Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Enable exploit protection in Windows

4 September 2026Retirement+151 / −186 lines

In brief

The page now documents configuration through multiple management methods, default mitigations, audit mode, XML export, and staged testing. It also states that EAF and IAF are deprecated and incompatible with .NET Framework 2.0 and 3.5 applications.

What Defender admins need to know

Administrators should account for EAF and IAF deprecation and test mitigation changes for application compatibility before broad deployment.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Enable exploit protection

Exploit protection helpsapplies mitigation techniques to the operating system and individual apps to help protect againstWindows devices from malware that uses exploits to infect devicesexploits. Security administrators can configure system-level and spread. Exploit protection consists of manyapp-level mitigations that can be applied to eitherby using Microsoft Intune, mobile device management (MDM), Microsoft Configuration Manager, Group Policy, PowerShell, or the operating system or individual apps.Windows Security app.

Many features from the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection.

Prerequisites

The following recommendations can help you successfully deploy exploit protection.

  • Set up monitoring for application crashes (Event ID 1000 and/or Event ID 1001) and/or hangs (Event ID 1002)

  • Enable full user mode dump collection

  • Check to see which applications are already compiled with "Control Flow Guard" (CFG) which primarily focus on mitigating memory corruption vulnerabilities. Use dumpbin tool to see if it's compiled w/ CFG. For applications already compiled with CFG, you could skip enabling enforcement for DEP, ASLR, SEHOP, and ACG.

  • Use safe deployment practices (SDP) to test and roll outWindows enables several exploit protection changes gradually.

Safe deployment practices

Safe deployment practices (SDP): Safe deployment processes and procedures define how to safely make and deploy changes to your workload. Implementing SDP requires you to think about deployments through the lens of managing risk. You can minimize the risk of end-user productivity outages in your deployments and limit the effects of problematic deployments on your users by implementing SDP.

Start out with a small set (for example, 10 to 50) of Windows devices and use that as your test environment to see which of the 21 mitigations, are incompatible with exploit protection. Remove the mitigations that aren't compatible with the application. Reiterate with the applications that you're targeting. Once the exploit protection policy is ready for production, begin rolling it out more broadly.

Start out by pushing first to User Acceptance Testing (UAT) comprised of the IT administrators, Security administrators and help desk personnel. Then to 1%, 5%, 10%, 25%, 50%, 75%, and finally to 100% of your environment.

Enabling exploit protection mitigations

You can enable each mitigation separately by using any of the following methods:

Exploit protection is configuredmitigations by default in Windows 10 and Windows 11. You can setturn each mitigation to on,on or off, or touse its default value. Some mitigations have more options. also support audit mode, which lets you evaluate compatibility without affecting normal device use.

You can export the exploit protection mitigation settings as an XML file and deploy themthe configuration to other devices.

Prerequisites

Before you deploy exploit protection, prepare the following monitoring and testing capabilities:

Safe deployment practices

Safe deployment practices (SDP) help you manage the risk of app compatibility and user productivity issues. Start with a small group of Windows devices, and test the mitigations with the apps you plan to protect. Disable incompatible mitigations for the affected apps, and then repeat the testing.

After you validate the policy, deploy it to a user acceptance testing (UAT) group that includes IT administrators, security administrators, and help desk personnel. Expand the deployment in stages based on the results from each group.

Enable exploit protection by using Microsoft Intune

[!INCLUDE intune-recommended-separate-product]

To configure exploit protection in Microsoft Intune, use an endpoint security Attack surface reduction policy. For detailed instructions, see Create endpoint security policies or Modify existing policies (links open new tabs in the Intune documentation).

When you create the policy, use these specific settings:

When you create or modify the policy, use these specific settings on the Configuration settings tab:

  • Exploit protection settings in the Exploit guard section: Slide the toggle to :::image type="icon" source="media/toggle-on.png" border="false"::: Configured.
  • Next to the box that appears, select :::image type="icon" source="media/intune-admin-center-icon-open-file-icon.png" border="false"::: Open file and then find and select your exploit protection XML file.

For more information about creating an exploit protection XML file, see Import, export, and deploy exploit protection configurations.

