Microsoft je najavio novi sigurnosni centar za Windows Defender počevši od Windows 10 v1703 i to olakšava prebacivanje sigurnosnih postavki za naša računala. Prema zadanim postavkama, Windows Defender je postavljen na način niske zaštite jer će nam to olakšati život nametanjem manje ograničenja, ali IT administratori mogu omogućiti zaštitu u oblaku^{(Cloud Protection)} i promijeniti ove postavke grupnih pravila^{(Group Policy)} – Konfiguriraj Blok^{(Configure Block)} na prvi pogled^{(First Sight)} , Konfiguriraj^(Configure) nadjačavanje lokalnih postavki za izvješćivanje , i pridružite se Microsoft MAPS^{(Join Microsoft MAPS)} -u ( Microsoft Advanced Protection Service ) ili SpyNetu^(SpyNet) , za postavljanjeWindows Defender Antivirus blokira zaštitu na najvišim razinama.

^{(Harden Windows Defender)}Pojačajte zaštitu Windows Defendera u sustavu Windows 10^{(Windows 10)}

Pokrenite gpedit.msc da otvorite uređivač grupnih pravila^{(Group Policy Editor)} i idite na sljedeći put:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Maps

Ovdje ćete vidjeti 4 postavke:

• Pridružite se Microsoft kartama
• Konfigurirajte značajku Blokiraj^(Block) na prvi pogled^{(First Sight)}
• Konfigurirajte^(Configure) nadjačavanje lokalnih postavki za izvješćivanje u Microsoft MAPS
• Pošaljite^(Send) uzorke datoteka kada je potrebna daljnja analiza.

Postavke Windows Defendera možete konfigurirati prema svojim zahtjevima.

1] Pridružite se Microsoft kartama

Da biste se pridružili usluzi Microsoft Advanced Protection Service ^{(Microsoft Advanced Protection Service)}, dvaput kliknite na Pridruži se Microsoft kartama^{(Join Microsoft Maps)} . U okviru Svojstva^(Properties) koji se otvori odaberite " Omogućeno^(Enabled) ".

This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you.

Ovdje imate 3 opcije – Onemogućeno^(Disabled) , Osnovno^(Basic) članstvo i Napredno^(Advanced) članstvo.

2] Konfigurirajte^{(Configure Block)} značajku Blokiraj na prvi pogled^{(First Sight)}

Nakon što se pridružite MAPS -u, možete dvaput kliknuti 0n Blok na prvi pogled^{(Block at First Sight)} i odabrati Omogućeno u njegovom okviru Svojstva^(Properties) .

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device.

Ova značajka zahtijeva da se ove postavke grupnih pravila^{(Group Policy)} postave na sljedeći način: Pridruži se Microsoft MAPS^{(Join Microsoft MAPS)} -u mora biti omogućeno, polje Pošalji uzorke datoteka kada je potrebna daljnja analiza^{(Send file samples when further analysis is required)} treba biti postavljeno na Pošalji sigurne uzorke^{(Send safe samples)} ili Pošalji sve uzorke^{(Send all samples)} , pravilo Skeniraj sve preuzete datoteke i privitke^{(Scan all downloaded files and attachments)} mora biti omogućena i politika Isključi zaštitu u stvarnom vremenu^{(Turn off real-time protection)} NE bi trebala biti omogućena.

3] Konfigurirajte^(Configure) nadjačavanje lokalnih postavki za izvješćivanje u Microsoft MAPS

Postavka Konfiguriraj nadjačavanje lokalne postavke za izvješćivanje u Microsoft MAPS^{(Configure local setting override for reporting to Microsoft MAPS)} omogućit će korisnicima da imaju prednost u odnosu na Pravila grupe,^{(Group Policy)} čime će im na kraju omogućiti da istu nadjačaju.

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy.

Morate ga dvaput kliknuti i odabrati Omogućeno u okviru Svojstva^(Properties) koji se otvara. Nakon što je ova značajka omogućena, pokrenut će provjere u stvarnom vremenu i odlučit će hoće li dopustiti pokretanje sadržaja ili ne.

4] Pošaljite^(Send) uzorke datoteka kada je potrebna daljnja analiza

Postavka Pošalji uzorke datoteke kada je potrebna daljnja analiza^{(Send file samples when further analysis is required)} omogućit će vam da automatski pošaljete sve uzorke Microsoftu^(Microsoft) na daljnju analizu.

This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. The possible options are: Always prompt, Send safe samples automatically, Never send and Send all samples automatically.

Morate ga dvaput kliknuti i odabrati Omogućeno u okviru Svojstva^(Properties) koji se otvara.

