During these days when work from home is a trend, protecting remote workers against malwares is essentials, we have to make sure their systems are free from malwares and running, so they could perform their day to day tasks. When system is infected, they couldn't do their daily task and makes them counterproductive. In case, you are using Microsoft Intune and you are managing devices with Windows Defender in Window 10, make sure take the following into consideration:
Enable Tamper Protection: This policy prevents change to disable important security settings in Windows Defender like real-time protection, removing update, cloud protection, ... using registry, group policy, scripts and so on. Because people are working from home and they might download many things or execute untrusted command or fall into hand of cybercriminals to trick them into disabling their antimalware program and enabling this setting would make sure they won't be able to do it. However, please make sure send announcement and inform them about you are applying this change and if there was any case of false-positive detection or you have permit program that incorrectly is being detected as malware, then you have to add them to exclude list. Take a look at protect security settings with tamper protection.
Enable Cloud-Delivered Protection: There are possibility of 0-days malware and suspicious behavior for malware and cloud protection is great way to protect users against malware. In case antimalware definition update is not installed yet or pending installation, it would be proactive way to protect system while update is being installed. You might face case of false-positive in following cases:
- Software Developer Teams: they are writing codes and might execute programs or make changes behaving like malware , their action might be detected as malicious
- Support Teams: they might create scripts and execute programs and they could detect as malicious
- IT Department: they are doing administrative tasks and working with scripts and programs and might produce programs where detected as malicious
In such case, you might monitor cloud-delivery protection and test or add their components into exclude list for Windows Defender. To learn more, take a look at Use next-gen technologies in Windows Defender Antivirus through cloud-delivered protection .
