Use advanced protection against ransomware
Download ADMXThis rule provides an extra layer of protection against ransomware. It uses both client and cloud heuristics to determine whether a file resembles ransomware. This rule doesn't block files that have one or more of the following characteristics: - The file has already been found to be unharmful in the Microsoft cloud. - The file is a valid signed file. - The file is prevalent enough to not be considered as ransomware. You must enable cloud-delivered protection to use this rule.
Policy Details
- Policy Name
- ExploitGuard_ASR_Rules_Ransomware
- Registry Key
- Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
- Supported On
- At least Windows Server 2016, Windows 10 Version 1803
Configuration Elements
ASR rule modes: Not configured or Disable: The state in which the ASR rule isn't enabled. Block: The state in which the ASR rule is enabled. Audit: The state in which the ASR rule is evaluated for the effect it would have on the organization or environment if enabled (set to block or warn). Warn: The state in which the ASR rule is enabled and presents a notification to the end-user, but permits the end-user to bypass the block.
Mode:
Type: enum
- 0 Disabled
- 2 Audit
- 6 Warn
- 1 Block