Application Guard¶
Microsoft Defender Application Guard opens untrusted websites and Office documents inside a throwaway virtual machine. If the page exploits the browser, the exploit lands in a container that's destroyed when the tab closes. It needs virtualization support, so it may not run inside a VMware image, but the policies can be set regardless.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Application Guard.
The settings¶
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.10.43.6 | Turn on Microsoft Defender Application Guard in Managed Mode | Enabled: 1 | Turns it on for Edge |
| 18.10.43.1 | Allow auditing events in Microsoft Defender Application Guard | Enabled | What happens in the container gets logged |
| 18.10.43.2 | Allow camera and microphone access in Microsoft Defender Application Guard | Disabled | An untrusted site can't reach the webcam |
| 18.10.43.3 | Allow data persistence for Microsoft Defender Application Guard | Disabled | The container is wiped every time; nothing (cookies, downloads) survives |
| 18.10.43.4 | Allow files to download and save to the host operating system from Microsoft Defender Application Guard | Disabled | Downloads stay in the container |
| 18.10.43.5 | Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting | Enabled: Enable clipboard operation from an isolated session to the host | Copy out of the container is allowed, paste in is not, so credentials can't be pasted into an untrusted site |
Install it¶
Enable-WindowsOptionalFeature -Online -FeatureName Windows-Defender-ApplicationGuard -NoRestart
Or optionalfeatures → Microsoft Defender Application Guard.
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\AppHVSI"
AllowAppHVSI_ProviderSet 1, AuditApplicationGuard 1, AllowCameraMicrophoneRedirection 0, AllowPersistence 0, SaveFilesToHost 0, AppHVSIClipboardSettings 1.