Nakon što ste to učinili, možete prijeći na postavljanje razine zaštite u oblaku za Windows Defender.^{(Having done this, you can move on to set the Cloud protection level for Windows Defender.)}

5] Odaberite^{(Select Cloud Protection)} razinu zaštite u oblaku u Windows Defenderu^{(Windows Defender)}

Razina zaštite oblaka također se može omogućiti korištenjem grupnih pravila^{(Group Policy)} posjetom sljedećeg puta:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MpEngine

U desnom oknu vidjet ćete Odaberi razinu zaštite^{(Select protection level)} . Dvaput kliknite na njega da biste otvorili njegov okvir Svojstva^(Properties) , a zatim odaberite Omogućeno^(Enabled) . Vidjet ćete dvije ponuđene opcije:

1. Zadana razina blokiranja antivirusnog programa Windows Defender^{(Windows Defender Antivirus)}
2. Visoka razina blokiranja

Odaberite Visoka razina blokiranja^{(High blocking level)} i kliknite na Primijeni.

This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency.

Pročitajte^(Read) : Kako omogućiti i konfigurirati zaštitu od Ransomware-a u Windows Defenderu^{(Ransomware Protection in Windows Defender)} .

6] Konfigurirajte proširenu provjeru oblaka

Pod postavkama MpEngine također ćete vidjeti  postavku Konfiguriraj proširenu provjeru oblaka^{(Configure extended cloud check)} . Ako želite, možete također omogućiti ovu postavku

This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it’s safe. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds.

SAVJET^(TIP) : Neka vas Windows Defender zaštiti i od potencijalno neželjenih programa^{(Make Windows Defender protect you against Potentially Unwanted Programs too)} .

7 ] Omogućite^{(] Enable)} i postavite razinu zaštite u oblaku na ^{(Cloud Protection)}Visoku^(High) pomoću Registra^(Registry)

Ako ste korisnik Windows 10 Home , tada možete koristiti Windows Registry i podesiti neke postavke. Da biste to učinili, upišite regedit.exe u Start Search i pritisnite Enter da otvorite uređivač registra^{(Registry Editor)} . Sada idite do sljedeće tipke:

HKEY_LOCAL_Machine\Software\Policies\Microsoft\Windows Defender

Na lijevoj strani, desnom tipkom miša kliknite Windows Defender, odaberite Novo > Ključ i nazovite ključ Spynet . Desnom tipkom miša kliknite Spynet i ponovno odaberite New > Dword (32-bit) i nazovite ga SpynetReporting. Postavite njegovu vrijednost na 2 da biste je postavili na naprednu razinu.

Sada ponovno desnom tipkom miša kliknite tipku Windows Defender koja se pojavljuje na lijevoj strani i odaberite New > Key . Ovaj put nazovite ključ kao MpEngine . Zatim desnom tipkom miša kliknite tipku MpEngine i odaberite New > Dword (32-bitna) vrijednost. Imenujte ključ kao MpCloudBlockLevel i dajte mu vrijednost 2 da biste ga postavili na visoku razinu bloka.

Alati koji vam mogu pomoći:^{(Tools that may help you:)}

1. ConfigureDefender vam pomaže da trenutačno promijenite sigurnosne postavke sustava Windows^{(Windows Security)}
2. Alat WinDefThreatsView^{(WinDefThreatsView)} omogućuje postavljanje zadanih radnji za prijetnje Windows Defendera .^{(Windows Defender)}

Harden Windows Defender protection to the highest levels on Windows 10

Microsоft announсed a new Windows Defender Securіty Center starting from the Windows 10 v1703 and this makes it easier to toggle the security settings for our PCs. By default, Windows Defender is set in a low protection mode since this will make our lives easy by imposing fewer restrictions, but IT administrators can enable Cloud Protection and change these Group Policy settings – Configure Block at First Sight, Configure local setting override for reporting, and Join Microsoft MAPS (Microsoft Advanced Protection Service) or SpyNet, to set Windows Defender Antivirus blocking protection to highest levels.

Harden Windows Defender protection in Windows 10

Run gpedit.msc to open the Group Policy Editor and navigate to the following path:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Maps

Here you will see 4 settings:

• Join Microsoft Maps
• Configure Block at First Sight feature
• Configure local setting override for reporting to Microsoft MAPS
• Send file samples when further analysis is required.

You can configure Windows Defender settings according to your requirements.

1] Join Microsoft Maps

To join Microsoft Advanced Protection Service, double-click on Join Microsoft Maps. In the Properties box which opens, select “Enabled.”

This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you.

You have 3 options here – Disabled, Basic membership and Advanced membership.

