Windows 10: Enable Windows Defender Block at First Sight in Windows 10

How to: Enable Windows Defender Block at First Sight in Windows 10

How to Enable or Disable Windows Defender Block at First Sight in Windows 10


Windows Defender Antivirus helps protect your PC against malware (malicious software) like viruses, spyware, and other potentially unwanted software. Malware can infect your PC without your knowledge: it might install itself from an email message, when you connect to the Internet, or when you install certain apps using a USB flash drive, CD, DVD, or other removable media. Some malware can also be programmed to run at unexpected times, not only when it's installed.

version 1607) that provides a way to detect and block new malware within seconds. Block at First Sight requires a number of Group Policy settings to be configured correctly or it will not work.

See also: Use next-gen technologies in Windows Defender Antivirus through cloud-delivered protection | Microsoft Docs

How Block at First Sight works



When a Windows Defender client encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend will apply heuristics, machine learning, and automated analysis of the file to determine the files as malicious or clean.

If the cloud backend is unable to make a determination, the file will be locked by Windows Defender while a copy is uploaded to the cloud. Only after the cloud has received the file will Windows Defender release the lock and let the file run. The cloud will perform additional analysis to reach a determination, blocking all future encounters of that file.

In many cases this process can reduce the response time to new malware from hours to seconds.

*note Suspicious file downloads requiring additional backend processing to reach a determination will be locked by Windows Defender on the first machine where the file is encountered, until it is finished uploading to the backend. Users will see a longer "Running security scan" message in the browser while the file is being uploaded. This might result in what appear to be slower download times for some files.

This tutorial will show you how to enable or disable the Block at First Sight cloud protection feature in Windows Defender for all users in Windows 10.

*Warning You must be signed in as an administrator to be able to enable or disable Block at First Sight.


CONTENTS:

• Option One: To Turn On or Off Windows Defender Block at First Sight in Settings
• Option Two: To Enable Windows Defender Block at First Sight in Group Policy
• Option Three: To Disable Windows Defender Block at First Sight in Group Policy
• Option Four: To Enable or Disable Windows Defender Block at First Sight using a REG file

OPTION ONE [/i] To Turn On or Off Windows Defender Block at First Sight in Settings
*note You can confirm that Block at First Sight is enabled in Windows Settings. The feature is automatically enabled, as long as Cloud-based protection and Automatic sample submission are both turned on.

If you enabled Block at First Site using Option Two or Option Four below, then the settings in this option will be grayed out.
1. Open Windows Security, and click/tap on the Virus & threat protection icon. (see screenshot below)



2. Click/tap on the Manage settings link under Virus & threat protection settings. (see screenshot below)



3. Do step 4 (on) or step 5 (off) below for what you want to do.


4. To Turn On Block at First Sight Cloud Protection in Windows Defender
*note This is the default setting.
A) Turn on Real-time protection. (see screenshot below)

B) Turn on Cloud-delivered protection.

C) Turn on Automatic sample submission, and go to step 6 below.

5. To Turn Off Block at First Sight Cloud Protection in Windows Defender
A) Turn off Cloud-delivered protection. (see screenshot below)

B) Turn off Automatic sample submission, and go to step 6 below.
6. When finished, you can close Windows Security if you like.









OPTION TWO [/i] To Enable Windows Defender Block at First Sight in Group Policy
*note This option will override Option One.

Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Four below to enable Block at First Sight using a .reg file instead.
1. Open the Local Group Policy Editor.

2. Navigate to the location below in the left pane of Local Group Policy Editor. (see screenshot below)
*Arrow Computer Configuration/Administrative Templates/Windows Components/Windows Defender Antivirus/MAPS




3. In the right pane of MAPS in Local Group Policy Editor, double click/tap on the Configure the ‘Block at First Sight’ feature policy to edit it. (see screenshot above)
A) Select (dot) Enabled, and click/tap on OK. (see screenshot below)




4. In the right pane of MAPS in Local Group Policy Editor, double click/tap on the Join Microsoft MAPS policy to edit it. (see screenshot below)




A) Select (dot) Enabled. (see screenshot below)

B) Select Advanced MAPS under Options, and click/tap on OK.

*note [B]Advanced MAPS[/B] membership, in addition to basic information, will send more information to Microsoft about malicious software, spyware, and potentially unwanted software, including the location of the software, file names, how the software operates, and how it has impacted your computer.




5. In the right pane of MAPS in Local Group Policy Editor, double click/tap on the Send file samples when further analysis is required policy to edit it. (see screenshot below)




A) Select (dot) Enabled. (see screenshot below)

B) Select Send safe samples or Send all samples under Options for what you want, and click/tap on OK.