For more information about attack surface reduction policies in Microsoft Intune, see Attack surface reduction policy for endpoint security in Intune.

Enable exploit protection by using an MDM solution

The Policy configuration service provider (CSP) enables organizations to configure policies on Windows devices by using any MDM solution, not just Microsoft Intune. For more information, see Policy CSP.

Configure exploit protection by using the ExploitProtectionSettings CSP with the following settings:

OMA-URI path: ./Device/Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings
Data type: String
Value: The contents of your exploit protection XML file.

System-level settings require a device restart. App-level settings don't require a restart. For information about creating the XML file, see Import, export, and deploy exploit protection configurations.

Enable exploit protection by using Microsoft Configuration Manager

In Microsoft Configuration Manager, configure exploit protection in a Windows Defender Exploit Guard policy. For instructions, see Create and deploy an Exploit Guard policy.

When you create the policy, use these specific settings:

  • Exploit Guard components: Select Exploit protection.
  • Exploit protection XML: Select Browse, and then select the XML file that contains your system-level and app-level mitigation settings.

Enable exploit protection by using Group Policy

To configure exploit protection through Group Policy, follow these steps:

  1. In a domain environment, open the Group Policy Management Console (GPMC) on your Group Policy management computer.

  2. In the GPMC console tree, expand Group Policy Objects in the forest and domain that contain the Group Policy object (GPO) you want to edit.

  3. Right-click the GPO, and then select Edit.

  4. In the Group Policy Management Editor, go to Computer configuration > Administrative templates > Windows components > Microsoft Defender Exploit Guard > Exploit Protection.

  1. In the Exploit Protection details pane, open the Use a common set of exploit protection settings setting by using one of the following methods:

    • Double-click the setting.
    • Right-click the setting, and then select Edit.
    • Select the setting, and then select Action > Edit.

  2. In the setting window that opens, configure the following options:

    1. Select Enabled.
    2. In the Options section, enter the local path, Universal Naming Convention (UNC) path, or URL of the exploit protection XML file.

    When you're finished, select OK.

Configure exploit protection by using PowerShell

Use the Get-ProcessMitigation and Set-ProcessMitigation cmdlets to review and configure exploit protection mitigations. The cmdlets require an elevated PowerShell session, which is a PowerShell window opened by selecting Run as administrator.

For guidance about configuring individual mitigations, see Configure and audit exploit protection mitigations.

  • Process mitigations:

    • To review the mitigation policy stored in the registry for a specific executable name, use the following syntax:

      Get-ProcessMitigation -Name <ProcessPathAndFilename.exe>

      For example:

      Get-ProcessMitigation -Name testing.exe

      Add the RunningProcesses parameter to retrieve the current settings from running instances of the executable. Mitigations that haven't been configured have the status value NOTSET, which means that Windows applies the system-level value.

    • To configure mitigations for a specific process, use the following syntax:

      Set-ProcessMitigation -Name <ProcessPathAndFilename.exe> [-Remove] <-Enable | -Disable> Mitigation1,Mitigation2,...MitigationN

      This example enables data execution prevention (DEP) with ATL thunk emulation and blocks child-process creation for the specified process:

      Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP,EmulateAtlThunks,DisallowChildProcessCreation

      To disable the same mitigations for the specified app, use -Disable instead of -Enable.

    • This example removes an app-specific DEP override and restores the system-level value:

      Set-Processmitigation -Name c:\apps\lob\tests\testing.exe -Remove -Disable DEP

  • System-level mitigations:

    • To review the process mitigations configured at the system level, use the following syntax:

      Get-ProcessMitigation -System

      The status value NOTSET means that Windows applies the default value for the mitigation.

      You can also setview the default value for each system-level mitigation in the Windows Security app.

    • To enable or disable mitigations to audit mode. Audit mode allows you to test howat the mitigations would work (and review events) without impactingsystem level, use the normalfollowing syntax:

      Set-Processmitigation -System [-Remove] <-Enable | -Disable> Mitigation1,Mitigation2,...MitigationN

      This example enables DEP at the system level:

      Set-Processmitigation -System -Enable DEP

      To disable a mitigation, use -Disable instead of -Enable.

