ADMX Viewer
Microsoft.Policies.WindowsDefender• Machine

Configure Remote Encryption Protection Mode

Set the mode for Remote Encryption Protection in Microsoft Defender Antivirus, which can detect and block attempts to replace local files with encrypted versions from another device. Supported settings: * 0 - Not configured or Default: Apply defaults, which can vary depending on the antivirus engine version and the platform * 1 - Block: Prevent suspicious and malicious behaviors * 2 - Audit: Generate EDR detections without blocking * 4 - Off: Feature is off with no performance impact

Policy Details

Policy Name
Remediation_BNB_REP_RemoteEncryptionProtection_ConfiguredState
Registry Key
Software\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Remote Encryption Protection
Value Name
RemoteEncryptionProtectionConfiguredState
Supported On
At least Windows Server 2016, Windows 10 Version 1607
Available Languages
en-us

Configuration Elements

Specify the state of Remote Encryption Protection

Type: enum

Allowed Values
  • 0 Default
  • 1 Block
  • 2 Audit
  • 4 Off