Secure Windows Operating Systems

0:00Welcome to the content on securing the Windows server operating system. Now this is an interesting one especially in the latest edition of the AZ-801. Why is it interesting? Well they're taking things in a little bit of a different direction now because we finally have some new topics to talk about. Something like OS config. Now still there's some oldies but goodies things that we've done for 30 years now like setting password policies and user rights assignments but like I said there are a couple new things that we're going to talk about like OS config. So get ready as we talk about the basics of securing the Windows Server operating system primarily through GPO but now with some other new utilities too. Let's go!

0:00We are beginning to securing Windows Server operating systems and importantly Windows desktop operating systems by talking about exploit protection. Now exploit protection does exactly what its name says it's going to do. It's going to protect you from exploits typically coming in through files. You could almost think about this as like malware scanning and file scanning but what's interesting is in a lot of applications even well known good applications it can execute code that is still problematic. For instance Outlook. Outlook is a safe application to download and install. Now it can be painful to use sometimes right but that doesn't mean bad things can't happen within Outlook because ultimately Outlook's job is to get email, download applications, download images and exploits can come in through that. So as the landscape has changed over the years exploits and malware and everything have become incredibly sophisticated and Microsoft has been on top of this. Now we starting off by looking at the documentation it's more like a you are here. We are looking at reducing our attack surface and exploit protection was going to attack surface

1:19reduction exploit protection as you can see is just one of the things that we do to reduce our attack surface and then there's some other interesting things that I want to point out here in the documentation. It says this applies to exploit mitigation techniques and it begins with Windows 10 version 1709 and Windows 11 and Windows server version 1803 that's really 2016 but that was 2016 plus two or three years. This was a feature update that really started to roll out the exploit protection feature. Ultimately what the high-level overview is is it is a malware scanning application that is always on is always enabled by default and it basically runs a bunch of different algorithms and scanning detection things across all applications and all operating systems that meet these baseline requirements and above. There's not really anything that you need to configure because it's already on. Now it says here you can enable exploit protection on an individual device and then use GPOs to distribute an XML file to multiple devices once it's done but the kicker

2:37here is if you've got these operating systems it's already on. So there's not a lot that you need to do unless you need to enable or override specific applications to not use specific malware scanning algorithms. Let me show you. Here's Windows 11. This is where we're going to start and from Windows 11 I'm going to go and just type in security and we'll bring up Windows security right here. So we'll click on it and it'll load up and much like we've got the attack surface reduction and the documentation that a bunch of different facets the Windows security has a bunch of different facets too. Explained protection is under app and browser control. So we'll give this a click and right here you see exploit protection right here. This is one of the things that we do. So if we want to look at the exploit protection settings we can give that a click and as you can see the default settings for the system wide configurations for all of these is set to on. You don't have to do anything to turn this on. This is using AI machine learning signature updates and everything like that behind the scenes. So we've got data execution

3:55preventions and unless you're a security person like really really deep in the security a lot of this is just going to sound like a lot of big words and fancy stuff prevents code from being run from data only memory pages. Randomize memory allocations. I actually think this one is really cool. Randomize locations for virtual memory allocations that way an application or you know malicious code can't execute in the same memory space every time and being predictable. Things like validating heap integrity terminate a process when heap correction is detected. These are the things that happen on a system wide level across all applications. But let's say for a second you need to change this or more specifically target a specific application probably one that you've built in house to override you know this setting and turn that in particular algorithm off. We can go in to program settings and then you'll scroll until you find the specific application that you're looking for.

5:02Maybe it's something like print dialog.exe. You notice here there's already some system overrides in place because it would guarantee come with you know some sort of trigger that would stop this application from ever working. We can click edit here and you can take a look at what that specific override is when we scroll down. They have override disable extension points. Disable various extensibility mechanisms that allow DLL injection into all processes such as Windows hooks. Again unless this is kind of your jam you probably don't know what that means and that's okay. You should just know at least for the exam that the point of exploit protection is that on an application level there are all of these you know algorithms running at a given point to stop threats from happening. Let's say for a second we want to override validate image dependency integrity and turn it on. We'll click apply here and now we've created an override specific to that exe. So that's what we've done on this one particular box. But what happens when we have 300 devices or 300 boxes in our environment that we now need to make this configuration change on. Does that

