🎯 Purpose
✅ Establish a lightweight, low‑impact hardening baseline for Windows Defender for Endpoint as part of your Initial Baseline Profiles (IBP).
➡️ Focuses on safe, high‑value Attack Surface Reduction (ASR) protections while avoiding complex or intrusive Defender features.
This aligns with your IBP design philosophy:
IBP = Simple, safe, minimally disruptive (Essential Eight Maturity Level 1 posture).
👥 Who is affected
✅ Assignments: All Windows 10/11 devices
➡️ Applied tenant‑wide as the initial Defender hardening baseline.
(Other advanced Defender or BitLocker configurations are intentionally separated.)
🔐 Key Security Controls Enabled
This policy enables only a small set of high‑impact, low‑risk ASR protections.
Everything below is actively configured and enforced:
✔ Attack Surface Reduction (ASR) Rules (Enabled)
Block Office applications launching child processes
Block executable content created/launched by Office
Block obfuscated macro code
Block untrusted USB processes
Block email content execution
Prevent credential stealing (LSASS protection)
➡️ These rules protect against:
Malicious Office documents
Script‑based malware
USB‑borne payloads
Email‑delivered malware
Credential harvesting
✔ Compatibility Controls (Enabled)
These are intentionally allowed to avoid breaking legitimate workflows:
Office communication apps launching child processes (Teams/Outlook)
Adobe Reader launching child processes
➡️ Ensures normal enterprise document handling continues without disruption.
🔒 BitLocker
❌ Not configured
➡️ Correct by design — BitLocker is handled in your dedicated BitLocker policy.
🧯 What This Policy Does NOT Enforce
As an IBP baseline, this profile intentionally leaves most Defender features unconfigured.
❌ Not configured (by design):
Real‑time protection behaviours
Cloud protection level
Network Protection
Controlled Folder Access (CFA)
Exploit Guard
Credential Guard
SmartScreen
VBS or virtualization security
Tamper protection
Firewall profiles
Local security options
SMB signing
Application Guard
BitLocker (handled elsewhere)
➡️ This is not a full Endpoint Hardening or E8 Maturity Level 2/3 configuration.
It is a light baseline designed for safe initial rollout.
🟢 Policy status
✅ Enabled
➡️ Actively applying the ASR rule set to all assigned Windows devices.
📘 Security Alignment
✅ Aligns with Essential Eight Maturity Level 1 hardening
➡️ Delivers safe, low‑impact protections against common malware vectors
ℹ️ Acts as the foundation for future uplift to stronger Defender configurations (E8 Maturity Level 2+)
📘 Practical Interpretation (Executive‑Friendly)
This configuration ensures that:
✅ All Windows devices
➡️ Receive a small but powerful set of Defender ASR protections
🔒 Blocking:
Malicious Office behaviour
USB‑borne malware
Macro‑based threats
Email‑based attacks
Credential theft
At the same time, it avoids friction by not enforcing advanced Defender features that require deeper testing or maturity.
This provides a safe, stable security baseline and establishes the first step in your uplift path toward full Enterprise Windows hardening.