Microsoft Defender for Endpoint
Endpoint protectionUse network protection to help prevent connections to malicious or suspicious sites
In brief
The article updates Group Policy Management Console navigation, expands the steps for enabling **Convert warn verdict to block**, adds Local Group Policy Editor guidance, and refreshes supporting links and page metadata.
What Defender admins need to know
Administrators configuring network protection have clearer, updated procedures to follow; no configuration change is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Use network protection to help prevent connections to malicious or suspicious sites
Overview of network protection
Network protection helps protect devices by preventing connections to malicious or suspicious sites. Examples of dangerous domains are domains that host phishing scams, malicious downloads, tech scams, or other malicious content. Network protection expands the scope of Microsoft Defender SmartScreenMicrosoft Defender SmartScreen to block all outbound HTTP(S) traffic that attempts to connect to poor-reputation sources (based on the domain or hostname).
Network protection extends the protection in Web protection to the operating system level, and is a core component for Web Content Filtering (WCF). It provides the web protection functionality found in Microsoft Edge to other supported browsers and nonbrowser applications. Network protection also provides visibility and blocking of indicators of compromise (IOCs) when used with Endpoint detection and response. For example, network protection works with your custom indicators to block specific domains or host names.
The following table summarizes network protection areas of coverage:
| Feature | Microsoft Edge | Non-Microsoft browsers | Nonbrowser processes (for example, PowerShell) |
|---|---|---|---|
| Web Threat Protection | SmartScreen must be enabled | Network protection must be in block mode | Network protection must be in block mode |
| Custom Indicators | SmartScreen must be enabled | Network protection must be in block mode | Network protection must be in block mode |
| Web Content Filtering | SmartScreen must be enabled | Network protection must be in block mode | Not supported |
| Network protection also requires Microsoft Defender Antivirus with real-time protection enabled. |
| Windows version | Microsoft Defender Antivirus |
|---|---|
| Windows 10 version 1709 or later, Windows 11, Windows Server 1803 or later | Make sure that Microsoft Defender Antivirus real-time protection, behavior monitoring, and cloud-delivered protection are enabled (active) |
| Windows Server 2012 R2 and Windows Server 2016 using the modern unified solution | Platform update version 4.18.2001.x.x or newer |
Use CSP to enable Convert warn verdict to block
By enabling this setting, network protection blocks network traffic instead of displaying a warning.
OnIn Centralized Group Policy, open the Group Policy Management Console (GPMC) on your Group Policy managementcomputer, opencomputer.In the
Group Policy Management Console.GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.Right-click the
Group Policy Object you want to configure,GPO, and then select Edit.In the Group Policy Management Editor, go to Computer configuration
and then select> Administrative templates.Expand the tree to> Windows components > Microsoft Defender Antivirus > Network inspection system.Double-clickIn the details pane of Network inspection system, open the Convert warn verdict to block setting. To open the setting, use any of the following methods:- Double-click the setting.
- Right-click the setting, and
setthen select Edit. - Select the
option tosetting, and then select Action > Edit.
In the setting window that opens, select Enabled
.Select, and then select OK.
Block experience
This procedure enables network protection to improve performance by switching from real-time inspection to asynchronous inspection.
OnBlock experience
This procedure enables network protection to improve performance by switching from real-time inspection to asynchronous inspection.
In Centralized Group Policy, open the Group Policy Management Console (GPMC) on
computer, opencomputer.In the
Group Policy Management Console.GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.Right-click the
Group Policy Object you want to configure,GPO, and then select Edit.In the Group Policy Management
Editor,Editor, go to Computer configuration, and then select> Administrative templates.Expand the tree to> Windows components > Microsoft Defender Antivirus > Network inspection system.Double-clickIn the details pane of Network inspection system, open the Turn on asynchronous inspection,setting. To open the setting, use any of the following methods:- Double-click the setting.
- Right-click the setting, and then
setselect Edit. - Select the
option tosetting, and then selectEnabledAction > Edit. SelectOK.
Use Microsoft Defender Antivirus Powershell to enable Turn on asynchronous inspection
Configuring attack surface reduction capabilities in Microsoft Intune- In the setting window that opens, select Enabled, and then select OK.
Use Microsoft Defender Antivirus Powershell to enable Turn on asynchronous inspection
- Network protection for Linux | To learn about using Microsoft Network protection for Linux devices.