6. Navigate to the location below in the left pane of Local Group Policy Editor. (see screenshot below)
*Arrow Computer Configuration/Administrative Templates/Windows Components/Windows Defender Antivirus/Real-time Protection




7. In the right pane of Real-time Protection in Local Group Policy Editor, double click/tap on the Turn off real-time protection policy to edit it. (see screenshot above)
A) Select (dot) Disabled, and click/tap on OK. (see screenshot below)




8. In the right pane of Real-time Protection in Local Group Policy Editor, double click/tap on the Scan all downloaded files and attachments policy to edit it. (see screenshot below)




A) Select (dot) Enabled, and click/tap on OK. (see screenshot below)




9. When finished, you can close the Local Group Policy Editor if you like.




OPTION THREE [/i] To Disable Windows Defender Block at First Sight in Group Policy
*note You may choose to disable the Block at First Sight feature if you want to retain the pre-requisite settings without using Block at First Sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network.

Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Four below to disable Block at First Sight using a .reg file instead.
1. Open the Local Group Policy Editor.

2. Navigate to the location below in the left pane of Local Group Policy Editor. (see screenshot below)
*Arrow Computer Configuration/Administrative Templates/Windows Components/Windows Defender Antivirus/MAPS




3. In the right pane of MAPS in Local Group Policy Editor, double click/tap on the Configure the ‘Block at First Sight’ feature policy to edit it. (see screenshot above)

4. Select (dot) Disabled, and click/tap on OK. (see screenshot below)



5. When finished, you can close the Local Group Policy Editor if you like.




OPTION FOUR [/i] To Enable or Disable Windows Defender Block at First Sight using a REG file
*note The downloadable .reg files below will add and modify the DWORD values in the registry keys.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableIOAVProtection DWORD

• (delete) = Default Not Configured
• 0 = Enable

DisableRealtimeMonitoring DWORD

• (delete) = Default Not Configured
• 0 = Enable

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet
DisableBlockAtFirstSeen DWORD

• (delete) = Default Not Configured
• 1 = Disable
• 0 = Enable

SpynetReporting DWORD

• (delete) = Default Not Configured
• 2 = Advanced MAPS

SubmitSamplesConsent DWORD

• (delete) = Default Not Configured
• 1 = Send safe samples
• 3 = Send all samples

1. Do step 2 (enable with "Send safe samples"), step 3 (enable with "Send all sample"), step 4 (disable), or step 5 (default Not Configured) below for what you would like to do.


2. To Enable Block at First Sight with "Send safe samples"
A) Click/tap on the Download button below to download the file below, and go to step 6 below.

EnableBlockAtFirstSight_AdvancedMAPS_SendSafeSamples.reg

Download
3. To Enable Block at First Sight with "Send all samples"
A) Click/tap on the Download button below to download the file below, and go to step 6 below.

EnableBlockAtFirstSight_AdvancedMAPS_SendAllSamples.reg

Download
4. To Disable Block at First Sight
A) Click/tap on the Download button below to download the file below, and go to step 6 below.

Disable_BlockAtFirstSight.reg

Download
5. To Set Block at First Sight to Default "Not Configured"

*note This is the default setting to set all Block at First Sight group polices back to "Not Configured".

This will have the settings in Option One above to no longer be grayed out.
A) Click/tap on the Download button below to download the file below, and go to step 6 below.

Default_NotConfigured_BlockAtFirstSight.reg

Download
6. Save the .reg file to your desktop.

7. Double click/tap on the downloaded .reg file to merge it.

8. If prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

9. If you like, you can now delete the downloaded .reg file.

That's it,
Shawn


Related Tutorials

• How to Turn On or Off Windows Defender in Windows 10
• How to Turn On or Off Windows Defender Real-time Protection in Windows 10
• How to Turn On or Off Windows 10 Limited Periodic Scanning with Windows Defender
• How to Add or Remove Exclusions for Windows Defender in Windows 10
• How to Enable or Disable Scan Archive Files by Windows Defender in Windows 10
• Enable or Disable Scan Mapped Network Drives with Windows Defender in Windows 10
• Enable or Disable Scan Removable Drives during Windows Defender Full Scan in Windows 10
• How to Enable or Disable Windows Defender Exploit Guard Controlled Folder Access in Windows 10
• Hide or Show Virus and Threat Protection in Windows Defender Security Center in Windows 10
• How to Turn On or Off Windows Defender Block Suspicious Behaviors in Windows 10

:)

 

Windows Defender antivirus software

Please see:

https://www.tenforums.com/tutorials/70329-enabl...

https://www.tenforums.com/tutorials/32236-enabl...

 

THIS APP HAS BEEN BLOCKED FOR YOUR PROTECTION

Try turning off Real time protection temporarily:

https://www.tenforums.com/tutorials/3569-turn-o...

Also, see this:

https://www.tenforums.com/tutorials/70329-enabl...