Windows Defender Exploit Guard Registry Key Guide

This article provides an overview of the Windows Registry keys used to manage Windows Defender Exploit Guard settings. Exploit Guard is a suite of intrusion prevention capabilities in Windows that includes Attack Surface Reduction (ASR), Controlled Folder Access, Network Protection, and Exploit Protection. Administrators can configure, enforce, or audit these features directly through specific registry paths in the Windows Registry Editor (Regedit).

Primary Exploit Guard Policy Registry Key

The central registry path that manages policy configurations for Windows Defender Exploit Guard is:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard

Under this main key, settings are divided into dedicated sub-keys for each core protection feature.

Component Registry Keys

1. Exploit Protection

Exploit Protection manages system-level and application-level mitigations (such as DEP, ASLR, and SEHOP).

• Policy Path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Exploit Protection
• Configuration Setting:
  ExploitProtectionSettings (String / REG_SZ containing the XML representation or file path of the mitigation configuration).
• System Implementation Path:
  Individual process mitigations configured directly on the system are stored under:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

2. Attack Surface Reduction (ASR)

ASR rules prevent actions commonly used by malware, such as launching executable files from Office apps or scripts.

• Policy Path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR
• Rule Definitions:
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
  • Values within this key use specific rule GUIDs as the value name, and numeric data (0 = Disabled, 1 = Block, 2 = Audit) as the value data.

3. Controlled Folder Access

Controlled Folder Access protects critical directories from unauthorized modification by untrusted applications (ransomware mitigation).

• Policy Path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access
• Key Values:
  • EnableControlledFolderAccess (DWORD: 0 = Disabled, 1 = Enabled, 2 = Audit Mode, 3 = Block disk modification only)
  • ControlledFolderAccess_ProtectedFolders (Sub-key containing custom protected paths)
  • ControlledFolderAccess_AllowedApplications (Sub-key containing whitelisted executables)

4. Network Protection

Network Protection extends SmartScreen capabilities to block outbound HTTP/HTTPS traffic to malicious domains.

• Policy Path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection
• Key Value:
  • EnableNetworkProtection (DWORD: 0 = Disabled, 1 = Enabled, 2 = Audit Mode)

How to Access and Modify Settings in Regedit

1. Press Win + R, type regedit, and press Enter.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.
3. If Windows Defender Exploit Guard does not exist, right-click Windows Defender, select New > Key, and name it Windows Defender Exploit Guard.
4. Create the required component sub-keys and assign the appropriate DWORD (32-bit) or String values to apply configurations.