-
Home
-
News
- What Is Exploit Protection? How to Enable It on Windows 10/11?
By Aurelie | Follow |
Last Updated
Exploit Protection is a new feature in Windows Defender. To know what it is and how to enable it on Windows 10/11, scroll down in this post on MiniTool Website to find the detailed instructions.
What Is Exploit Protection?
Exploit Protection is one of the features in Windows Defender that can protect your computer from the infection of malware that uses security exploits. There are two mitigations in Exploit Protection – system level and program level.
How to Enable Exploit Protection Windows 10/11?
After knowing what Exploit Protection is, let me show you how to access this feature on Windows 10/11:
Step 1. Go to Settings > Update & Security > Windows Security > App & browser control > Exploit protection settings.
Step 2. As you can see, the settings are divided into two tabs – System settings and Program settings.
Under System settings, you can see the following options:
- Control flow guard (CFG)
- Data Execution Prevention (DEP)
- Force randomization for images (mandatory ASLR)
- Randomize memory allocations (Bottom-up ASLR)
- High-entropy ASLR
- Validate exception chains (SEHOP)
- Validate heap integrity
Under Program settings, you can add program to customize by either hitting Add by program name or Choose exact file path. Also, adding the program by hitting it from the pre-populated list is permitted.
- Add by program name – allows you to apply migration to any running process with that name. You need to specify the file with its extensions.
- Choose exact file path – selects the executable file from the standard Windows Explorer file picker window.
Meanwhile, Exploit Protection allows you to export your settings in an XML file after hitting Export settings.
If you are using EMET and have saved its settings in an XML file, you can try importing the settings running the following command in Windows PowerShell:
Set-ProcessMitigation -PolicyFilePath myconfig.xml
Tips:
You need to replace myconfig.xml with the location and name of your Exploit protection configuration file.
How to Add or Exclude an App in Exploit Protection?
If the feature is enabled, some applications will be lagging or stuttering when launching them. This is pretty common in games, so you can disable Exploit Protection when gaming. Here’s how to add or exclude Exploit Protection for some selected application on Windows 10/11:
Step 1. Press Win + I to launch Windows Settings.
Step 2. In the settings menu, scroll down to find Update & Security and hit it.
Step 3. Under the Windows Security tab, click on App & browser control.
Step 4. Scroll down to find Exploit protection settings and hit it.
Step 5. Go to Program settings and click on Add program to customize to customize the settings. Choose from Add by program name and Choose exact file path.
Step 6. Here, we select Choose exact file path. Once found and selected, you will see a list of mitigation that can be applied. If you want to add the file in Exploit Protection, tick all the options. To exclude the file from Exploit Protection, untick the boxes marked against the app.
Step 7. Click on Apply to save the settings.
Step 8. Reboot your computer.
Another Way to Protect Your Data
Exploit Protection can protect your system from the attack of malware and viruses. At the same time, it is also important to secure your files and folders. There is another way for you to protect your data – back up your files and folders on an external hard drive via MiniTool ShadowMaker. With a backup copy in hand, even if your files are lost after a malware infection, you can restore them easily.
MiniTool ShadowMaker TrialClick to Download100%Clean & Safe
MiniTool ShadowMaker is a free and reliable backup software that is designed to create a backup for files, folders, partitions, systems and disks on Windows 11/10/8/7. It is green, convenient and practical. If you need to back up your important data, MiniTool ShadowMaker will be the top choice for you!
About The Author
Position: Columnist
Aurelie is a passionate soul who always enjoys researching & writing articles and solutions to help others. Her posts mainly cover topics related to games, data backup & recovery, file sync and so on. Apart from writing, her primary interests include reading novels and poems, travelling and listening to country music.
by Madalina Dinita
Madalina has been a Windows fan ever since she got her hands on her first Windows XP computer. She is interested in all things technology, especially emerging technologies… read more
Updated on
- If you enable the Exploit Protection on Windows Defender you will be protected against malware.
- It’s easy to do that by tweaking the settings within the App & browser control settings.
- You should also consider installing the latest OS updates to keep your system secure.
- A great way of protecting your PC is to get a dedicated antivirus with more advanced features.
