Forum Discussion
EnableConvertWarnToBlock will not enable - stays False
We have a GPO applied to Windows 11 Pro machine - fully patched and onboarded to MDE. The GPO enables "EnableConvertWarnToBlock" as follows:
The GPO is applied to the machine and the following registry key is populated:
But when I check the status on the client - it will not enable:
I have enabled troubleshooting mode and disabled tamper protection in case this is blocking but nothing seems to work. Its as if MDAV/MDE is not even looking/reading that registry key.
Anyone else have the same issue or ideas on resolution?
1 Reply
The registry value in the screenshot is correct, so the GPO is writing the policy. However, that value alone does not mean the Defender engine can apply it.
EnableConvertWarnToBlock is a Network Protection setting. It only has an effect when Microsoft Defender Antivirus is running in active mode and Network Protection is enabled. Onboarded to MDE does not automatically mean Defender Antivirus is active; it can still be in passive mode if another antivirus product is registered.
Check these first:
Get-MpComputerStatus | Select AMRunningMode,RealTimeProtectionEnabled,NISEnabled Get-MpPreference | Select EnableNetworkProtection,EnableConvertWarnToBlock
AMRunningMode should be Normal, real-time protection should be enabled, and Network Protection must be enabled, normally in block mode. Configure that separately in GPO under:
Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Network Protection
Set Prevent users and apps from accessing dangerous websites to Enabled (Block). Then run gpupdate /force, restart the device, and check the two commands again.
Tamper Protection is not the likely cause here, so it does not need to be disabled. Also review Intune, MDE security settings management, or another Defender policy source for a conflicting Network Protection setting. A GPO can write the registry value while another management source prevents the effective Defender configuration from changing.
Finally, this policy applies to Network Protection warnings. If the intended browser is Microsoft Edge, configure the Edge policy Prevent SmartScreen Prompt Override as well; EnableConvertWarnToBlock alone does not control Edge SmartScreen override behaviour.
