Microsoft mengumumkan Pusat Keamanan Windows Defender baru mulai dari Windows 10 v1703 dan ini memudahkan untuk mengubah pengaturan keamanan untuk PC kami. Secara default, Windows Defender diatur dalam mode perlindungan rendah karena ini akan membuat hidup kita lebih mudah dengan memberlakukan lebih sedikit batasan, tetapi administrator TI dapat mengaktifkan Perlindungan Cloud^{(Cloud Protection)} dan mengubah pengaturan Kebijakan Grup ini – ^{(Group Policy)}Konfigurasikan Blok^{(Configure Block)} pada Pandangan Pertama^{(First Sight)} , Konfigurasi^(Configure) penggantian pengaturan lokal untuk pelaporan , dan Bergabunglah dengan Microsoft MAPS^{(Join Microsoft MAPS)} ( Microsoft Advanced Protection Service ) atau SpyNet , untuk mengaturWindows Defender Antivirus memblokir perlindungan ke level tertinggi.

^{(Harden Windows Defender)}Perkuat perlindungan Windows Defender di Windows 10

Jalankan gpedit.msc untuk membuka Editor Kebijakan Grup^{(Group Policy Editor)} dan arahkan ke jalur berikut:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Maps

Di sini Anda akan melihat 4 pengaturan:

• Bergabunglah dengan Microsoft Maps
• Konfigurasikan fitur Block at First Sight
• Konfigurasikan^(Configure) penggantian pengaturan lokal untuk pelaporan ke Microsoft MAPS
• Kirim^(Send) sampel file saat analisis lebih lanjut diperlukan.

Anda dapat mengonfigurasi pengaturan Windows Defender sesuai dengan kebutuhan Anda.

1] Bergabunglah dengan Microsoft Maps

Untuk bergabung dengan Layanan Perlindungan Lanjutan Microsoft ^{(Microsoft Advanced Protection Service)}, klik dua kali Bergabung dengan Microsoft Maps^{(Join Microsoft Maps)} . Di kotak Properties yang terbuka, pilih “ Enabled .”

This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you.

Anda memiliki 3 opsi di sini – Dinonaktifkan^(Disabled) , Keanggotaan dasar^(Basic) dan Keanggotaan lanjutan^(Advanced) .

2] Konfigurasikan Blok^{(Configure Block)} pada fitur First Sight

Setelah bergabung dengan MAPS , Anda dapat mengklik dua kali 0n Block at First Sight dan pilih Enabled di kotak Properties -nya ..

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device.

Fitur ini memerlukan pengaturan Kebijakan Grup^{(Group Policy)} untuk diatur sebagai berikut: Bergabung dengan Microsoft MAPS^{(Join Microsoft MAPS)} harus diaktifkan, Kirim sampel file saat analisis lebih lanjut diperlukan^{(Send file samples when further analysis is required)} harus diatur ke Kirim sampel aman^{(Send safe samples)} atau Kirim semua sampel^{(Send all samples)} , kebijakan Pindai semua file yang diunduh dan lampiran^{(Scan all downloaded files and attachments)} harus diaktifkan dan kebijakan Nonaktifkan perlindungan waktu nyata^{(Turn off real-time protection)} TIDAK boleh diaktifkan.

3] Konfigurasikan^(Configure) penggantian pengaturan lokal untuk pelaporan ke Microsoft MAPS

Pengaturan Configure local setting override untuk pelaporan ke^{(Configure local setting override for reporting to Microsoft MAPS)} pengaturan Microsoft MAPS akan membiarkan pengguna lebih diutamakan daripada Group Policy sehingga pada akhirnya memungkinkan mereka untuk menimpa yang sama.

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy.

Anda perlu mengklik dua kali padanya dan memilih Diaktifkan di kotak Properties yang terbuka. Setelah fitur ini diaktifkan, ia akan menjalankan pemeriksaan secara real-time dan akan memutuskan apakah akan mengizinkan konten untuk berjalan atau tidak.

4] Kirim^(Send) sampel file saat analisis lebih lanjut diperlukan

Pengaturan Kirim sampel file saat analisis lebih lanjut diperlukan^{(Send file samples when further analysis is required)} akan memungkinkan Anda mengirim semua sampel secara otomatis ke Microsoft untuk analisis lebih lanjut.

This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. The possible options are: Always prompt, Send safe samples automatically, Never send and Send all samples automatically.

Anda perlu mengklik dua kali padanya dan memilih Diaktifkan di kotak Properties yang terbuka.