6:22mean I need to go from one desktop to the next and turn this override on manually? No. We can export all of these settings out to an XML file. I'll click export settings right here. It'll ask me where do you want to save this. I'll put it on my desktop and I'll change this name to be something like exploit settings and you can see the type is an XML file. I'll click save and sure enough we've now got exploit settings.xml on my desktop. So what I can do now is I can move this to a file share and that way I can then mass deploy that file throughout my entire environment. So I'll copy this file and I'll move this over to something like a file share or domain controller and we'll take a look at how to deploy this via GPO. So from my Windows server device I'll paste this in right here and as you can see there's the exploit settings XML file and now what I need to do is create a GPO that can mass deploy this. Now very important for you to understand this needs to be on some sort of file share or UNC path. So what I 'll do is I'll create a folder real quick. We'll call this exploit settings. I'll

7:39go ahead and just share it real quick for this lab environment to get it up and running you would obviously create this with a little bit more permissions than available to everyone read level is fine done and close. I'll move exploit settings into that folder and now we're good to go from there. So now that it's in a place where any one or any device can get to it we can open up server manager go into group policy management we'll expand the forest we'll expand the domain and we'll edit the default domain policy. So I'll double click on this or excuse me I'll right click on this and say edit and then we'll start working on a computer configuration. So from here we are editing a policy it is an administrative template which it will spin while it expands we'll go down to Windows components and then we'll go nice and big as we begin to scroll we're gonna look for the M's Microsoft Microsoft defender exploit guard is what we're looking for here and then in exploit protection here's the the policy use a common set of exploit protection settings. So we will edit this we will

9:00enable it and the path will be the the path to reach that XML file. So in this case I put it on DC NUG and then it goes into the share was exploit settings and the file was exploit settings dot XML we could comply we click okay we can run a GP update slash force if that's what we want to do and at this point we've now mass deployed a custom configuration for exploit protection but keep in mind everything is enabled by default from basically Windows 10 and on so you should be okay to leave things as you want and this is only on an as needed basis.

0:00Have you ever fired up your edge browser, navigated through some websites, and then ultimately got hit with some sort of warning that said, hey, you should rethink about proceeding onto this next website. We've detected some anomalous behavior or an expired SSL certificate, or some other signature or problem that is warning you that you should not proceed to this next website. The logic behind where it got the idea to not proceed to that next website, to generate the warning is Microsoft Defender Smart Screen or Windows Defender Smart Screen.

0:39They oscillate between Microsoft Defender and Windows Defender. They've been bouncing back and forth. So the point is, is Edge gets its logic on whether or not to generate this warning using the Defender Smart Screen. Now, if you want to start off on Windows 11, we can take a look at it again by searching for security, we'll bring up Windows security, and we'll go again into app and browser control. Instead of exploit protection this time, we're now working on reputation-based protection this time.

1:12So when I go into reputation-based warnings here, you really see two instances of Smart Screen. The first one is Smart Screen for Edge, and it's just as simple as turning it on. Microsoft Defender Smart Screen helps protect your device from malicious sites and downloads. That's what pops up all the warnings prompting you that you should rethink proceeding. Now, there's also a Smart Screen for Microsoft Store apps. The kicker here is on Windows Enterprise editions.

1:42Lots of times, not always, but lots of times, enterprises shut down the Microsoft Store, and there's not even a Microsoft Store that ships with an Enterprise edition of the operating system. So we're really focused on Smart Screen for Edge, especially when it comes to group policies. 'Cause here's the real kicker. First of all, we can turn Smart Screen on or off in the operating system. We can tell it, like, don't even warn me, I'm just gonna do it anyways. And then second of all, you know, as the end user sits right now, they're sitting there, they're browsing on this website, it warns them, don't download this file or don't proceed, and they can still ignore that and proceed on anyways.

2:24As a systems administrator, you have the ability to, first of all, lock Smart Screen to being on, and then secondly, enforce whether or not they're even allowed to proceed if they wanted to. So take a look at this. If I'm back on the default domain policy again, we'll edit it, we will go full screen, expands out a little bit, we'll go again down the same tree, policies, administrative templates, windows components. This time, instead of Microsoft Defender, I believe it's under Windows Defender, and there it is, Windows Defender Smart Screen.

3:01Now, there is Internet Explorer still here, for some reason. I don't think we're really gonna talk about Internet Explorer much more ever again, hopefully. And I doubt you'll see it on an exam, but Microsoft Edge, that's what we're here to do. So first of all, we've got Configure Windows Defender Smart Screen. This is just turning it on or off, okay? When we enable this setting, like it says right here, Windows Defender is turned on and employees can't turn it off. If we disable it, it's turned off and employees can't turn it on.

