Microsoft Defender Antivirus: Enterprise Settings for Cloud, Tamper, PUA and Exclusions

Microsoft Defender Antivirus is built into every supported Windows release, and how well it protects a fleet depends on a small set of customer-side settings: cloud protection, the cloud block level, tamper protection, PUA protection, its running mode and the exclusion lists. This guide covers those engine settings for managed organisations using Intune, Group Policy, Configuration Manager or PowerShell, with the exact setting names, event IDs to monitor and a rollout order. It is for endpoint engineers and security operations teams. The EDR and investigation side is covered in the Microsoft Defender for Endpoint Guide, and home users should read the Microsoft Defender Antivirus for Home Users Guide.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

• Keep cloud protection on, then raise the block level. Microsoft states cloud protection is on by default and that tamper protection, Block at First Sight, emergency signature updates, EDR in block mode and some ASR rules depend on it; High is a sensible fleet level once tested.
• Tamper protection is the control that keeps the others on. With it enabled, registry changes to Defender settings are blocked and exclusions cannot be modified or added locally, and blocked changes are logged as event 5013.
• Know the running mode of every device. In passive mode, cloud protection, network protection, ASR rules, controlled folder access and PUA protection do not work, so a device that silently dropped to passive has far less protection than its policy suggests.
• Exclusions are the biggest self-inflicted gap. Microsoft's list of exclusion mistakes starts with root folders, temp paths, process names such as powershell.exe and file types such as .ps1 and .dll.
• Move PUA from audit to block. Many onboarded devices default to audit; switch to block after reviewing event 1160 detections for a few weeks.

How identity and access work in Microsoft Defender Antivirus

Defender Antivirus has no sign-in of its own. Who can change it is decided by Windows local rights and by whichever management plane owns the device.

• Local administrators: can change settings in the Windows Security app or with Set-MpPreference, unless tamper protection or central policy prevents it. On unmanaged devices, the Windows Security app is the only way to turn tamper protection on, and it needs local admin rights.
• Management planes: Intune endpoint security antivirus policies, Group Policy (Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus), Configuration Manager, and the Microsoft Defender portal for tamper protection. Pick one owner per setting; mixed sources produce conflicts that are hard to trace.
• Local admin rights are the real attack path: malware or an intruder with admin rights tries to switch off protection (MITRE ATT&CK T1685 Disable or Modify Tools). Removing standing local admin and turning on tamper protection close most of that path. See the Windows LAPS Guide for managing local administrator passwords.

Admin roles and privileged access

Treat these as privileged roles: require phishing-resistant MFA and just-in-time activation for the Defender portal and Intune roles that can switch off tamper protection or add exclusions, and alert on policy changes. Intune and the portal show tamper protection as Not applicable until a device is onboarded to Defender for Endpoint.

Integrations, API tokens and service accounts

• Other antivirus products: on Windows 10 and 11, a non-Microsoft antivirus puts Defender into passive mode only when the device is onboarded to Defender for Endpoint; without onboarding Defender is disabled automatically. If the Windows Security Center service (wscsvc) is disabled, Defender cannot see the other product, which Microsoft calls unsupported.
• Windows Server: Defender does not enter passive mode automatically. Set ForceDefenderPassiveMode (REG_DWORD 1 under HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection) before onboarding. On platform 4.18.2208.0 and later with tamper protection, an onboarded server can move to active mode but not back to passive.
• Service and backup accounts: requests for exclusions usually arrive with backup agents, database engines and build servers. Tie each exclusion to the application owner and its service account, and review it when the application changes. See the Service Account Security Guide.
• Automation: scripts and RMM tools that call Set-MpPreference need admin rights on every endpoint. Keep them in the central management plane rather than granting a tool account broad local admin.

Logging and detection

Events are written to Microsoft-Windows-Windows Defender/Operational. Forward at least these to your SIEM.

On onboarded devices, hunt for ActionType == "TamperingAttempt" in the DeviceEvents table and for detections whose ThreatName starts with PUA:. Check running mode with Get-MpComputerStatus and the AMRunningMode property (Normal, Passive or EDR Block Mode). Metrics worth reporting: percentage of devices in the intended mode; percentage with tamper protection on; signature age above 3 days; count of exclusions per device group, trending down; event 5013 and 5001 counts per week; PUA block rate after cutover. See the EDR Tampering and BYOVD Response Playbook for response steps.

Hardening baseline

Cloud block levels, as Microsoft describes them: Not configured (default blocking), High (aggressively blocks unknown files, more false positives), High plus (more protection measures, possible performance cost) and Zero tolerance (blocks all unknown executables). Configuration Manager calls these Normal, High, High with extra protection and Block unknown programs.