    • This example removes the device.system-level DEP override and restores the default value:

      Set-ProcessMitigation -System -Remove -Disable DEP

Enable exploit protection by using the Windows Security app

  1. OpenYou can use the Windows Security app on individual devices to configure exploit protection mitigations.

    Use the following steps to configure exploit protection mitigations in the Windows Security app:

    1. In the Windows securityapp by either selectingon the shield icon in your task bar, or by searching the Start menu fordevice, go to SecurityApp & browser control.

    2. SelectIn the App & browser control tile (orpane, in the app icon on the left menu bar) and thenExploit protection section, select Exploit protection settings.

    3. The Exploit protection pane that opens has two tabs:

      • Go to Program settings and choosetab: Choose the app you want to apply mitigations to.

        • If the app you want to configure is already listed, select it, and then select Edit.
        • If the app isn't listed, select :::image type="icon" source="media/defender-portal-icon-create.png" border="false"::: Add program to customizeat the top of the list select Add program to customizetab and then choose how you want to add the app.
          • app:
          • UseSelect Add by program name to have the mitigation applied to any running process with that name. Specify a filename and file with its extension. You can enterextension (test.exe) or a full path to the file (c:\test\test.exe) to limit the mitigation to only the app with that name in that location.specific file. When you're finished, select Add.
          • UseSelect Choose exact file path to use a standard Windows Explorer file picker window to find and select the file you want.file.

        After selecting the app, you'll see a list of allA Program settings: <app> window opens with the mitigations that can be applied. ChoosingSelect AuditOverride system settings applies, and then configure the individual settings available for the mitigation. If the mitigation supports audit mode, select Audit only to evaluate the mitigation without enforcing it.

        :::image type="content" source="media/windows-security-app-exploit-protection-program-settings.png" alt-text="Screenshot of the Program settings window for the exploit protection settings of an app in audit mode only.the Windows Security app." lightbox="media/windows-security-app-exploit-protection-program-settings.png":::

        When you're finished, select Apply. You're notified if you need to restart the process or app, or if you need to restart Windows.

      • Repeat steps 3-4the app-level configuration for all the apps and mitigations you want to configure.

      • Under the System settings section, findtab: Find the mitigation you want to configureconfigure, and then specify one of the following settings. Apps that aren't configured individually in the Program settings sectionwithout an app-specific override for a mitigation use the settings that are configured here.corresponding system-level setting.

        • On by default: The mitigation is enabled for apps that don't have this mitigation set in thean app-specific Program settings sectionoverride.
        • Off by default: The mitigation is disabled for apps that don't have this mitigation set in thean app-specific Program settings sectionoverride.
        • Use default (On | Off): The mitigation is either enabled or disabled, depending on the default configuration that is's set up by Windows 10 or Windows 11 installation; theWindows. The default value (On or Off) is always specified next toafter the Use default label for each mitigationmitigation.

      • Repeat step 6the system-level configuration for all the system-level mitigations you want to configure. Select Apply when you're done setting up your configuration.finished.

    If you add an app toFor each mitigation, the configuration on the Program settings section and configure individual mitigationtab takes precedence only when Override system settings there, they are honored above is selected. If Override system settings isn't selected, the app uses the configuration for the same mitigations specified inon the System settings section. The following matrix and examples help to illustrate how defaults work:

    Enabled in Program settingsEnabled in System settingsBehavior
    YesNoAs defined in Program settings
    YesYesAs defined in Program settings
    NoYesAs defined in System settings
    NoNoDefault as defined intab. If the system-level configuration is Use default option

    Example 1: Mikael configures Data Execution Prevention in system settings section to be off by default

    Mikael adds the app test.exe to the Program settings section. In the options for that app, under Data Execution Prevention (DEP) (On | Off), Mikael enables the Override system settings option and sets the switch to On. There are no other apps listed in the Program settings section.

    The result is that DEP is enabled only for test.exe. All other apps won't have DEP applied.

    Example 2: Josie configures Data Execution Prevention in system settings to be off by default

    Josie adds the app test.exe to the Program settings section. In the options for that app, under Data Execution Prevention (DEP), Josie enables the Override system settings option and sets the switch to On.