XINSTALL BY CLICKING THE DOWNLOAD
FILE
Most people tend to say that we currently enjoy Microsoft’s most secure OS. The latest Windows 10 version features a series of new security features and improvements that close the door to malware attacks.
Windows 10’s main tool in the fight against malware is its built-in antivirus. Microsoft has added a bevy of new security features to Windows Defender, making it more powerful than ever.
Users can configure and the Windows system and app exploit mitigation settings with ease. It’s all done from the Windows Defender Security Center.
How can I enable Windows 10 Exploit Protection?
1. Enable Windows 10 Exploit Protection
- Start Windows Security by clicking on the shield from the notification area.
- Click on App & browser control.
- Scroll to the bottom of the screen to find Exploit Protection and click the Exploit protection settings.
- In the new window, customize the System settings and Program settings.
- When you’re done, click Apply and OK.
Perform the steps above steps to enable Exploit Protection for the system and installed programs. As you can see, it’s pretty easy to tweak the settings from Windows Security.
2. Additional actions to make sure that your PC is protected
Apart from customizing the Exploit Protection settings, you need to carry out a series of additional actions to make sure that your computer is fully protected against malware:
- Install the latest Windows updates
- Upgrade to the latest OS version available
- Run a full system scan periodically
- Install additional anti-malware tools compatible with your main antivirus, etc.
3. Try out a different antivirus solution
Even if it’s incredibly intuitive, Windows Defender has serious cybersecurity and online banking safety issues.
In the meantime, the tool recommended below is popular all over the globe for a good reason. Firstly, this antivirus is surprisingly lightweight and has little to no impact on the system.
Moreover, it’s known for its accurate malware blocking and it’s fully compatible even with earlier Windows versions.
Some valuable bonus features include parental control features, a useful vulnerability scanner, and a VPN.
ESET Smart Security
Get to the next level of protection with a trusted, light but strong security tool for your PC.
We hope that our guide helped you learn how to turn on the Exploit Protection for your system and apps in Windows 10.
The exploit protection is also very useful with Windows 10 gaming so make sure you activate it for your favorite tiles.
However, you should know that the built-in antivirus is not the most secure way of protecting your PC. Check out our best antiviruses with unlimited licenses to get a third-party security tool.
Have you tested out these security features available on Windows 10? Let us know what you are thinking by using the comments area below. Your thoughts may help other users like yourself.
Защита от эксплойтов (Exploit Guard) — эта новая функция в Windows Defender в Windows 10 1709, которая представляет собой объединенную и более улучшенную версию инструмента EMET от Microsoft. Exploit Guard предназначен для защиты компьютера от эксплоитов, и заражения вашей системы вредоносными программами. Специально активировать Защиту от эксплойтов не нужно, это происходит автоматически, но только при включенном защитнике Windows.
Изменить параметры Exploit Guard по умолчанию можно в Центре безопасности Защитника Windows.
- Получить к нему доступ можно через меню Пуск или Параметры (Windows + I). Настройки будут производиться именно через Центр Безопасности, а не Параметры Защитника. Учитывайте это при использовании быстрого поиска.
- В появившемся окне перейдите в меню «Управление приложениями и браузером».
- Пролистайте страницу в самый низ и выберите «Параметры защиты от эксплойтов».
Всего есть две основные категории для изменения конфигураций на компьютере. Рассмотрим каждую из них более подробно.
Системные параметры
Здесь отображается список доступных пользователю механизмов защиты Windows. Рядом указывается статус — включено, отключено. Доступны:
- CFG. Защита потока управления и обеспечение его целостности для совершения непрямых вызовов (включена по умолчанию).
- SEHOP. Проверка цепочек исключений и обеспечение ее целостность во время отправки.
- DEP. Предотвращение выполнения данных (включена по умолчанию).
- Обязательный ASLR. Принудительное случайное распределение для образов, которые не соответствуют /DYNAMICBASE (выключена по умолчанию).
- Низкий ASLR. Случайное распределение выделения памяти. (включена по умолчанию).
- Проверка целостности кучи. В случае нахождения повреждений, процесс автоматически завершается. (включена по умолчанию).
Пользователь может отключить их независимо друг от друга.
