Microsoft Defender for Endpoint
Endpoint protectionMicrosoft Defender for Endpoint Exploit protection (EP) demonstrations
In brief
The article now includes an overview, more explicit PowerShell commands for applying and verifying mitigation policies, and steps for converting EMET XML profiles and applying self-hosted XML settings.
What Defender admins need to know
Administrators can use the updated procedures to configure, troubleshoot, and verify Exploit Protection demonstrations more easily.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Exploit protection (EP) demonstrations
Overview
This article walks you through demonstration scenarios for configuring Exploit Protection, applying mitigation settings, and converting existing EMET profiles in Microsoft Defender for Endpoint.
Exploit Protection automatically applies exploit mitigation settings system wide and on individual apps. Many of the features in the Enhanced Mitigation Experience Toolkit (EMET) have been included in Exploit Protection, and you can convert and import existing EMET configuration profiles into Exploit Protection.
Set up the demo environment
RunApply the process mitigation policy from the XML configuration file by running the following PowerShellcommands:command:Set-ProcessMitigation -PolicyFilePath ProcessMitigation.xmlTo view usage and parameter information for customizing or troubleshooting the policy application, run the following command:
Set-ProcessMitigation –helpVerify
configurationthat the mitigation policy was applied successfully by listing the current process mitigation settings:Get-ProcessMitigation
Sample xmlXML file for exploit protection settings
EP xml config file (right select, "save target as")
Scenario 1: Convert EMET xml to Exploit Protection settings
Use the following steps to convert an EMET XML configuration file to Exploit Protection settings:
Convert EMET to xml, run PowerShell command:
ConvertTo-ProcessMitigationPolicyApply
settings,settings using the XML file generated byConvertTo-ProcessMitigationPolicy, run PowerShell command:use the XML from the prior stepSet-ProcessMitigation -PolicyFilePath
Scenario 2: Apply selfhost xml to Exploit Protection settings
Follow these steps to apply a self-hosted XML configuration to Exploit Protection settings:
Download our EP xml config file (right select, "save target as") or use your own.
Apply settings, run PowerShell command:
Review the event log for application compatibility.
See alsoRelated content
@@ -1,6 +1,6 @@ --- title: Microsoft Defender for Endpoint Exploit protection (EP) demonstrations-description: See how Exploit Protection automatically applies many exploit mitigation settings system wide and on individual apps.+description: Learn how to demonstrate Microsoft Defender for Endpoint Exploit Protection, including converting EMET profiles and applying exploit mitigation settings system wide and per app. ms.service: defender-endpoint ms.author: lwainstein author: limwainstein@@ -11,7 +11,7 @@ ms.collection: - demo ms.topic: how-to ms.subservice: asr-ms.date: 06/16/2026+ms.date: 07/03/2026 appliesto: - Microsoft Defender for Endpoint Plan 1 - Microsoft Defender for Endpoint Plan 2@@ -20,10 +20,13 @@ appliesto: - Microsoft Defender Antivirus ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- # Exploit protection (EP) demonstrations +## Overview++This article walks you through demonstration scenarios for configuring Exploit Protection, applying mitigation settings, and converting existing EMET profiles in Microsoft Defender for Endpoint. Exploit Protection automatically applies exploit mitigation settings system wide and on individual apps. Many of the features in the Enhanced Mitigation Experience Toolkit (EMET) have been included in Exploit Protection, and you can convert and import existing EMET configuration profiles into Exploit Protection. @@ -36,23 +39,26 @@ Exploit Protection automatically applies exploit mitigation settings system wide ### Set up the demo environment -1. Run PowerShell commands:+1. Apply the process mitigation policy from the XML configuration file by running the following PowerShell command: ```powershell Set-ProcessMitigation -PolicyFilePath ProcessMitigation.xml ```- ++1. To view usage and parameter information for customizing or troubleshooting the policy application, run the following command:+ ```powershell Set-ProcessMitigation –help ``` -1. Verify configuration- +1. Verify that the mitigation policy was applied successfully by listing the current process mitigation settings:+ ```powershell Get-ProcessMitigation ``` -### Sample xml file+<a name="sample-xml-file"></a>+### Sample XML file for exploit protection settings [EP xml config file](https://demo.wd.microsoft.com/Content/ProcessMitigation.xml?) (right select, "save target as") @@ -63,13 +69,15 @@ The following scenarios show how to convert and apply Exploit Protection setting ### Scenario 1: Convert EMET xml to Exploit Protection settings +Use the following steps to convert an EMET XML configuration file to Exploit Protection settings:+ 1. Convert EMET to xml, run PowerShell command: ```powershell ConvertTo-ProcessMitigationPolicy ``` -1. Apply settings, run PowerShell command: *use the XML from the prior step*+1. Apply settings using the XML file generated by `ConvertTo-ProcessMitigationPolicy`, run PowerShell command: ```powershell Set-ProcessMitigation -PolicyFilePath@@ -85,6 +93,8 @@ The following scenarios show how to convert and apply Exploit Protection setting ### Scenario 2: Apply selfhost xml to Exploit Protection settings +Follow these steps to apply a self-hosted XML configuration to Exploit Protection settings:+ 1. Download our EP xml config file (right select, "save target as") or use your own. 1. Apply settings, run PowerShell command: @@ -100,9 +110,10 @@ The following scenarios show how to convert and apply Exploit Protection setting 1. Review the event log for application compatibility. -## See also+<a name="see-also"></a>+## Related content -[Exploit Protection](/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard?ocid=wd-av-demo-ep-bottom)+[Exploit Protection documentation](/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard?ocid=wd-av-demo-ep-bottom) [Microsoft Defender for Endpoint - demonstration scenarios](defender-endpoint-demonstrations.md)