Windows 10: Enable or Disable Windows Defender PUA Protection in Windows 10

How to: Enable or Disable Windows Defender PUA Protection in Windows 10

How to Enable or Disable Windows Defender PUA Protection in Windows 10


The Potentially Unwanted Applications (PUA) protection feature in Windows Defender Antivirus can identify and block PUAs from downloading and installing on endpoints in your network.

These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have a poor reputation.

Typical PUA behavior includes:

• Various types of software bundling
• Ad-injection into web browsers
• Driver and registry optimizers that detect issues, request payment to fix the errors, but remain on the endpoint and make no changes or optimizations (also known as "rogue antivirus" programs)

These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications.

By default, PUA protection is not enabled in Windows Defender, and would need to be enabled if wanted.

While Microsoft announced the new PUA feature as only available for the Enterprise edition of Windows 10, Home and Pro editions can also enable it on their Windows 10 PCs to block the deployment of adware during software installations.

PUA protection updates are included as part of the existing definition updates and cloud protection of Windows Defender.

For more details, see:

• Block Potentially Unwanted Applications with Windows Defender AV | Microsoft Docs
• Shields up on potentially unwanted applications in your enterprise - Microsoft Malware Protection Center - Site Home - TechNet Blogs
• Microsoft Malware Protection Center - How Microsoft antimalware products identify potentially unwanted software

This tutorial will show you how to enable or disable Potential Unwanted Applications (PUA) protection in Windows Defender for all users in Windows 10.

*Warning You must be signed in as an administrator to enable or disable Windows Defender PUA protection.


CONTENTS:

• Option One: Enable or Disable Windows Defender Potentially Unwanted Applications (PUA) Protection using a REG file
• Option Two: Enable or Disable Windows Defender Potentially Unwanted Applications (PUA) Protection in PowerShell
• Option Three: Enable or Disable Windows Defender Potentially Unwanted Applications (PUA) Protection in Local Group Policy Editor

EXAMPLE: Windows Defender PUA protection

*tip To download a safe PUP test file: Feature Settings Check AMTSO

(Windows Defender Security Center > Virus & threat protection > Threat History > "See full history" under Quarantined threats)














OPTION ONE [/i] Enable or Disable Windows Defender Potentially Unwanted Applications (PUA) Protection using a REG file

*note The downloadable .reg files below will add and modify the DWORDs in the registry keys below.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

PUAProtection DWORD

0 or delete = Disable
1 = Enable
2 = Audit Mode


HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine

MpEnablePus DWORD

0 or delete = Disable
1 = Enable

1. Do step 2 (enable), step 3 (audit mode), or step 4 (disable) below for what you would like to do.


2. To Enable Windows Defender PUA Protection
A) Click/tap on the Download button below to download the file below, and go to step 5 below.

Enable_Windows_Defender_PUA_protection.reg

Download

3. To Enable Audit Mode for Windows Defender PUA Protection
*note Potentially unwanted software will not be blocked, however if this feature would have blocked access if it were set to Block (enable), then a record of the event will be in the event logs.
A) Click/tap on the Download button below to download the file below, and go to step 5 below.

Enable_Audit_Mode_Windows_Defender_PUA_protection.reg

Download

4. To Disable Windows Defender PUA Protection
*note This is the default setting.
A) Click/tap on the Download button below to download the file below, and go to step 5 below.

Disable_Windows_Defender_PUA_protection.reg

Download
5. Save the .reg file to your desktop.

6. Double click/tap on the downloaded .reg file to merge it.

7. When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

8. Restart the computer to apply.

9. You can now delete the downloaded .reg file if you like.





OPTION TWO [/i] Enable or Disable Windows Defender Potentially Unwanted Applications (PUA) Protection in PowerShell

*note The PowerShell commands below will add and modify the DWORD value in the protected registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender

PUAProtection DWORD

0 = Disable
1 = Enable
2 = Audit Mode

1. Open an elevated PowerShell.

2. Enter the command below you want to use into the elevated PowerShell, and press Enter. (see screenshot below)
(Disable Windows Defender PUA protection - Default)
*Arrow Set-MpPreference -PUAProtection 0
or
*Arrow Set-MpPreference -PUAProtection Disabled

OR

(Enable Windows Defender PUA protection)
*Arrow Set-MpPreference -PUAProtection 1
or
*Arrow Set-MpPreference -PUAProtection Enabled

OR

(Audit Mode - will detect PUAs, but will not block them)
*Arrow Set-MpPreference -PUAProtection 2
or
*Arrow Set-MpPreference -PUAProtection AuditMode




3. Restart the computer to apply.





OPTION THREE [/i] Enable or Disable Windows Defender Potentially Unwanted Applications (PUA) Protection in Local Group Policy Editor

*note This option is only available starting with Windows 10 version 1809.

The Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option One or Option Two.
1. Open the Local Group Policy Editor.

2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)
*Arrow Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus




3. In the right pane of Windows Defender Antivirus in Local Group Policy Editor, double click/tap on the Configure detection for potentially unwanted applications policy to edit it. (see screenshot above)

4. Do step 5 (enable, )step 6 (audit mode), or step 7 (disable) below for what you would like to do.


5. To Enable for Windows Defender PUA Protection
A) Select (dot) Enabled, select Block in the Options drop down menu, click/tap on OK, and go to step 8 below. (see screenshot below)

6. To Enable Audit Mode for Windows Defender PUA Protection
*note Potentially unwanted software will not be blocked, however if this feature would have blocked access if it were set to Block (enable), then a record of the event will be in the event logs.
A) Select (dot) Enabled, select Audit Mode in the Options drop down menu, click/tap on OK, and go to step 8 below. (see screenshot below)

7. To Turn Off Windows Defender Antivirus
A) Select (dot) Not Configured or Disabled, click/tap on OK, and go to step 8 below. (see screenshot below)

*note Not Configured is the default setting.




8. When finished, you can close the Local Group Policy Editor if you like.

That's it,
Shawn


Related Tutorials

• How to Turn On or Off Windows Defender in Windows 10
• How to Turn On or Off Windows Defender Real-time Protection in Windows 10

:)

 

Windows 10 Blocked mrt.exe by administrator and refuses to run MRT

Try disabling Windows Defender PUA or real time protection.

https://www.tenforums.com/tutorials/32236-enabl...

https://www.tenforums.com/tutorials/3569-window...

 

Windows Defender not detecting known Adware

I’ve been enabling PUA protection on my Windows 10 Home and Pro machines for over a year now, but I’ve never actually tested it myself. People who have tested it, though, report that it is working as expected on these editions. So maybe this is worth
a try:

Enable or Disable Windows Defender PUA Protection in Windows 10

http://www.winhelponline.com/blog/defender-enable-pua-pup-adware-protection/

PUA Protection is disabled by default and needs to be enabled. This is easy with PowerShell – just run this command line at the elevated PowerShell Prompt:

Set-MpPreference -PUAProtection 1

Then confirm that the value was reset by returning the current state for PUAProtection:

$Preferences = Get-MpPreference

$Preferences.PUAProtection

 

Hello nissimezra, *Smile

The Microsoft article made no mention of it supporting MSE, but it won't hurt to give it a play with if you like to see for sure.

 

Hi Shawn,
When I saw you post this Tut I assumed Malwarebytes Anti-Malware Premium would locate & resolve PUP issues. Is it good practice to have Defender PUA protection as well?

thank you,
richie

 

Hello Richie, *Smile

Yes, MBAM protects against PUPs, but it wouldn't hurt to enable it in Windows Defender for extra protection.

 

Great *Smile

thanks Shawn

 

Additional at Microsoft Protection Center:

More at: Microsoft Malware Protection Center - How Microsoft antimalware products identify potentially unwanted software

 

Shawn, a quick question.

In the Shields up on potentially unwanted applications in your enterprise | Microsoft Malware Protection Center it specifically mentions that the
MpEnablePus DWORD should be entered in the
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\MpEngine

whereas in your tutorial you create it in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine

Am I missing something? Which one is the correct entry?

Thanx. Dimitri

 

Hello Dimitri, *Smile

Interesting. I'll update the tutorial now to use that location instead. Thank you.

 

You're very welcome.

So I take it that the correct entry should be in the
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\MpEngine

*Smile

 

Hi administrator brink
i am gettin this error
i have not installed any of the .reg files
plz help

 

Hello Sammy, and welcome to Ten Forums. *Smile

As a test enable it using the .reg file in Option One to see if that may work better for you.

 

hello, thanks for the well documented feature (as usual..)
It is unclear if this works with all version of Windows 10 (core, pro, etc..)
at least, Microsoft is documented it for Enterprise version

 

Hello Daniel, *Smile

While Microsoft announced the new PUA feature as only available for the Enterprise edition of Windows 10, Home and Pro editions can also enable it on their Windows 10 PCs to block the deployment of adware during software installations.