Параметры программ
В этом разделе можно отдельно редактировать дополнительные настройки защиты для каждого исполняемого файла, добавлять их в список исключений. Если ПО конфликтует при каком-либо активированном в системных параметрах модуле, то его можно отключить. При этом настройки других программ останутся прежними.
Опция работает по тому же принципу, что и исключения в инструменте EMET от Microsoft. По умолчанию здесь уже находятся некоторые штатные программы Windows.
Добавить новый исполняемый файл в список можно здесь же, нажав на кнопку «Добавление программы для индивидуальной настройки». Для этого укажите название программы или точный путь к ней. После этого он отобразится в списке.
Пользователь может редактировать параметры для каждой отдельной программы. Для этого выберите ее из списка, и кликните «Редактировать», после чего принудительно выключите/ включите нужную опцию. По желанию программу можно удалить из списка исключений.
Для редактирования доступны только те параметры, которые невозможно настроить через категорию «Системные». Для некоторых опций доступно значение «Аудит». После его активации Windows будет записывать события в системный журнал, что удобно для дальнейшего анализа.
Импорт и экспорт настроек
Экспортировать текущие настройки Exploit Guard можно через Центр безопасности Защитника Windows. Для этого достаточно нажать на соответствующую кнопку и сохранить файл в формате XML.
Экспортировать настройки можно и через командную строку Windows PowerShell. Для этого есть команда:
Get-ProcessMitigation -RegistryConfigFilePath C:\Users\Alex\Desktop\Settings.xml
Для импорта необходимо заменить командлет Get на Set и по аналогии с примером указать название и путь к файлу.
Установить уже существующий XML файл с настройками можно через редактор локальных групповых политик gpedit.msc:
- В левой части экрана перейдите в ветку редактора Конфигурация компьютера —> Административные шаблоны —> Компоненты Windows —> Exploit Guard в Защитнике Windows —> Защита от эксплойтов. Откройте политику Используйте общий набор параметров защиты от эксплойтов.
- Измените значение на «Включено», а в появившемся поле укажите путь или URL- адрес к существующему XML файлу с конфигурацией.
Сохраните внесенные изменения нажав на «Применить». Настройки вступят в силу немедленно, поэтому перезагружать ПК не обязательно.
Настройка Exploit Guard с помощью PowerShell
Для редактирования списка модулей защиты можно использовать командную строку Windows PowerShell.
Здесь доступные следующие команды:
-
Get-ProcessMitigation -Name iexplore.exe
— получить список всех защитных мер для выбранного процесса. В данном примере это iexplore.exe, вы можете указать любой другой. Вместо имени программы, можно указать точный путь. - Состояние NOTSET (не установлено) для категории системных параметров означает, что выставлены значения по умолчанию, для категории программ здесь следует вписать параметр, к которому будут присвоены меры защиты.
- —Set с добавочной командой ProcessMitigation используется для редактирования каждого отдельного значения. Чтобы активировать SEHOP для конкретного исполняемого файла (в нашем примере test.exe) по адресу C:\Users\Alex\Desktop\test.exe, используйте команду в PowerShell:
Set-ProcessMitigation -Name C:\Users\Alex\Desktop\test.exe -Enable SEHOP - Чтобы применить эту меру для всех файлов, а не для конкретной программы, используйте команду:
Set-Processmitigation -System -Enable SEHOP - -Enable — включить, —Disable — отключить.
- Командлет —Remove используется для восстановления настроек по умолчанию и указывается сразу после —Name.
- -Enable или —Disable AuditDynamicCode — активировать или выключить аудит.
При вводе команд учитывайте, что каждый отдельный параметр меры должен отделяться запятой. Посмотреть их список вы можете здесь же, в PowerShell. Они отобразятся после ввода команды
Get-ProcessMitigation -Name имя_процесса.exe
.
Keeping your PC safe is one of the most challenging things to do. Today, anything which is not from a reliable source can be dangerous. Keeping this in mind, Microsoft, in terms of security, has massively improved Windows, but a few vulnerabilities can still cause severe damage. Hence, having Exploit Protection enabled is a must!
But what is Exploit Protection? Is it enabled by default or not? This post will answer these questions and explain how to implement Exploit Protection.