3:35And if we don't configure this setting, employees can figure out whatever, they can choose whether or not they want to enable it or not. So by doing this, by just turning this on, immediately Smart Screen is enforced to be on, it is enabled, and that's what we want. Secondly, do we want to bypass the Smart Screen prompts for these websites? If we enable this setting, employees can't ignore the Smart Screen warnings, and they are blocked from continuing to the site.

4:08If we disable this settings, or importantly, or if we don't configure this setting, employees can ignore the warnings and continue to the site. So enabled means they can't continue to the site. Disabled or not configured means they can't. So we're gonna apply this, and just like that, we've now got an extra layer of Smart Screen protection from the browser.

0:00Now, we're getting into old faithful and this is going to be account policies. What are we talking about when we say account policies? Usually we're talking about what are the things that an account can do, or more specifically, how do we manage the security of a specific account? This is passwords. At the end of the day, that's what this is. This is password. So now do we manage, they each account security and passwords. What we're going to do is we're going to expand our default domain policy.

0:31We're going to go into policies, Windows settings, security settings, and then right here you see account policies. Now really, the bulk of what we do within account policies, almost everything that we're going to do is going to be around the password policy and the lockout policy. I'm actually going to start with the lockout policy because it's pretty straightforward to understand. If you type your password incorrectly, you get locked out. What the lockout policy does is it defines what are the parameters that trigger the lockout and how long do you stay locked out.

1:07The account lockout threshold is three invalid attempts within 15 minutes. Reset the account lockout counter after 15 minutes. So if I make two incorrect attempts, but then wait 15 minutes and then on the 16th minute, make another incorrect attempt, that account counter has reset at that point. So I get a fresh new three attempts before I get locked out again, every 15 minutes.

1:40Now if I get locked out, how long does it keep me locked out by default? That's also set to 15 minutes. You might think that's not aggressive enough. It needs to be something more like you're locked out for 60 minutes or 10 hours or whatever it is. And that's what you need to do. The other thing is allow administrator account lockout. Can we lock out the local administrator account for typing in the wrong password? The answer here is right now it's not defined and we can either enable that or disable it.

2:12You can also click on explain to see if it determines whether or not you can lock out the built in administrator account. Honestly, this is a good opportunity to look into laps or the local administrator password settings, which we have a video on coming up at the very end of this skill. So just pause before you set the administrator account lockout, because there are better ways to handle the administrator password. So understanding that you get three invalid attempts within 15 minutes before you get locked out for, you know, what I've now set to an hour, that's the first thing you need to know about the account lockout policy.

2:52The password policy itself is another really good one. And where we always start with is password was meet complexity requirements. Click on explain here to understand what this really includes. This determines whether passwords meet complexity. If it's enabled, which it is by default, passwords must meet the following requirements. It cannot contain the user's account name or parts of the user's full name that exceed two consecutive characters.

3:22So I could have K in for, you know, Knox, but I can't have K in O or K in O X in my password. It must be at least six characters in length. It must contain characters from three of the following categories. So it needs to have an upper, lower number, or symbol, three of the four categories for that to kick in. So they can actually get away with upper, lower number without a symbol.

3:55And that would be good enough. So the things that you may want to think about is going back to the security settings and say, yes, is that good enough or not? Now, the only real thing that we can change with this is the password length. The password complexity says that we have to have at least six characters in length, but we actually have a minimum password length setting. And we might want to set this to be something a little more aggressive or I'm actually seeing a lot of people talking about like, we don't really care about this anymore because everything is moving to password lists or past keys for authentication.

4:38Now the other thing we have is enforced password history. So we are rotating passwords every 42 days with the maximum password age. If they don't change their password within 42 days, then at the 43rd day, they 're going to get prompted to change their password. They will not be able to reuse an old password for 24 42 day cycles. So it will be two and a half to three years before they can reuse an old password again.

5:14So that's really important to understand. Interestingly, if they've reset their password, they can't reset it again for 24 hours. It could look really suspicious if somebody's resetting their password every hour. Potentially there's been something malicious that's happened there. Now this one here might throw you off a little bit. Relax minimum password length limits. Now what is this all about? Well in legacy active directory, the maximum length of a password was 14.

5:48When we enable this, we're saying we can go beyond a minimum limit of 14 characters. That's what that's doing there. And it's important to understand that when we apply these password and account lockout policies, they apply to every single user account in the domain. There is a way, however, to override this for specific users or specific groups and give them an entirely different password policy. We have to do that through active directory administrative center by bringing this up right here.

