Windows 10: Turn On or Off Windows Defender Application Guard in Windows 10

How to: Turn On or Off Windows Defender Application Guard in Windows 10

How to Turn On or Off Windows Defender Application Guard for Microsoft Edge in Windows 10


Microsoft Edge is a new web browser that is available across the Windows 10 device family. It is designed for Windows 10 to be faster, safer, and compatible with the modern Web.

Announced last September 27th 2016 in the Fast ring.

Starting with Windows 10 Enterprise build 16188, Microsoft has made it easy to test drive Microsoft Edge with Application Guard.

Microsoft Edge running in Application Guard provides enterprises the maximum level of protection from malware and zero day attacks against Windows. Windows Defender Application Guard for Microsoft Edge is a lightweight virtual machine that helps isolate potentially malicious website activity from reaching your operating systems, apps, and data.

There is no persistence of any cookies or local storage when an Application Guard window is closed in Microsoft Edge.

Three core features of Windows Defender Application Guard:

• Isolated Browsing - Windows Defender Application Guard uses the latest virtualization technology to help protect your operating system by creating an isolated environment for your Microsoft Edge session.
• Help Safeguard your PC - Windows Defender Application Guard starts up every time you visit a non-work-related site to help keep potentially malicious attacks away from your PC.
• Malware Removal - Any websites you visit, files you download, or settings you change while in this isolated environment are deleted when you sign out of Windows, wiping out any potential malware.

Starting with data persistence while using Application Guard. Once enabled, data such as your favorites, cookies, and saved passwords will be persisted across Application Guard sessions. The persisted data will be not be shared or surfaced on the host, but it will be available for future Microsoft Edge in Application Guard sessions.

Starting with edition.

For more details about Application Guard, see:

• Windows Defender Application Guard Companion | Microsoft Store
• Windows Defender Application Guard (Windows 10) | Microsoft Docs
• Windows Defender Application Guard inside Windows Security App - Microsoft Tech Community
• Windows Defender Application Guard Standalone mode - Microsoft Tech Community
• ​Windows Defender Application Guard extensions for Chrome and Firefox

This tutorial will show you how to turn on or off the Windows Defender Application Guard for Microsoft Edge security feature for all users in Windows 10 Pro and Windows 10 Enterprise.

You must be signed in as an administrator to turn on of off the Windows Defender Application Guard for Microsoft Edge security feature.

*note In Windows 10 build 16193, Windows Defender Application Guard (WDAG) will fail to work on touch PCs, showing a solid black window on launch. Non-touch enabled devices should not experience the issue. A temporary workaround if you would like to use WDAG is to go to Device Manager, expand Human Interface Devices and disable the HID-compliant touch screen and Intel Precise Touch Device if they are present. After a reboot try WDAG again. Re-enable these devices to restore touch.


CONTENTS:

• Option One: Turn On or Off Windows Defender Application Guard for Microsoft Edge in Windows Features
• Option Two: Turn On or Off Windows Defender Application Guard for Microsoft Edge in Windows Security

VIDEOS: Windows Defender Application Guard for Microsoft Edge













OPTION ONE [/i] Turn On or Off Windows Defender Application Guard for Microsoft Edge in Windows Features
1. Open Windows Features.

2. Do step 3 (on) or step 4 (off) for what you want to do.


3. Turn On "Windows Defender Application Guard" Feature for Microsoft Edge
A) Check both the Hyper-V and Windows Defender Application Guard box, click/tap on OK, and go to step 5 below. (see screenshot below step 4)

*note Windows Defender Application Guard requires Hyper-V to also be turned on.

If either feature is grayed out, then you will need to enable virtualization in your UEFI firmware settings, and try again.

4. Turn Off "Windows Defender Application Guard" Feature for Microsoft Edge
*note This is the default setting.
A) Uncheck the Windows Defender Application Guard box, click/tap on OK, and go to step 5 below. (see screenshot below)





5. When Windows has completed the requested changes, click/tap on Restart now to restart the computer and finish turning on this feature. (see screenshot below)



6. If you turned on the "Windows Defender Application Guard" feature, users on the PC will now be able to open an Application Guard window in Microsoft Edge. (see screenshots below)










OPTION TWO [/i] Turn On or Off Windows Defender Application Guard for Microsoft Edge in Windows Security

*note This option is only available starting with Windows 10 build 17713.
1. Open Windows Security, and click/tap on the App & browser control icon. (see screenshot below)



2. Do step 3 (on) or step 4 (off) for what you want to do.


3. Turn On "Windows Defender Application Guard" Feature for Microsoft Edge
A) Click/tap on the Install Windows Defender Application Guard link under the Isolated browsing section. (see screenshot below)



B) If prompted by UAC, click/tap on Yes to approve.