What is Exploit Protection, and How Does it Work?
Every Windows PC has many vulnerabilities that make it prone to security breaches and threats. To mitigate these, Windows Exploit Protection and a few precautions are required.
Fact – PC’s security is at risk if it stays connected to the internet all day.
Moreover, these vulnerabilities allow cyber attacker to make their way into the PC and play around.
Common Security Risk
- Insecure internet connection.
- Loopholes in PC security.
- Network Vulnerability.
- Outdated Operating System.
- Process Vulnerabilities.
How To Stay Protected from Zero Day Attacks
Exploit Protection is a shield for your PC and helps mitigate the risk caused due to vulnerabilities. Simply put, Windows security Exploit Protection ensures that the weak points of your PC are not targeted, and the user gets notified of any breach it might encounter.
Must Read: How Does an Antivirus Protect Your PC
2 Ways to Enable Exploit Protection on Windows
The latest versions of Windows come with essential Exploit Protection. However, to ensure it is working, it must be enabled. Also, you can customize it as per your usage. Here we explain two ways in which Exploit Protection can turn on.
Method 1 – Using the Windows Security App
- Open Start Menu and Search for Windows Security Application.
- Open it and navigate to App & browser control.
- Look for Exploit Protection settings under Exploit protection and click on it!
- You will see two sections here – System settings and Programme settings.
- Using these settings, you can configure Exploit Protection settings. To protect the application, navigate to program settings > Add programme to customize.
- This way, you can configure Exploit Protection for added applications.
- If you want you can edit these settings and configure them as per your requirement. The default values are loaded automatically.
- Once done configuring the program settings, switch to system settings. Any application unavailable in the program settings will be taken care of by the system settings configuration and can be customized.
- The dropdown has three options to configure your system settings. – On by Default, Off by Default, Use Default.
- You can either make the changes and turn it off, which is not recommended, or keep it on the default settings. However, Use default (On) option makes customizing the system and program settings easy.
Using these simple steps, you can enable Exploit Protection. However, there are times when you are unable to turn it on and get the “This setting is managed by your Admin” error.
Usually, the error results from modifications made to system settings without admin rights or a bug in the Windows Security Application. You will need a few fixes in both cases to make the setting work. Until then, are you ready to risk your data and PC security? If not, we have a solution for you try T9 antivirus, which comes with Exploit Protection, malware protection, real-time scanning, and other advanced security shields.
Also, as you can see, setting up Exploit Protection is quite time-consuming, and technical knowledge is required. This makes enabling Exploit Protection difficult. Due to this also, finding an easy way out to stay protected is also asked for. Below we explain how you can keep your PC shielded without getting into technicalities.
Method 2 – Use T9 Antivirus
The most straightforward and less time-consuming method you can implement is a dedicated antivirus program that offers Exploit Protection for your PC. T9 antivirus software is the perfect example. Here’s how it works –
- Download and install T9 Antivirus on your PC.
- Run the application.
- On the left panel of your home screen, you can find a shield icon option. Click on it to access all the shields.
- Here, you can find the Exploit Protection shield. Enable it to stay protected from zero-day attacks.
- Since T9 is a reliable protection program, it enables the configurations by default. This means you do not have to worry about the same.
With the help of T9 antivirus, setting up Exploit Protection is easier. You can rely on it for Web Protection as well. It hardly takes 5 minutes to turn it on, and the best part is that you do not have to configure it manually to make it work!
Do Not Let Anyone Exploit Your Privacy!
Privacy and security should be the top priority of any internet user. Like anything exposed to danger, your PC also has a few vulnerabilities that should be taken care of, and Exploit Protection does precisely that.
If you feel intimidated by the number of settings and steps you need to finish to enable Exploit Protection on your computer, use the T9 antivirus, as it is safe and secure!
That brings us to the end of this post; I hope you find it helpful! Don’t forget to download the T9 antivirus and take care of your PC’s protection! Good Luck!
Recommended :
Should You Rely on Your Antivirus for Web Security
How To Test If Your Antivirus Is Effective Or Not
How Does An Antivirus Protect You Against Hackers
Top Ways To Disable Avast Antivirus