Configure Defender Cloud Protection Registry Key

This article outlines how to configure the Windows Defender cloud-delivered protection blocking levels using the Windows Registry. It specifically covers the exact registry keys, values, and parameters required to manage how Microsoft Defender Antivirus inspects and blocks suspicious files using cloud metadata in real time.

Registry Key for Cloud-Delivered Protection Metadata Blocks

The primary registry key responsible for managing the cloud-delivered metadata blocking sensitivity in Microsoft Defender is the MpEngine key located under the policy hive:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine

Inside this key, the specific DWORD (32-bit) value that dictates cloud-delivered blocking behavior is:

MpCloudBlockLevel Configuration Values

The MpCloudBlockLevel value determines how aggressively Defender blocks suspected threats based on metadata retrieved from the Microsoft cloud:

Value (DWORD) Blocking Level Description
0 Default Standard cloud blocking behavior using standard metadata matching.
1 Moderate Applies moderate cloud blocking for suspicious files.
2 High Aggressively blocks unknown or suspicious files while analyzing metadata.
4 High+ Applies High protection and additional protection measures (may cause false positives).
6 Zero Tolerance Blocks all unknown executables and files until metadata confirms safety.

Supporting Registry Key: Spynet

For cloud metadata blocking to function properly, Cloud-delivered Protection must be enabled under the Spynet key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet

Ensure the following values are configured:

Applying the Settings via Command Line

You can configure the metadata blocking level directly via an elevated Command Prompt:

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v MpCloudBlockLevel /t REG_DWORD /d 2 /f

(Note: Replace 2 with your desired protection level from the table above.)