2] Configure Block at First Sight feature

After joining MAPS, you can double-click 0n Block at First Sight and select Enabled in its Properties box..

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device.

This feature requires these Group Policy settings to be set as follows: Join Microsoft MAPS must be enabled, the Send file samples when further analysis is required should be set to Send safe samples or Send all samples, the Scan all downloaded files and attachments policy must be enabled and the Turn off real-time protection policy should NOT be enabled.

3] Configure local setting override for reporting to Microsoft MAPS

The Configure local setting override for reporting to Microsoft MAPS setting will let users take precedence over the Group Policy thus eventually allowing them to override the same.

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy.

You need to double-click on it and select Enabled in the Properties box which opens. Once this feature is enabled it will run checks in real-time and will decide on whether to allow the content to run or not.

4] Send file samples when further analysis is required

The Send file samples when further analysis is required setting will let you send all the samples automatically to Microsoft for further analysis.

This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. The possible options are: Always prompt, Send safe samples automatically, Never send and Send all samples automatically.

You need to double-click on it and select Enabled in the Properties box which opens.

Having done this, you can move on to set the Cloud protection level for Windows Defender.

5] Select Cloud Protection level in Windows Defender

The cloud protection level too can be enabled by using the Group Policy by visiting the following path:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MpEngine

In the right pane, you will see Select protection level. Double-click on it to open its Properties box and then choose Enabled. You will see two options offered:

1. Default Windows Defender Antivirus blocking level
2. High blocking level

Select High blocking level and click on Apply.

This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency.

Read: How to enable and configure Ransomware Protection in Windows Defender.

6] Configure extended cloud check

Under the MpEngine settings, you will also see a Configure extended cloud check setting. If you wish, you may also Enable this setting

This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it’s safe. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds.

TIP: Make Windows Defender protect you against Potentially Unwanted Programs too.

7] Enable & set Cloud Protection level to High using Registry

If you are a user of Windows 10 Home, then you can use the Windows Registry and tweak some settings. To do this, type regedit.exe in Start Search and hit Enter to open the Registry Editor. Now navigate to the following key:

HKEY_LOCAL_Machine\Software\Policies\Microsoft\Windows Defender

In the left side, right-click on Windows Defender, select New > Key and name the key Spynet. Right-click on Spynet and again select New > Dword (32-bit) and name it SpynetReporting. Set its value to 2 to set it at Advanced level.

Now, again right-click on the Windows Defender key which appears on the left side and select New > Key. This time name the key as MpEngine. Next right-click on the MpEngine key and select New > Dword (32-bit) value. Name the key as MpCloudBlockLevel and give it a value of 2 to set it at High block level.

Tools that may help you:

1. ConfigureDefender helps you change Windows Security settings instantly
2. WinDefThreatsView tool lets you set default actions for Windows Defender threats.

Related posts

• Što je Control Flow Guard u sustavu Windows 10 - kako ga uključiti ili isključiti

• Pogreška 0x800106ba, Windows Defender aplikacija nije uspjela inicijalizirati

• Vaš IT administrator je onemogućio Windows sigurnost

• Gdje se pohranjuju zapisnici izvanmrežnog skeniranja sustava Windows Defender?

• Omogućite i konfigurirajte zaštitu od Ransomware-a u Windows Defenderu

• Kako omogućiti mrežno skeniranje u Windows Defenderu u sustavu Windows 11/10

• Što je zaštita računa u sustavu Windows 11/10 i kako sakriti ovaj odjeljak

• Kako omogućiti periodično skeniranje Windows Defendera u sustavu Windows 11/10

• Popravak Ne može se uključiti Windows Defender

• Kako ručno ažurirati Windows Defender u sustavu Windows 10

• Apple iCloud ne radi zbog blokade Windows Defendera

• Što su Family Options u sustavu Windows 10 i kako sakriti ovaj odjeljak

• Popravite uslugu Threat Service u Windows Defenderu

• Konfigurirajte Microsoft Defender za skeniranje .zip .rar .cab datoteka u sustavu Windows 11/10

• Kako otvoriti Windows sigurnosni centar u sustavu Windows 11/10

• Što je kontrola aplikacija i preglednika u sustavu Windows 10 i kako je sakriti

• Spriječite korisnike da mijenjaju zaštitu od iskorištavanja u Windows Security

• Uklonite ikonu obavijesti Windows Defender u sustavu Windows 10

• Uključite ili isključite postavke zaštite temeljene na reputaciji u sustavu Windows 11/10

• Što je WDAGUtilityAccount u sustavu Windows 11/10? Trebam li ga izbrisati?