Windows 10: Windows 10 Exploit Guard

One of the mitigations available in exploit guard feature is "Do not allow child processes".


We can configure it in the group policy using rules to apply it on the system.


I am looking for more details on how does this work. I do not think so system can work without having processes create child processes and I believe maybe the exploit guard is mitigating this on demand or for a specific use case rather than applying system-wide?


PS: I know there's a powershell cmdlet to apply it for a particular process/binary but what about if we configure it in the group policy as indicated in general configuration steps?

:)

 

Bug? In Windows Defender Exploit Guard.

If we assume that this is just a glitch, then you might be able to reset the Exploit protection defaults by exporting the settings from an unaffected PC (with default settings) and then importing those settings on the affected machines. This looks
to be the backup/restore tool for the Exploit protection settings:

https://docs.microsoft.com/en-us/wi...ard/import-export-exploit-protection-emet-xml

Export and Import Exploit Protection Settings in Windows 10

 

Does Windows Defender Exploit Protection log anywhere?


Does this document helps?

*Arrow docs.microsoft.com | list-of-all-windows-defender-exploit-guard-events

and docs.microsoft.com | evaluate-exploit-protection

 

network protection, a feature in windows defender exploit guard, doesn't work right

In case it still isn’t clear; the Windows IT Pro Center documentation gets cited in discussions of the Windows Defender Exploit Guard features because it’s the most comprehensive documentation for all of these next-gen features, including the Network
Protection feature. That shouldn’t be taken to imply that any of these technologies are limited to enterprise environments, or that the topic is limited to security administrators. If you’re looking for the simplified documentation, it's right here:

Enable Windows Defender Exploit Guard Network Protection in Windows 10

And yes, I can personally guarantee that no Enterprise Security Administrator would ever be caught dead downloading Brink’s
Enable_Windows_Defender_Network_Protection.reg file. That file is for Windows 10 Home users who are afraid of the PowerShell command line.