Setelah melakukan ini, Anda dapat melanjutkan untuk mengatur tingkat perlindungan Cloud untuk Windows Defender.^{(Having done this, you can move on to set the Cloud protection level for Windows Defender.)}

5] Pilih^{(Select Cloud Protection)} tingkat Perlindungan Cloud di Windows Defender

Tingkat perlindungan cloud juga dapat diaktifkan dengan menggunakan Kebijakan Grup^{(Group Policy)} dengan mengunjungi jalur berikut:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MpEngine

Di panel kanan, Anda akan melihat Select protection level . Klik dua kali untuk membuka kotak Properties -nya dan kemudian pilih Enabled . Anda akan melihat dua opsi yang ditawarkan:

1. Tingkat pemblokiran Antivirus Windows Defender^{(Windows Defender Antivirus)} default
2. Tingkat pemblokiran tinggi

Pilih Tingkat pemblokiran tinggi^{(High blocking level)} dan klik Terapkan.

This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency.

Baca^(Read) : Cara mengaktifkan dan mengkonfigurasi Perlindungan Ransomware di Windows Defender^{(Ransomware Protection in Windows Defender)} .

6] Konfigurasikan pemeriksaan cloud yang diperluas

Di bawah pengaturan MpEngine , Anda juga akan melihat pengaturan  Configure extended cloud check . Jika mau, Anda juga dapat Mengaktifkan pengaturan ini

This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it’s safe. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds.

TIP : Jadikan Windows Defender melindungi Anda dari Program yang Mungkin Tidak Diinginkan juga^{(Make Windows Defender protect you against Potentially Unwanted Programs too)} .

7 ] Aktifkan^{(] Enable)} & atur tingkat Perlindungan Cloud^{(Cloud Protection)} ke Tinggi^(High) menggunakan Registry

Jika Anda adalah pengguna Windows 10 Home , maka Anda dapat menggunakan Windows Registry dan mengubah beberapa pengaturan. Untuk melakukan ini, ketik regedit.exe di Mulai Pencarian^{(Start Search)} dan tekan Enter untuk membuka Registry Editor . Sekarang navigasikan ke kunci berikut:

HKEY_LOCAL_Machine\Software\Policies\Microsoft\Windows Defender

Di sisi kiri, klik kanan pada Windows Defender, pilih New > Key dan beri nama key Spynet . Klik kanan pada Spynet dan pilih lagi New > Dword (32-bit) dan beri nama SpynetReporting. Atur nilainya menjadi 2 untuk mengaturnya di tingkat Lanjutan.

Sekarang, klik kanan lagi pada tombol Windows Defender yang muncul di sisi kiri dan pilih New > Key . Kali ini beri nama kuncinya sebagai MpEngine . Selanjutnya klik kanan pada kunci MpEngine dan pilih New > Dword (32-bit) value. Beri nama kunci sebagai MpCloudBlockLevel dan berikan nilai 2 untuk mengaturnya di level blok Tinggi.

Alat yang dapat membantu Anda:^{(Tools that may help you:)}

1. ConfigureDefender membantu Anda mengubah pengaturan Keamanan Windows secara instan^{(Windows Security)}
2. Alat WinDefThreatsView^{(WinDefThreatsView)} memungkinkan Anda mengatur tindakan default untuk ancaman Windows Defender .

Harden Windows Defender protection to the highest levels on Windows 10

Miсrоsoft annоunced a new Windows Defender Security Center starting from the Windows 10 v1703 and this makes it easier to toggle the security settings for our PCs. By default, Windows Defender is set in a low protection mode since this will make our lives easy by imposing fewer restrictions, but IT administrators can enable Cloud Protection and change these Group Policy settings – Configure Block at First Sight, Configure local setting override for reporting, and Join Microsoft MAPS (Microsoft Advanced Protection Service) or SpyNet, to set Windows Defender Antivirus blocking protection to highest levels.

Harden Windows Defender protection in Windows 10

Run gpedit.msc to open the Group Policy Editor and navigate to the following path:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Maps

Here you will see 4 settings:

• Join Microsoft Maps
• Configure Block at First Sight feature
• Configure local setting override for reporting to Microsoft MAPS
• Send file samples when further analysis is required.

You can configure Windows Defender settings according to your requirements.

1] Join Microsoft Maps

To join Microsoft Advanced Protection Service, double-click on Join Microsoft Maps. In the Properties box which opens, select “Enabled.”

This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you.