6:23So how do I get to this? What we're going to do is we're going to go into the domain and then we're going to go into system and then we're going into password settings container right here . We can create a new custom password settings policy right here. You give it a name like my policy, you give it a precedence, which is a number of what is most important and what is least important. There used to be a tool tip here that said the lower the number, the higher the priority.

6:54So priority number one means its top precedence, this policy will apply first to which users. We click add right here and specify which users these belong to. And at this point, we can change the policies to be different. We can say a password history of 12, but a complex length of 11 and maybe rotate it every 30 days or something like that. So when we use this, we can do a targeted or what's called a fine-grained password that targets a specific group and applies a different policy to them.

0:00Now I'm excited to talk to you about a relatively new type of configuration style that we see this began to roll out as an executable in Windows Server 2022. And now that we fast forward to Windows Server 2025, it's basically a list of PowerShell commandless. The idea with OS config is that we can define what a desired state of configuration settings should be for a given operating system or a given device .

0:36And we can apply a broad spectrum of security settings and configurations with these PowerShell commandless. Now we do need to break down some terminology here. The first thing that you need to know or the first term that you need to know when working with OS config is the desired state. And you can think about this as more of the big picture is that there are large sets of topics of security TLS settings, SMB settings, firewall settings, network settings that all impact how the operating system should look and behave.

1:26Within that desired state, we have settings, and this is the actual configuration itself, like TLS version 1.0 is disabled. That's the kind of thing that you would set as, you know, many different settings within a single desired state. The last term that I want you to be aware of is a scenario.

1:58And this is really a template of desired state Microsoft provides scenarios out of the box for you to begin working with and building off of as a quick as a great way to fly wheel your start or kick start your beginning intro into OS config. Now the first thing you should know is that OS config does not ship with Windows Server 2025 by default. I believe it did on Windows Server 2022 as a .exe.

2:32But in Server 2025, they're transitioning this to PowerShell commandless, so you need to go out and install the modules. So what I'm going to do is paste in the commandlet install module name Microsoft OS config. We're going to say force to accept all the prompts that go along with that. So I'll press enter here and let it do its thing. Ah, yes, it tells me that we got to install the provider first. I will say yes to that and let it do its thing. This will take a little bit.

3:02So there we go. We've got it installed now. I ran the commandlet twice just to make sure. Now what we can do is explore what all this thing can do. Let's run the git command commandlet, but specify the whole module to see what options there are. So here I'll say module, the name of the module again was Microsoft dot OS config. And we see we don't have a whole lot of commandlets, but they're all the good ones. The big ones that we care about are things like get OS config desired configuration.

3:37We can also do get OS config drift control because one of the big points of infrastructure is code and setting a desired state is catching an operating system when it's drifted from the desired state. So as you can see, it really begins with a lot of just specifying or setting a desired configuration. And then understanding that catching it when catching the configuration when it drifts and pulling it back into the desired state is what matters.

4:12I want you to look at the documentation of where we go next. Once we've got it installed, the first thing we want to do then is apply a baseline scenario to the server. If we have a domain join server, we're going to apply the member server scenario. If it's a device that's just in a workgroup and it's not domain joined, we're going to apply the workgroup member scenario. If it's a domain controller, we're going to apply the domain controller scenario.

4:46There is a secured core baseline for a device scenario. And then there is a specific Microsoft Defender antivirus scenario that we can apply to. The box that I'm on right now is a domain controller. So I'm going to copy that commandlet, come back here and paste it in and press enter. It tells you you're about to install necessary metadata. This operation may take a while. So I'm going to let it take a while and come back to it when it's done.

5:19After about 60 seconds, it is all done. The necessary metadata was installed. There are 312 settings. A restart of the system is recommended to ensure changes take effect. Let's see what that desired configuration actually looks like. If I do get OS desired configuration specifying the exact scenario here for the domain controller, I can press enter. It'll process this again as you can see at the top right there. And when it's done, it'll come back here and spit out the results.

5:56Now, there's a lot of results as you can see. And what you're looking at is the individual setting for this specific configuration. And there are, well, a lot of different settings that you can look at here. I mean, you can keep scrolling up and you'll see things like user rights take ownership. And it tells you what the data type is, what the value currently is, which is kind of like a hash, even though it's an array. And you can see if the status is currently compliant and when it was last checked.

