# Maximizing Windows Defender Protection

> Maximize your Windows Defender protection! In this article, we'll explore the configuration I use to enhance the capabilities of Windows Defender and its various modules.

Published on 2023-09-01 | Updated on 2025-01-12 | Tags: windows defender, hardening

https://xsec.fr/en/defensive/windows-defender-hardening/

---

import Callout from '@shared/components/Callout.astro'
import { Steps, Step } from '@/components/ui/steps'
import { Collapsible } from '@shared/components/ui/collapsible'

Windows Defender is the **native** security **organ** of Windows **distributions**. Often considered "ineffective," its true potential is poorly understood. What can be criticized about Defender, however, is that its **default** protection is somewhat too **minimal** on machines.

This is entirely understandable, since, as usual, Windows needs to be: backward-compatible and cater to as many use cases as possible. That’s why Windows has deemed the basic configuration appropriate for everyone. As we all know, **users rarely explore the settings.**

**The more advanced the system's security, the greater the risk of encountering user-blocking elements.** This is a constant balance that all IT staff play with continuously.

<Callout title="Computing changes" variant="danger">
It's important to note that computing constantly changes, with systems having lifecycles, vulnerabilities, and updates. These elements can create instabilities and require significant maintenance.
</Callout>

The following diagram summarizes IT security in general. Throughout this tutorial, it will be up to you to define your "security level" based on your needs and accept the potential consequences! That's why **it's imperative to back up your data before any action.**

![Source: vmware.com](/media/defensive/maximiser_protection_windows_defender/conveniancevssec.webp)

<Callout title="Restore point" variant="danger">
Create a Windows restore point first! This will allow you to return to a previous state in case of a problem.
</Callout>

<Collapsible client:load title="How to do it?">

<Steps>
<Step title="Search for 'Create a restore point'">
Search for "Create a restore point" in the Windows Start menu.

   ![](/media/defensive/maximiser_protection_windows_defender/pointderestauration.png)

</Step>
<Step title="Click on Create">
Click on Create.

   ![](/media/defensive/maximiser_protection_windows_defender/creer.png)

</Step>
<Step title="Name and create the restore point">
Name and create the restore point.

   ![](/media/defensive/maximiser_protection_windows_defender/nom.png)

</Step>
<Step title="Restore point creation in progress...">
Restore point creation in progress...

   ![](/media/defensive/maximiser_protection_windows_defender/progressbar.png)

</Step>
<Step title="Close the window">
Close the window.

   ![](/media/defensive/maximiser_protection_windows_defender/finished.png)

</Step>
</Steps>
</Collapsible>

## Paranoid Setup

This configuration significantly increases the resource usage (CPU/RAM) of the machine.
You need a valid **Windows 10/11 Professional** or higher copy to follow this procedure.

Go to **"Group Policy Objects"** from the Start menu, for example, then to `Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus`. All the configurations presented are within this object hierarchy. The **"Enabled"** items are to be activated manually by following the screenshots below.

Under the **"MAPS"** section:

![Microsoft's antivirus products and services (MAPS)](/media/defensive/maximiser_protection_windows_defender/MAPS.png)

![Block at first Sight](/media/defensive/maximiser_protection_windows_defender/blockatfirst.png)

![Send all samples](/media/defensive/maximiser_protection_windows_defender/sendallsamples.png)

Under the **"MpEngine"** section:

![Cloud Protection Level](/media/defensive/maximiser_protection_windows_defender/cloudprotectionlevel.png)

![Extended Cloud Check](/media/defensive/maximiser_protection_windows_defender/extendeddcloudcheck.png)

Under the **"Real-Time Protection"** section:

![](/media/defensive/maximiser_protection_windows_defender/realtimeprotection.png)

Under the **"Scan"** section:

![](/media/defensive/maximiser_protection_windows_defender/scan.png)

Under the **"Security Intelligence Update"** section:

![](/media/defensive/maximiser_protection_windows_defender/intelupdates.png)