You have 3 options here – Disabled, Basic membership and Advanced membership.

2] Configure Block at First Sight feature

After joining MAPS, you can double-click 0n Block at First Sight and select Enabled in its Properties box..

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device.

This feature requires these Group Policy settings to be set as follows: Join Microsoft MAPS must be enabled, the Send file samples when further analysis is required should be set to Send safe samples or Send all samples, the Scan all downloaded files and attachments policy must be enabled and the Turn off real-time protection policy should NOT be enabled.

3] Configure local setting override for reporting to Microsoft MAPS

The Configure local setting override for reporting to Microsoft MAPS setting will let users take precedence over the Group Policy thus eventually allowing them to override the same.

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy.

You need to double-click on it and select Enabled in the Properties box which opens. Once this feature is enabled it will run checks in real-time and will decide on whether to allow the content to run or not.

4] Send file samples when further analysis is required

The Send file samples when further analysis is required setting will let you send all the samples automatically to Microsoft for further analysis.

This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. The possible options are: Always prompt, Send safe samples automatically, Never send and Send all samples automatically.

You need to double-click on it and select Enabled in the Properties box which opens.

Having done this, you can move on to set the Cloud protection level for Windows Defender.

5] Select Cloud Protection level in Windows Defender

The cloud protection level too can be enabled by using the Group Policy by visiting the following path:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MpEngine

In the right pane, you will see Select protection level. Double-click on it to open its Properties box and then choose Enabled. You will see two options offered:

1. Default Windows Defender Antivirus blocking level
2. High blocking level

Select High blocking level and click on Apply.

This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency.

Read: How to enable and configure Ransomware Protection in Windows Defender.

6] Configure extended cloud check

Under the MpEngine settings, you will also see a Configure extended cloud check setting. If you wish, you may also Enable this setting

This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it’s safe. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds.

TIP: Make Windows Defender protect you against Potentially Unwanted Programs too.

7] Enable & set Cloud Protection level to High using Registry

If you are a user of Windows 10 Home, then you can use the Windows Registry and tweak some settings. To do this, type regedit.exe in Start Search and hit Enter to open the Registry Editor. Now navigate to the following key:

HKEY_LOCAL_Machine\Software\Policies\Microsoft\Windows Defender

In the left side, right-click on Windows Defender, select New > Key and name the key Spynet. Right-click on Spynet and again select New > Dword (32-bit) and name it SpynetReporting. Set its value to 2 to set it at Advanced level.

Now, again right-click on the Windows Defender key which appears on the left side and select New > Key. This time name the key as MpEngine. Next right-click on the MpEngine key and select New > Dword (32-bit) value. Name the key as MpCloudBlockLevel and give it a value of 2 to set it at High block level.

Tools that may help you:

1. ConfigureDefender helps you change Windows Security settings instantly
2. WinDefThreatsView tool lets you set default actions for Windows Defender threats.

Related posts

• Apa itu Control Flow Guard di Windows 10 - Cara menghidupkan atau mematikannya

• Error 0x800106ba, Windows Defender Application Gagal menginisialisasi

• IT administrator Anda telah menonaktifkan Windows Security

• Di mana Windows Defender Offline memindai log disimpan?

• Aktifkan dan Konfigurasikan Ransomware Protection di Windows Defender

• Apa itu Account Protection di Windows 10 dan bagaimana menyembunyikan bagian ini

• Cara Memindai drive Mapped Network dengan Windows Defender

• Mengkonfigurasi Windows Defender untuk memindai file .zip .rar .cab di Windows 10

• Add An Exclusion item ke menu Windows Defender context

• Aktifkan berpotensi Unwanted Applications protection di Windows 10

• Layanan program ini telah berhenti, 0x800106BA, di Windows Defender

• Fix Windows Defender error code 0x8050800c pada Windows 11/10

• Service tidak dapat dimulai, Error 0x80070422 di Windows Defender

• Defender Windows Threat Service telah berhenti di Windows 10

• Cara mengedit daftar aplikasi yang diizinkan di Windows Defender Firewall (dan memblokir orang lain)

• Apa itu Device Security di Windows 10 dan bagaimana menyembunyikan area ini?

• Apa itu App & Browser Control di Windows 10 dan bagaimana menyembunyikannya

• Cara Menambahkan File type or Process Exclusion ke Windows Security

• Cara Mengaktifkan Pemindaian Network di Windows Defender pada Windows 10

• Perform Windows Defender Offline Scan di boot time di Windows 11/10