6:30If you're interested in a very specific setting, we can do something like copy the name of the setting like this one right here user rights modify firmware environment. So let me go ahead and highlight this and copy it. We'll press up, we can then add a setting parameter to it and then paste it in right here, run the commandlet again, and it'll target this scenario and that a specific setting, and we can look at the results right here.

7:02If at any point we need to override the setting, we can use the set OS config desired configuration commandlet instead. So let's take a look at audit detailed file share. This is an easy one to override and change because the value is an integer. So what I can do if I want to change this for any reason to be something like three reason is two is one of the allowed values two or three for severity critical.

7:32What we can do is we can press up well actually what we're going to do is we're going to do set OS config desired configuration. The scenario is this really long one right here and the setting is what I'm going to copy right for that to do. Control C, let's do control C, we'll paste it in right there. Now what I can do is set the value equal to three. So in the past we've gotten this specific configuration from this scenario with this specific setting.

8:06Now we're setting this configuration in this scenario, the name of the setting and what the value is going to be. When I press enter here, we set the value to three. Takes a second or two. Any minute now do do do do do do and it says a restart of the system is recommended if I hit up a couple times we can confirm that this configuration is in place it is there.

8:36The default value is normally two but we have overridden it to three. So at this point we've actually been able to use setting an OS config. Now the final thing that I want you to see in OS config is that there is a commandlet that they give us for checking compliance with our security desired state baseline. If we flip back to the documentation under the check compliance tab here there is to check compliance details for a domain controller baseline, run the following commandlet.

9:06So I'll copy that commandlet, paste it in right here. It is a nice long command let. I expect it to take roughly 60 seconds or so to run the whole thing. So I'll let it spin. We'll check it out when it's done up there goes right there. So we get a list of all of the settings and whether or not we are compliant. We actually have a couple here right here that are not compliant. So those are things that can immediately alert me that I need to take action. Here's a couple others that are set to not compliant.

9:38So there we go. OS config is really really helpful and it gives us a way to set a configuration setting right out of the gate.

0:00Now I'm really excited to talk to you about LAPS. LAPS in my opinion receives the most improved award with Windows Server 2022 and Windows Server 2025. The idea here is that every machine in your entire environment, desktop or server or whatever has a local administrator account and that local administrator account has keys to that kingdom of that box. Still a critical piece of infrastructure. So managing that local administrators password is one of the most overlooked things in all of systems administration and it's still a huge security vulnerability. With LAPS we can let our active directory manage the local administrator passwords of all of our boxes. The domain controller and active directory will store the passwords in active directory and rotate them by default every 30 days. The password then which is stored in active directory can only be retrieved by domain admins or anyone

1:20else that we have explicitly granted read permissions too. So if for whatever reason anybody needed the local administrator account to box number one right here only the domain admins or the explicitly names people can get it by going to active directory and retrieving it. Then they can come over to this box and type in that password. So the idea here is that we have a secure manage password for an easily overlooked bit of infrastructure and security in our environment. This used to be a pain in the rear to deploy. We used to have to do things like Windows Server 2019 and older. We used to have to extend the AD schema before beginning. We then had to configure the GPOs to enable this. We still sort of have to do that. We still have to configure GPO settings. We then had to install a client executable or MSI on each of these boxes that we're going to be managed by it. That is no

2:37longer a thing. And then we had to grant the permissions to the people that we want to be able to read it. So now in Windows Server 2022 that's gone and installing the MSI is gone. We're now down to just turn it on in GPO and grant permissions. This is a huge deal and it is a huge win. Let's see how to configure it. First things first we're going to go into group policy management. We're going to edit the default domain policy. Under computer configuration we're going to go into policies, administrative templates, system . I'll expand this out so it's a little bit easier to see. And right there you will see laps.

3:29Where did it go? My eye just cut it left. Local administrator policy settings or password settings. So first things first configure automatic account management. That's where you want to start things. We're going to edit this and we're going to turn it on. Now specify a target account to manage. You can manage a custom admin account if you don't use the default administrator or you can manage the built-in admin account which has the well- known rid of 500 RID of 500. Notice that we'll come up with an automatic account name. If we don't configure this setting right here it will default to wlapse admin as the account name or prefix when managing this account. Now when it creates a managed account we can disable this account by default by leaving this box unchecked, enable the managed account. Even if it's disabled it's still going to rotate the password of a managed account at the same time. And we can also randomize the name of the managed account. It tells you a little bit more about how it does this with a random numeric suffix. So I'll hit apply right here to turn it on. Now there's a couple other things that you need to know about.

