everyone who has given us feedback on the “Block Suspicious Behaviors” feature that was recently added to Windows Security. For the time being we’re removing it from the build while we work on addressing some of the things you shared with us.
Announcing Windows 10 Insider Preview Build 17730 - Windows Experience Blog
Here's How:
1. Open Windows Security, and click/tap on the Virus & threat protection icon. (see screenshot below)
2. Click/tap on the Manage settings link under Virus & threat protection settings. (see screenshot below)
3. Turn on or off (default) Block suspicious behaviors for what you want. (see screenshot below)
This setting is stored in the ASR registry key below, but requires you to change the owner to Administrators, and set permissions to "Allow" Administrators "Full Control" before being able to modify the DWORD value below.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR
EnableASRConsumers DWORD
0 = Off
1 = On
4. If prompted by UAC, click/tap on Yes to approve.
5. You can now close Windows Security if you like.
That's it,
Shawn
Related Tutorials
- How to Turn On or Off Microsoft Defender Antivirus in Windows 10
- How to Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 10
- How to Enable or Disable Windows Defender Block at First Sight in Windows 10
- How to Enable or Disable Windows Defender Exploit Guard Controlled Folder Access in Windows 10
- How to Add or Remove Exclusions for Windows Defender in Windows 10
- How to Turn On or Off Windows Defender Antivirus Enhanced Notifications in Windows 10
Turn On Windows Defender Block Suspicious Behaviors in Windows 10
-
-
-
New #3
Build 17713, "Block Suspicious Behaviors" check to enable still not sticking when activated and the NOTE in the tutorial also no longer appears to be work with noted build to solve the check not sticking.
-
New #4
Hello Reidel,
I'm seeing the same issue in my build 17713 for it not showing correctly as on/off in Windows Security app.
The DWORD in the note box under step 3 will confirm whether it is actually turned on or off though.
-
New #5
The DWORD is set to 0 and I cannot get the process you suggested in the "NOTE" portion of the tutorial to work. Two attached screen shoots will show the before and after attempts to change the Permissions necessary for access to the DWORD change.
Access is denied. (Note-Protected folder in Defender is turned off)
-
-
New #7
True, but REGEDIT will not allow me to change the Administrator to full control, see the pop up box, "Unable to save permission changes on ASR"
Note, does not matter whether the toggle is set to on or off in Windows Security, Administrative permission of ASR cannot be accomplished in REGEDIT.
-
New #8
Correct. The registry key is protected and will not allow you to change the DWORD by default.
You would have to change the owner of the ASR registry key to "Administrators" first to be able to set its permissions to "Allow" "Administrators" "Full control". Afterwards, you should be able to modify the DWORD.
-
New #9
Thanks, I've come to the conclusion just to wait on using Windows Security to "Block Suspicious Behaviors" at this time. Pretty obvious Microsoft has not completed the development of this feature. Most likely similar effect can be found using gpedit/Administrative templates/ and then enabling Block at First Site and Behavior Monitoring within Defender settings. No regediting necessary. Hey it's just Insider.
Turn On Windows Defender Block Suspicious Behaviors in Windows 10
How to Turn On or Off Windows Defender Block Suspicious Behaviors in Windows 10Published by Shawn BrinkCategory: Security System
23 Jun 2020
Quote
Related Discussions
