Microsoft.Policies.WindowsDefender• Machine
Configure Remote Encryption Protection Mode
Set the mode for Remote Encryption Protection in Microsoft Defender Antivirus, which can detect and block attempts to replace local files with encrypted versions from another device. Supported settings: * 0 - Not configured or Default: Apply defaults, which can vary depending on the antivirus engine version and the platform * 1 - Block: Prevent suspicious and malicious behaviors * 2 - Audit: Generate EDR detections without blocking * 4 - Off: Feature is off with no performance impact
Policy Details
- Policy Name
- Remediation_BNB_REP_RemoteEncryptionProtection_ConfiguredState
- Registry Key
- Software\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Remote Encryption Protection
- Value Name
- RemoteEncryptionProtectionConfiguredState
- Supported On
- At least Windows Server 2016, Windows 10 Version 1607
- Available Languages
- en-us
Configuration Elements
Specify the state of Remote Encryption Protection
Type: enum
Allowed Values
- 0 Default
- 1 Block
- 2 Audit
- 4 Off