    Josie also adds the app miles.exe to the Program settings section and configures Control flow guard (CFG) to On. Josie doesn't enable the Override system settings option for DEP or any other mitigations for that app.

    The result is that DEP is enabled for test.exe. DEP won't be enabled for any other app, including miles.exe. CFG will be enabled for miles.exe.

    1. Open the Windows Security app by selecting the shield icondefault shown in the task bar or searching the start menu for Windows Security.

    2. Select the App & browser control tile (or the app icon on the left menu bar) and then select Exploit protection.

    3. Go to Program settings and choose the app you want to apply mitigations to.

      • If the app you want to configure is already listed, select it, and then select Edit.
      • If the app isn't listed, at the top of the list select Add program to customize and then choose how you want to add the app.
        • Use Add by program name to have the mitigation applied to any running process with that name. Specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
        • Use Choose exact file path to use a standard Windows Explorer file picker window to find and select the file you want.

    4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing Audit applies the mitigation in audit mode only. You're notified if you need to restart the process or app, or if you need to restart Windows.

    5. Repeat steps 3-4 for all the apps and mitigations you want to configure. Select Apply when you're done setting up your configuration.

    Enable exploit protection by using Microsoft Intune

    To configure exploit protection using a Microsoft Intune Endpoint Security Attack surface reduction policy, see Create an endpoint security policy (opens in a new tab in the Intune documentation). When creating the policy, use these settings:

    • Policy type: Attack surface reduction
    • Platform: Windows 10, Windows 11, and Windows Server
    • Profile: Exploit Protection
    • Configuration settings: Set Exploit Protection Settings to Configured, then browse to and select your exploit protection XML file

    For more information about creating an exploit protection XML file, see Import, export, and deploy exploit protection configurations.

    For more information about attack surface reduction policies in Microsoft Intune, see Attack surface reduction policy for endpoint security in Intune.parentheses applies.

    EnableCustomize exploit protection by using MDM

    Use the ./Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings configuration service provider (CSP) to enable or disable exploit protection mitigations or to use audit mode.

    Enable exploit protection by using Microsoft Configuration Manager

    You can deploy exploit protection through Configuration Manager by using either the Endpoint Security node or the Assets and Compliance workspace.

    Enable exploit protection from the Endpoint Security node

    Use the following steps to create an exploit protection policy from the Endpoint Security node:

    1. In Microsoft Configuration Manager, go to Endpoint Security > Attack surface reduction.

    2. Select Create Policy > Platform, and for Profile, choose Exploit Protection. Then select Create.

    3. Specify a name and a description, and then choose Next.

    4. Choose Select XML File and browse to the location of the exploit protection XML file. Select the file, and then choose Next.

    5. Configure Scope tags and Assignments if necessary.

    6. Under Review + create, review your configuration settings, and then choose Create.

    Enable exploit protection from the Assets and Compliance workspace

    Use the following steps to create an exploit protection policy from the Assets and Compliance workspace:

    1. In Microsoft Configuration Manager, go to Assets and Compliance > Endpoint Protection > Windows Defender Exploit Guard.

    2. Select Home > Create Exploit Guard Policy.

    3. Specify a name and a description, select Exploit protection, and then choose Next.

    4. Browse to the location of the exploit protection XML file and select Next.

    5. Review the settings, and then choose Next to create the policy.

    6. After the policy is created, select Close.

    Enable exploit protection by using Group Policy

    Perform the following steps to configure exploit protection through Group Policy:

    1. On your Group Policy management device, open the Group Policy Management Console. Right-click the Group Policy Object you want to configure and select Edit.

    2. In the Group Policy Management Editor, go to Computer configuration and select Administrative templates.

    3. Expand the tree to Windows components > Windows Defender Exploit Guard > Exploit Protection > Use a common set of exploit protection settings.