4:47You can adjust the password settings if you want to. I trust that the domain controller in this policy is going to be able to create complex in well-known passwords on its own and rotate it every 30 days. So setting password settings here doesn't really matter that much to me. Now configure password backup directory. This lets you choose where you want to save this specifically. If we choose to enable this we can save it in Active Directory, Azure Active Directory or disabled entirely. I want to specify Active Directory since this is only local to me. I'll hit apply and okay and now I've hard coded that to be stored in my Active Directory. And then of course configure authorized password decryptors.

5:39This is the group of people that are going to be allowed to decrypt this password. So what we want to do is we want to make sure we have a group outside of the domain admins. If you want a group outside of the domain admins who are allowed to do this. So what I can do is I can create an OU real quick just so I have a fresh OU to put them in. We'll call this a new organization unit. We'll call this lapse users and inside lapse users I 'll create a new group called lapse admins and inside that you would have your user. So from here I'll go back to my group policy. I'll edit the authorized decryptors. I'll enable this and then you would type it in like Knox's data. In this case my case zero because there is a zero right there in my environment. And then it will be lapse admins like so.

6:45Apply okay. And now we've specified who was allowed to access it. Now to kick things off a little bit. I am going to request it to update the lapse schema real quick. I'm going to run update lapse ad schema commandlet. We're going to say yes to all to proceed. And that should be what we need to make sure any previous compatibility is handled. Now what happens next after that we open up active directory users and computers. And it will take a while for all the machines to check in refresh their GPOs and then go through the password rotation process. It could be up to two or three hours. So what you'll do then is when you're ready to retrieve the password I'll show you where it'll be. You'll go into your active directory in the computers. You'll find the computer object and if you have credentials and privileges to see you can go to properties. There will be a lapse tab. And once the password rotation is done you'll be able to click the copy password or show password button and it'll be right there.

7:59So that's where you would go to manage and configure local admin password settings. I hope this has been informative for you and I'd like to thank you for viewing.

0:00So it's time to review some scenarios to reinforce what we've learned and I really am excited about some of these newer features or the improvements on previous ones like OS config or laps. So let's take a look. You are responsible for securing a new Windows Server 2025 member server. Your security team requires applying Microsoft's recommended baseline quickly without manually configuring dozens of policies.

0:31Which OS config command or commandlet should you run? Get OS config desired configuration with a scenario. Set OS config desired configuration with a scenario. Enable OS config drift control or remove OS config desired configuration with a scenario. Almost every time you're changing a configuration in PowerShell, it's the set commandlet. Remember PowerShell is verb - noun.

1:02The verb is the big thing to look for. Get retrieves data, set changes data, remove deletes data, and enable usually turn something on or off. But in this case, pay attention to the noun. OS config drift control is not what we're looking for. We're looking for the desired configuration. Next up, you enabled Windows laps for an OU of workstation. But help desk staff still cannot read stored passwords. What should you do next? Add help desk staff to the domain admins group.

1:34Nope. Delegate read permissions for lapsed passwords to the help desk. Yes. Now we saw that there was a GPO that can help certain user groups retrieve encrypted passwords. That's one thing that we can do. There's also a PowerShell commandlet that can help us delegate those permissions as well. That PowerShell commandlet is set lapse ad read password permission. So if you just know set lapse ad read, you can tab to auto complete it and go from there.

2:10So that's one thing that you should know about. A user complains that a website they frequently visited using edge is now being blocked by a warning. They cannot proceed to the website. What is likely the cause? Why are they no longer able to go to that website anymore? The smart screen GPO is not configured. Smart screen is disabled. Windows defender is uninstalled. Or the smart screen GPO is being enforced. The big thing that we know here is the fact that they can't proceed to the website means that the GPO is being enforced.

2:45Any other scenario would mean they could at least go past the warning if it weren't being enforced. Let's take a look. Lastly, your boss is worried about exploits and users downloading malware that will execute malicious code. He believes that in your current fleet of Windows 11 and Windows Server 2025 machines, there is no protection. Is this accurate? No, defender exploit protection is enabled by default with every setting on every Windows 11 and Windows Server 2025 machine.

3:21The only thing that you can really do here are customize your overrides. And of course export that XML file and the mass deploy that XML file using a GP O if that's what you want to do. But we're talking about by default. So we know that by default exploit protection is on across the board. And that reinforces what we've learned about Windows OS security configurations .