- Network protection for macOS | To learn more about Microsoft Network protection for macOS
@@ -1,13 +1,14 @@ --- title: Use network protection to help prevent connections to malicious or suspicious sites-description: Protect your network by preventing users from accessing known malicious and suspicious network addresses+description: Protect your network by preventing users from accessing known malicious and suspicious network addresses. ms.service: defender-endpoint ms.localizationpriority: medium-ms.date: 10/20/2025+ms.date: 08/12/2026 author: paulinbar ms.author: painbar ms.reviewer: ericlaw-ms.custom: asr+ms.custom: asr, msecd-doc-authoring-1015+ai-usage: ai-assisted ms.subservice: asr ms.topic: overview ms.collection: @@ -16,6 +17,7 @@ ms.collection: - mde-asr appliesto: - Microsoft Defender Antivirus+#customer intent: As a security administrator, I want to configure network protection so that endpoints block connections to malicious or suspicious network destinations. --- # Use network protection to help prevent connections to malicious or suspicious sites@@ -24,7 +26,7 @@ Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial](h ## Overview of network protection -Network protection helps protect devices by preventing connections to malicious or suspicious sites. Examples of dangerous domains are domains that host phishing scams, malicious downloads, tech scams, or other malicious content. Network protection expands the scope of [Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview) to block all outbound HTTP(S) traffic that attempts to connect to poor-reputation sources (based on the domain or hostname).+Network protection helps protect devices by preventing connections to malicious or suspicious sites. Examples of dangerous domains are domains that host phishing scams, malicious downloads, tech scams, or other malicious content. Network protection expands the scope of [Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/) to block all outbound HTTP(S) traffic that attempts to connect to poor-reputation sources (based on the domain or hostname). Network protection extends the protection in [Web protection](web-protection-overview.md) to the operating system level, and is a core component for [Web Content Filtering](web-content-filtering.md) (WCF). It provides the web protection functionality found in Microsoft Edge to other supported browsers and nonbrowser applications. Network protection also provides visibility and blocking of indicators of compromise (IOCs) when used with [Endpoint detection and response](overview-endpoint-detection-response.md). For example, network protection works with your [custom indicators](indicators-overview.md) to block specific domains or host names. @@ -48,7 +50,7 @@ Watch this video to learn how network protection helps reduce the attack surface The following table summarizes network protection areas of coverage: | Feature | Microsoft Edge | Non-Microsoft browsers | Nonbrowser processes <br/> (for example, PowerShell) |-|:---|:---|:---|:---|+| --- | --- | --- | --- | | [Web Threat Protection](web-threat-protection.md) | SmartScreen must be enabled | Network protection must be in block mode | Network protection must be in block mode | | [Custom Indicators](indicators-overview.md) | SmartScreen must be enabled | Network protection must be in block mode | Network protection must be in block mode | | [Web Content Filtering](web-content-filtering.md) | SmartScreen must be enabled | Network protection must be in block mode | Not supported |@@ -83,7 +85,7 @@ Network protection requires devices running one of the following operating syste Network protection also requires Microsoft Defender Antivirus with real-time protection enabled. | Windows version | Microsoft Defender Antivirus |-|:---|:---|+| --- | --- | | Windows 10 version 1709 or later, Windows 11, Windows Server 1803 or later | Make sure that [Microsoft Defender Antivirus real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md), [behavior monitoring](behavior-monitor.md), and [cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) are enabled (active) | | Windows Server 2012 R2 and Windows Server 2016 using the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2) | Platform update version `4.18.2001.x.x` or newer | @@ -154,13 +156,13 @@ A user visits a website. If the url has an unknown or uncertain reputation, a to > [!NOTE] >-> - The images shown in this article for both the `warn` experience and `block` experience use "blocked url" as example placeholder text. In a functioning environment, the actual url or domain is listed. +> - The images shown in this article for both the `warn` experience and `block` experience use "blocked url" as example placeholder text. In a functioning environment, the actual url or domain is listed. > > - To receive this toast notification, make sure the **Files or activities are blocked** option is enabled under **Virus & Threat Protection notifications** by setting the corresponding registry key: > > `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender Security Center\Virus and threat protection\FilesBlockedNotificationDisabled = 0` >-> For more information, see [Windows Security app settings](https://support.microsoft.com/windows/windows-security-app-settings-1ec98620-4e41-4b6b-b055-3c4bb115d4ee#bkmk_notifications).+> For more information, see [Windows Security app settings](https://support.microsoft.com/Windows/Security/Windows-Security/windows-security-app-settings#bkmk_notifications). #### Use CSP to enable `Convert warn verdict to block` @@ -174,17 +176,23 @@ For Edge browsers, see [Edge Policy: Prevent SmartScreen Prompt Override](/deplo By enabling this setting, network protection blocks network traffic instead of displaying a warning. -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)).+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer. -1. Right-click the Group Policy Object you want to configure, and then select **Edit**.+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit. -1. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**.+1. Right-click the GPO, and then select **Edit**. -1. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Network inspection system**.+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Network inspection system**. -1. Double-click **Convert warn verdict to block** and set the option to **Enabled**.+1. In the details pane of **Network inspection system**, open the **Convert warn verdict to block** setting. To open the setting, use any of the following methods:+ - Double-click the setting.+ - Right-click the setting, and then select **Edit**.+ - Select the setting, and then select **Action** \> **Edit**. -1. Select **OK**.+1. In the setting window that opens, select **Enabled**, and then select **OK**.++> [!TIP]+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Network inspection system**. #### Block experience @@ -460,17 +468,23 @@ Network protection includes a performance optimization that allows `block` mode This procedure enables network protection to improve performance by switching from real-time inspection to asynchronous inspection. -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)).+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer. -1. Right-click the Group Policy Object you want to configure, and then select **Edit**.+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit. -1. In the Group Policy Management Editor, go to **Computer configuration**, and then select **Administrative templates**.+1. Right-click the GPO, and then select **Edit**. -1. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Network inspection system**.+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Network inspection system**. -1. Double-click **Turn on asynchronous inspection**, and then set the option to **Enabled**.+1. In the details pane of **Network inspection system**, open the **Turn on asynchronous inspection** setting. To open the setting, use any of the following methods:+ - Double-click the setting.+ - Right-click the setting, and then select **Edit**.+ - Select the setting, and then select **Action** \> **Edit**. -1. Select **OK**.+> [!TIP]+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Network inspection system**.++1. In the setting window that opens, select **Enabled**, and then select **OK**. ### Use Microsoft Defender Antivirus Powershell to enable Turn on asynchronous inspection @@ -487,5 +501,3 @@ Set-MpPreference -AllowSwitchToAsyncInspection $true - [Configuring attack surface reduction capabilities in Microsoft Intune](/intune/intune-service/protect/endpoint-security-asr-policy) - [Network protection for Linux](network-protection-linux.md) | To learn about using Microsoft Network protection for Linux devices. - [Network protection for macOS](network-protection-macos.md) | To learn more about Microsoft Network protection for macOS--