C) Check both the Hyper-V and Windows Defender Application Guard box, click/tap on OK, and go to step 5 below. (see screenshot below step 4C)

*note Windows Defender Application Guard requires Hyper-V to also be turned on.

If either feature is grayed out, then you will need to enable virtualization in your UEFI firmware settings, and try again.

4. Turn Off "Windows Defender Application Guard" Feature for Microsoft Edge
*note This is the default setting.
A) Click/tap on the Uninstall Windows Defender Application Guard link under the Isolated browsing section. (see screenshot below)



B) If prompted by UAC, click/tap on Yes to approve.

C) Uncheck the Windows Defender Application Guard box, click/tap on OK, and go to step 5 below. (see screenshot below)





5. When Windows has completed the requested changes, click/tap on Restart now to restart the computer and finish turning on this feature. (see screenshot below)



6. If you turned on the "Windows Defender Application Guard" feature, users on the PC will now be able to open an Application Guard window in Microsoft Edge. (see screenshots below)






That's it,
Shawn


Related Tutorials

• How to Open a New Application Guard Window in Microsoft Edge in Windows 10
• Enable Microsoft Edge Data Persistence with Windows Defender Application Guard in Windows 10
• Enable Download to Host from Windows Defender Application Guard Microsoft Edge session in Windows 10
• How to Turn On or Off Save Data in Application Guard for Microsoft Edge in Windows 10
• How to Turn On or Off Copy and Paste in Application Guard for Microsoft Edge in Windows 10
• How to Turn On or Off Printing in Application Guard for Microsoft Edge in Windows 10
• How to Turn On or Off Camera and Microphone in Application Guard for Microsoft Edge in Windows 10
• How to Turn On or Off Advanced Graphics in Application Guard for Microsoft Edge in Windows 10

:)

 

Windows Defender "Real Time Protection" will not disable

So my group policy editor does not look as shown in that guide.

There is no policy entry titled "Windows Defender" It is split into multiple headings "Windows Defender Antivirus" , "Windows Defender Application Guard", and "Windows Defender Smartscreen"

The "Windows Defender Antivirus" entry has a policy "Turn off windows defender antivirus" which is enabled, but the real time protection slider is unaffected by this setting. Is this another policy that can be edited?

 

Your Organization used Device Guard to block this app - contact your support person for more info

Device Guard is part of Windows Defender Security Suite

If this is a personal Computer it would be rare for it to be turned on

If it is a Company/organisation computer, it has been set by your IT admiistrator

If it is a personal computer, see the article below on how to turn off Device Guard:

https://www.tenforums.com/tutorials/68913-enabl...

 

Hi Brink.
Having a problem trying to set up WDAG.....any suggestions?....This on Insider Build 17063.

 

Hello @dencal, *Smile

The bit below from the release notes of Windows 10 build 17063 indicate that WDAG will not be available to the Windows 10 Pro edition until the next build release instead.

For now, WDAG is still only available for the Windows 10 Enterprise edition.

 

To be truthful Brink I had noticed your highlighted "next feature update".
This conflicts with a note further down concerning this feature.....but I take note of your response.

It is available now to our awesome Windows Insider community to give it a try and we would like to hear your feedback.

 

Yeah, the article they also linked to below states this, but it is dated "12-01-2017 - last edited Tuesday". I guess they decided to wait until the next build release after 17063.

Announcing WDAG in PRO SKU - Microsoft Tech Community

It certainly does confuse this.

 

Thank you Brink for clarifying the situation.

 

@dencal,

I just tested in a Windows 10 Pro build 17063 to verify, and I was actually able to enable WDAG after all. *Party

 

Brink.
Unfortunately cannot do as WDAG is greyed out, stating...Cannot be installed: Virtualisation support is disabled in the firmware.


Added
Have successfully enabled Virtualisation in the bios and have now New Application Guard window installed.

 

I would *love* to enable this feature and give it a try but I rely on VMware Workstation every single day (and am not willing to use HyperV for my VMs) so will I ever be able to use WDAG with VMware Workstation installed as well?

 

*Thumbs
I bet you're right Andre.
Windows keeps features compressed until they are turned on, either at OOBE or later by the user.
And .wim is basically a glorified zip format.

 

Another interesting find Shawn.
In C:\Windows\Containers there are two .wim files of Windows.




Maybe to be mounted as a sandbox pseudo VM`?

 

Not sure, but it would be interesting to find more official info about "WindowsDefenderApplicationGuard.wim".

 

,wim's are @Kari's specialty, maybe he could create a VM with both.*Wink