Windows 10: Turn On Windows Defender Block Suspicious Behaviors in Windows 10

How to: Turn On Windows Defender Block Suspicious Behaviors in Windows 10

How to Turn On or Off Windows Defender Block Suspicious Behaviors in Windows 10


Starting with Windows 10 build 17704, you can enable a new protection setting, Block suspicious behaviors, which brings the Windows Defender Exploit Guard attack surface reduction technology to all users.

You can turn on Block suspicious behaviors to prevent behavior by an app or file that might infect your device.

This tutorial will show you how to turn on or off the Block suspicious behaviors feature of Windows Defender Exploit Guard attack surface reduction for all users in Windows 10.

*Warning You must be signed in as an administrator to turn on or off "Block suspicious behaviors".



Note From Microsoft:

Thank you everyone who has given us feedback on the “Block Suspicious Behaviors” feature that was recently added to Windows Security. For the time being we’re removing it from the build while we work on addressing some of the things you shared with us.

*Arrow Announcing Windows 10 Insider Preview Build 17730 - Windows Experience Blog





Here's How:

1. Open Windows Security, and click/tap on the Virus & threat protection icon. (see screenshot below)



2. Click/tap on the Manage settings link under Virus & threat protection settings. (see screenshot below)



3. Turn on or off (default) Block suspicious behaviors for what you want. (see screenshot below)


Note This setting is stored in the ASR registry key below, but requires you to set permissions to "Allow" Administrators "Full Control" before being able to modify the DWORD value below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR

EnableASRConsumers DWORD

0 = Off
1 = On





4. If prompted by UAC, click/tap on Yes to approve.

5. You can now close Windows Security if you like.


That's it,
Shawn


Related Tutorials

• How to Turn On or Off Windows Defender Antivirus in Windows 10
• How to Turn On or Off Windows Defender Real-time Protection in Windows 10
• How to Enable or Disable Windows Defender Block at First Sight in Windows 10
• How to Enable or Disable Windows Defender Exploit Guard Controlled Folder Access in Windows 10
• How to Add or Remove Exclusions for Windows Defender in Windows 10
• How to Turn On or Off Windows Defender Antivirus Enhanced Notifications in Windows 10

:)

 

Turn On Windows Defender Block Suspicious Behaviors in Windows 10  

The DWORD is set to 0 and I cannot get the process you suggested in the "NOTE" portion of the tutorial to work. Two attached screen shoots will show the before and after attempts to change the Permissions necessary for access to the DWORD change.




Access is denied. (Note-Protected folder in Defender is turned off)

 

Turn On Windows Defender Block Suspicious Behaviors in Windows 10  

I don't have that toggle to turn on/off.....it's missing.

 

Turn On Windows Defender Block Suspicious Behaviors in Windows 10  

Thanks, I've come to the conclusion just to wait on using Windows Security to "Block Suspicious Behaviors" at this time. Pretty obvious Microsoft has not completed the development of this feature. Most likely similar effect can be found using gpedit/Administrative templates/ and then enabling Block at First Site and Behavior Monitoring within Defender settings. No regediting necessary. Hey it's just Insider.*Banghead

 

Block Suspicious Behaviors Setting (Windows 10)

Hi

Although all my Windows 10 Updates are 'up-to-date', I'm not sure if those Updates include the Windows Redstone 5 Update which (among other things) was suppose to have an 'optional' Security Setting that Users could switch on called: Block Suspicious Behaviors.

I've looked at the Security Centre in my Windows Settings (and also searched my PC using the Term 'Block Suspicious Behaviors') but can't find this Setting - so, therefore, can't switch it on.

Has Windows Redstone 5 been rolled out to Users for quite some time, or could it be that it's still in the process of being rolled out?

The other possibility, I guess, is that the 'Block Suspicious Behaviors' On/Off 'Option' has been withdrawn and is now 'Automatically' switched On.

How can I check if I've had Redstone 5?

Any Info, please, on this Check Suspicious Behavior 'Option' (as I want to switch it on)

Thanks in advance for any Comments / Thoughts / Assistance.

 

Turn On Windows Defender Block Suspicious Behaviors in Windows 10  

hi Brink, it seems that the toggle that manages Block suspicious behavior has been removed in 1809 (17763.x):
could you check it?