Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Customize exploit protection

4 September 2026Doc update+21 / −18 lines

In brief

The article updates Windows Security and PowerShell instructions, clarifies the `-System` scope and `-Remove` behavior, and explains that audit-only ACG monitoring logs policy violations without blocking execution.

What Defender admins need to know

Administrators can use the revised examples to configure system- and app-level mitigations and interpret audit mode more accurately. No action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Customize exploit protection

This article lists each of the mitigations available in exploit protection. It indicates whether the mitigation can be applied system-wide or to individual apps, and provides a brief description of how the mitigation works.

ItThis article also describes how to enable or configure the mitigations using Windows Security, PowerShell, and mobile device management (MDM) configuration service providers (CSPs). Configuring exploit protection settings on a single device is the first step in creating a configuration that you can deploy across your network. To deploy this configuration across multiple devices, see Import, export, and deploy exploit protection configurations.

Exploit protection mitigations

The Use default configuration for each of the mitigation settings indicates our recommendation for a base level of protection for everyday usage for home users. Enterprise deployments should consider the protection required for their individual needs and hence need to modify configuration away from the defaults.

For the associated PowerShell cmdlets for each mitigation, see the PowerShell cmdlets for exploit protection mitigations at the bottom of this article.

Mitigation Description Can be applied to Audit mode available

Configure system-level mitigations with the Windows Security app

To configure system-level and app-level exploit protection mitigations on an individual device, use the Windows Security app:

  1. Open the Windows Security app by selecting the shield icon in the task bar or searching the start menu for Windows Security.

  2. Select the App & browser control tile (or the app icon on the left menu bar) and then select Exploit protection.

Changing some settings may require restarting the device.

  1. Repeat these configuration steps for all the system-level mitigations you want to configure.

  2. Go to the Program settings section and choose the app you want to apply mitigations to:

  3. Repeat these steps for all the apps and mitigations you want to configure. Select Apply when you're done setting up your configuration.

You can now export the exploit protection configuration as an XML file or continue on to configure app-specific mitigations.

Exporting the configuration as an XML file allows you to copy the configuration from one device onto other devices.

You can use the Windows Security app to configure Exploit protection, or you can use PowerShell cmdlets.

The configuration settings that were most recently modified will always be applied - regardless of whether you use PowerShell or Windows Security. This means thatBecause the most recently modified configuration is always applied, if you use the app to configure a mitigation, then use PowerShell to configure the same mitigation, the app will update to show the changes you made with PowerShell. If you were to then use the app to change the mitigation again, that change would apply.

  • -Enable to enable the mitigation
  • -Disable to disable the mitigation
  • <Mitigation>:

For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called testing.exe in the folder C:\Apps\LOB\tests, and to prevent that executable from creating child processes, you'd use the following command:

To apply a mitigation at the system level instead of to a specific application, use the -System scope. For example, to enable DEP for all processes on the device, you'd use the following command:

Set-Processmitigation -System -Enable DEP

To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, this will force the mitigation to be disabled only for that app.

If you need to restore an app-level mitigation back to the system default, you need to include the `-Remove` cmdlet as well. The following example removes the app-specific DEP override for *test.exe* so that it inherits the system default:

```PowerShell
Set-Processmitigation -Name test.exe -Remove -Disable DEP

You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the Audit mode cmdlet as specified in the exploit protection mitigation cmdlets table below.

For example, to enablethe following command enables audit-only monitoring for the Arbitrary Code Guard (ACG) in audit mode formitigation on the testing.exe used previously, you'd use the following command:which logs policy violations without blocking execution:

Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode
|Validate image dependency integrity|App-level only|EnforceModuleDepencySigning|Audit not available|
|Validate stack integrity (StackPivot)|App-level only|EnableRopStackPivot|Audit not available<a href="#r2" id="t2">\[2\]</a>|

<a href="#t1" id="r1">\[1\]</a>: UseTo enable Export Address Filtering Plus (EAF+) for a process and restrict it to specific DLL modules, use the following format to enable EAF modules for dlls for a process:format:

```PowerShell
Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll

<a href="#t2" id="r2">\[2\]</a>: Audit for this mitigation is not available via PowerShell cmdlets.

<a name="customize-the-notification"></a>
## Customize the notificationexploit protection notifications

For more information about customizing the notification when a rule is triggered and blocks an app or file, see [Windows Security](/windows/security/threat-protection/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center).

## See alsoRelated content

- [Protect devices from exploits](exploit-protection.md)
- [Evaluate exploit protection](evaluate-exploit-protection.md)