Forum Discussion
EnableConvertWarnToBlock will not enable - stays False
The registry value in the screenshot is correct, so the GPO is writing the policy. However, that value alone does not mean the Defender engine can apply it.
EnableConvertWarnToBlock is a Network Protection setting. It only has an effect when Microsoft Defender Antivirus is running in active mode and Network Protection is enabled. Onboarded to MDE does not automatically mean Defender Antivirus is active; it can still be in passive mode if another antivirus product is registered.
Check these first:
Get-MpComputerStatus | Select AMRunningMode,RealTimeProtectionEnabled,NISEnabled Get-MpPreference | Select EnableNetworkProtection,EnableConvertWarnToBlock
AMRunningMode should be Normal, real-time protection should be enabled, and Network Protection must be enabled, normally in block mode. Configure that separately in GPO under:
Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Network Protection
Set Prevent users and apps from accessing dangerous websites to Enabled (Block). Then run gpupdate /force, restart the device, and check the two commands again.
Tamper Protection is not the likely cause here, so it does not need to be disabled. Also review Intune, MDE security settings management, or another Defender policy source for a conflicting Network Protection setting. A GPO can write the registry value while another management source prevents the effective Defender configuration from changing.
Finally, this policy applies to Network Protection warnings. If the intended browser is Microsoft Edge, configure the Edge policy Prevent SmartScreen Prompt Override as well; EnableConvertWarnToBlock alone does not control Edge SmartScreen override behaviour.
Hi - please see answers below:
I have 2 machines, both on the same network, connected to the same domain and receiving the same GPO policy enabling these settings. MDE is active and primary - no other AV installed. Network protection is enabled and in block mode.
Both machines have the registry key in place to enable. See below results for your queries:
Machine 1:
Machine 2:
No valid reason why machine 2 should/is different from machine 1. All updates/patches have been applied.
Additional strangeness seen:
Machine 1 - when enabled into troubleshooting mode - network protection goes to 0 and ConvertWarn goes to False
I did not expect that enabling troubleshooting mode would disable network protection?
I can also see the following in the event log:
Once troubleshooting mode is completed (4h), network protection re-enables and ConvertWarn goes to block.
I see the same issue on machine 2, but ConvertWarn always stays as false - even though it it part of the same domain with the same GPO applied and the same registry keys shown. The above event log is not shown on the second machine.
After further investigation I have noted the following:
- when enabled via Intune as per below
The reported setting with Get-MpPreference = True (which is correct and what I want)
When the Intune policy is removed from the device, the setting reverts to False:
Then I configure the same value in GPO as per below:
And confirm the value is applied to the device via gpresult /h
and in the registry:
Yet the client device Get-MpPreference = False
Its as if the GPO setting does not work while the Intune setting does - has anyone else seen this?
