Windows Defender Network Protection Registry Key

This article explains the specific Windows Registry key and values used to configure and manage Microsoft Defender Network Protection. You will learn the exact registry path, the specific DWORD value responsible for filtering behavior, and the state values required to enable, disable, or audit this security feature on Windows systems.

Registry Location and Value

The behavior of Windows Defender Network Protection filtering is managed under the following registry path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection

Within this key, the filtering behavior is controlled by a 32-bit DWORD value named:

EnableNetworkProtection

Configuration Values

The EnableNetworkProtection DWORD can be set to one of the following numeric values depending on the desired operating mode:

• 0 (Disabled): Turns off Network Protection entirely. Network traffic will not be filtered or blocked by Defender Exploit Guard.
• 1 (Block Mode / Enabled): Fully enables Network Protection. Users and applications are prevented from connecting to malicious domains, phishing sites, and untrusted IP addresses.
• 2 (Audit Mode): Enables Network Protection in test mode. Connections to malicious sites are allowed, but the events are recorded in the Windows Event Log (under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational, Event ID 1126).

How to Configure Network Protection via Regedit

1. Press Windows Key + R, type regedit, and press Enter to open the Registry Editor.

2. Navigate to the following path:

   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

3. If the subkeys do not exist, right-click Windows Defender, select New > Key, and name it Windows Defender Exploit Guard.

4. Right-click Windows Defender Exploit Guard, select New > Key, and name it Network Protection.

5. Select the Network Protection folder, right-click in the right pane, and choose New > DWORD (32-bit) Value.

6. Name the new value EnableNetworkProtection.

7. Double-click EnableNetworkProtection, set the Base to Hexadecimal, and enter 0, 1, or 2 in the Value data field.

8. Click OK and restart the computer or restart the Windows Defender service to apply the changes.