Enable Network Protection Block Mode with Regedit

This article explains how to enable Microsoft Defender Network Protection in block mode using the Windows Registry Editor (Regedit). Network Protection expands the scope of Microsoft Defender SmartScreen to block outbound HTTP and HTTPS traffic destined for malicious domains, phishing sites, and host exploits. Configuring this setting through the registry ensures that all network activity on the device adheres to Defender’s threat intelligence, actively blocking connections to untrusted domains.

Prerequisites

• Administrative privileges on the Windows device.
• Microsoft Defender Antivirus enabled as the primary antivirus solution.
• Real-time protection turned on.

Step-by-Step Instructions

1. Open Registry Editor

1. Press Windows Key + R to open the Run dialog box.
2. Type regedit and press Enter or click OK.
3. When prompted by User Account Control (UAC), click Yes to grant administrative permissions.

2. Navigate to the Policy Key

Navigate to the following registry path using the left sidebar, or copy and paste it directly into the Registry Editor address bar:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection

Note: If the Windows Defender Exploit Guard or Network Protection keys do not exist, you must create them: 1. Right-click on Windows Defender > New > Key, and name it Windows Defender Exploit Guard. 2. Right-click on Windows Defender Exploit Guard > New > **Key, and name itNetwork Protection`.

3. Create or Modify the EnableNetworkProtection Value

1. Select the Network Protection folder in the left pane.
2. In the right pane, look for a value named EnableNetworkProtection.
3. If it does not exist, right-click any empty space in the right pane, select New > DWORD (32-bit) Value, and name it EnableNetworkProtection.
4. Double-click the EnableNetworkProtection entry.
5. In the Value data field, enter 1.
6. Ensure the Base is set to Hexadecimal, then click OK.

Registry Value Reference

• 0: Disabled (Off)
• 1: Enabled (Block Mode)
• 2: Audit Mode (Logs events without blocking traffic)

4. Apply Changes

1. Close the Registry Editor.

2. Restart your computer or run the following command in an elevated Command Prompt to force policy updates:

   gpupdate /force

How to Verify the Setting

To verify that Network Protection is running in block mode:

1. Right-click the Start button and select Terminal (Admin) or PowerShell (Admin).

2. Run the following command:

   Get-MpPreference | Select-Object EnableNetworkProtection

3. If the output returns 1, Network Protection is successfully enabled in block mode.