Offline scan: Microsoft Defender Offline boots into a trusted environment outside the running Windows kernel to find rootkits and boot-sector malware. Use it after an outbreak or when Defender prompts. It runs from Windows Security, with Start-MpWDOScan, or through WMI; it needs Defender as the primary antivirus, local admin rights and the Windows Recovery Environment enabled (check with reagentc /info), and BitLocker should be suspended first. Microsoft lists it for x64 and x86 Windows client editions; ARM devices and Windows Server SKUs are outside that list. Event 2030 confirms it is queued for the next reboot.

Rollout order:

1. Inventory running mode, tamper protection state and signature age across the fleet.
2. Confirm cloud protection and sample submission are on everywhere; fix network access to the cloud service.
3. Turn on tamper protection tenant-wide or by Intune policy, starting with a pilot ring; document how to use troubleshooting mode.
4. Set PUA to audit, review event 1160 for two to four weeks, then block.
5. Raise the cloud block level to High in a pilot ring, watch false positives, then widen. Roll back by returning the policy to Not configured.
6. Review every exclusion against Microsoft's mistakes list and replace broad entries with full paths or contextual exclusions.

Choosing the running mode and management plane

Higher cloud block levels trade false positives for protection. Use High plus or Zero tolerance for rings where users rarely install new software, such as kiosks, servers with fixed workloads or privileged access workstations, and keep developer and engineering rings at High with a fast false-positive submission route. Submit misdetected files to Microsoft and suppress the alert before reaching for an exclusion, as Microsoft's exclusions overview advises.

Common misconfigurations

• Broad or risky exclusions: excluding C:\, C:\Users\*, C:\Windows\Temp\*, process names such as powershell.exe, cmd.exe or wscript.exe, or file types such as .exe, .dll, .ps1 and .zip. Use full paths, split lists per workload (IIS and SQL Server separately), and remember process exclusions also stop network protection and ASR rules inspecting that process. Antivirus exclusions do not apply to EDR. See the EDR Tuning and Exclusions Management Guide.
• Local lists merging with central policy: set the Group Policy option "Configure local administrator merge behavior for lists" so local admins cannot add their own exclusions, and let tamper protection protect managed exclusion lists.
• Unexpected passive or disabled mode: a leftover third-party agent, or a client that is not onboarded, leaves Defender passive or disabled. Report AMRunningMode and remove abandoned products.
• Turning off services in passive mode: Microsoft says not to stop or modify WinDefend, MsMpEng, Sense, wscsvc or SecurityHealthService, and not to turn off real-time or cloud protection when using passive mode or EDR in block mode.
• Policy that appears to apply but does not: with tamper protection on, Group Policy changes to protected settings can look successful while being blocked. Check event 5013 and manage protected settings through Intune or the portal.
• Sample submission set to Always Prompt or Never send: Microsoft notes both lower the device's protection state.

Practitioner checklist

• Report AMRunningMode for every device and fix any that are not in the intended mode.
• Confirm cloud protection and safe sample submission are on fleet-wide.
• Set the cloud block level to High after a pilot; use higher levels only for tested rings.
• Turn on tamper protection for all onboarded devices and document troubleshooting mode use.
• Move PUA protection from audit to block, and turn on SmartScreenPuaEnabled in Edge.
• Remove broad, temp-path, process-name and file-type exclusions; replace with full-path or contextual ones with an owner.
• Stop local exclusion lists merging with central policy.
• Forward Defender Operational events, alerting on 1119, 2001, 5001, 5007, 5010, 5012 and 5013.
• Restrict and monitor the Intune and Defender portal roles that can change tamper protection or exclusions.
• Keep the offline scan procedure, including WinRE and BitLocker steps, in the incident runbook.

Standards and references

• Microsoft Learn: Microsoft Defender Antivirus compatibility with other security products
• Microsoft Learn: Specify the cloud protection level
• Microsoft Learn: Protect security settings with tamper protection
• Microsoft Learn: Detect and block potentially unwanted applications
• Microsoft Learn: Common mistakes to avoid when defining exclusions
• Microsoft Learn: Exclusions overview
• Microsoft Learn: Run and review the results of a Microsoft Defender Offline scan
• Microsoft Learn: Microsoft Defender Antivirus event IDs and error codes

Related NHI Mgmt Group resources: Microsoft Defender for Endpoint Guide · EDR Tuning and Exclusions Management Guide · Microsoft Intune Guide · Group Policy Security Guide · Next-Generation Antivirus (NGAV) Guide