    4. Select Enabled and type the location of the XML file, and then choose OK.

    Enable exploit protection by using PowerShell

    You can use the PowerShell verb Get or Set with the cmdlet ProcessMitigation. Using Get lists the current configuration status of any mitigations that are enabled on the device. To review the exploit protection mitigations currently applied to a specific app, add the -Name parameter and the app executable:

    Get-ProcessMitigation -Name processName.exe

    Use Set to enable or disable one or more exploit protection mitigations at the system or app level. The general syntax is: 

    Set-ProcessMitigation -<scope> <app executable> -<action> <mitigation or options>,<mitigation or options>,<mitigation or options>

    Where:

    • <Scope>:
      • -Name to indicate the mitigations should be applied to a specific app. Specify the app's executable after this flag.
        • -System to indicate the mitigation should be applied at the system level
    • <Action>:
      • -Enable to enable the mitigation
      • -Disable to disable the mitigation
    • <Mitigation>:
      • The mitigation's cmdlet along with any suboptions (surrounded with spaces). Each mitigation is separated with a comma.

    The following example enables DEP with ATL thunk emulation and blocks child-process creation for a line-of-business application called testing.exe in the folder C:\Apps\LOB\tests: 

    Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation

    To enable DEP as a system-wide mitigation that applies to all processes, use the following command: 

    Set-Processmitigation -System -Enable DEP

    To disable mitigations, you can replace -Enable with -Disable. However, for app-level mitigations, this action forces the mitigation to be disabled only for that app.

    To remove an app-specific DEP override and restore the mitigation back to the system default, include the -Remove cmdlet as shown in the following example: 

    Set-Processmitigation -Name test.exe -Remove -Disable DEP

    The following table lists the individual Mitigations (and Audits, when available) to be used with the -Enable or -Disable cmdlet parameters.

    Mitigation type Applies to Mitigation cmdlet parameter keyword Audit mode cmdlet parameter
    Control flow guard (CFG) System and app-level CFG, StrictCFG, SuppressExports Audit not available
    Data Execution Prevention (DEP) System and app-level DEP, EmulateAtlThunks Audit not available
    Force randomization for images (Mandatory ASLR) System and app-level ForceRelocateImages Audit not available
    Randomize memory allocations (Bottom-Up ASLR) System and app-level BottomUp, HighEntropy Audit not available
    Validate exception chains (SEHOP) System and app-level SEHOP, SEHOPTelemetry Audit not available
    Validate heap integrity System and app-level TerminateOnError Audit not available
    Arbitrary code guard (ACG) App-level only DynamicCode AuditDynamicCode
    Block low integrity images App-level only BlockLowLabel AuditImageLoad
    Block remote images App-level only BlockRemoteImages Audit not available
    Block untrusted fonts App-level only DisableNonSystemFonts AuditFont, FontAuditOnly
    Code integrity guard App-level only BlockNonMicrosoftSigned, AllowStoreSigned AuditMicrosoftSigned, AuditStoreSigned
    Disable extension points App-level only ExtensionPoint Audit not available
    Disable Win32k system calls App-level only DisableWin32kSystemCalls AuditSystemCall
    Don't allow child processes App-level only DisallowChildProcessCreation AuditChildProcess
    Export address filtering (EAF) App-level only EnableExportAddressFilterPlus, EnableExportAddressFilter [1]Audit not available [2]
    Import address filtering (IAF)App-level onlyEnableImportAddressFilterAudit not available [2]
    Simulate execution (SimExec)App-level onlyEnableRopSimExecAudit not available [2]
    Validate API invocation (CallerCheck)App-level onlyEnableRopCallerCheckAudit not available [2]
    Validate handle usageApp-level onlyStrictHandleAudit not available
    Validate image dependency integrityApp-level onlyEnforceModuleDepencySigningAudit not available
    Validate stack integrity (StackPivot)App-level onlyEnableRopStackPivotAudit not available [2]

    [1]: To enable Export Address Filtering Plus (EAF+) for a specific process and limit monitoring to selected DLLs, use the following format:

    Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll

    [2]: Audit for this mitigation isn't available via PowerShell cmdlets.

    Customize the notificationnotifications

    For information about customizing the notification when a rule is triggered and an app or file is blocked, see Windows SecurityWindows Security.

    Removing theRemove exploit protection mitigations

    To reset (undo or remove) the exploit protection mitigations, see the Reset or remove exploit protection mitigations.

    See alsoRelated content