When our Windows installer runs, it changes a set of Microsoft Defender and Windows settings. This page lists every change, what it stops, how to check it on your own computer, and what we deliberately leave off.
| Your plan | What applies to you |
|---|---|
| Managed plan | Every computer that runs our installer gets these settings. |
| Ordered online (self-serve) | Every computer that runs the Windows installer from Downloads gets these settings, whichever services you bought. Installing Action1 on its own from its own file doesn't change them. |
Windows 10 and Windows 11 computers that ran our installer. Nothing new is installed for this part: every feature is already in Windows, and the installer switches the right ones on. Your files, USB drives, cameras and microphones keep working.
| Setting | What it stops | Windows default | Our value |
|---|---|---|---|
| Real-time protection and scanning of downloads, attachments, archives, scripts and email | Malware as it arrives or opens | Varies | On, each one checked |
| Cloud-delivered protection | New malware that the downloaded signature list doesn't know yet | On | On, with automatic sample submission |
| Cloud protection level | Unknown, suspicious files | Default | High |
| Extra time for a cloud check | Suspicious files that need a longer look | 10 seconds | Up to 50 seconds more |
| Potentially unwanted app blocking | Adware and bundled junk software | Report only, on current Defender versions | Block |
| Network protection | Connections to phishing and malware sites from any app | Not set | On |
| Attack surface reduction (ASR) rules | Specific attack techniques, listed below | Not set | 9 rules block, 4 report only |
| Defender update checks | Running on old signatures | Defender's own schedule | Every 4 hours |
| Weekly full scan | Malware that a quick scan misses | No weekly task | Sundays at 3:00 AM |
| Windows Firewall | Unwanted incoming connections | On | On for domain, private and public networks |
| SmartScreen for apps and files | Unknown or known-bad programs from the internet | On; people can turn it off | On, set to warn; can't be turned off |
| SMBv1 file sharing | An old protocol with serious weaknesses | Not installed on Windows 11; may be on in Windows 10 Home and Pro | Off |
The installer also checks that tamper protection is on and shows the result in its summary. It doesn't change that setting.
Windows Security, and open it.You'll know it worked when all four are on. Some may say they are managed by your organization. That is our baseline.
You'll know it worked when both are on, and Check apps and files can't be switched off.
You'll know it worked when the firewall is on for all three.
You'll know it worked when its checkbox is clear. If the installer just turned it off, it finishes at the next restart.
Close the dialog with Cancel so nothing else changes.
If you're comfortable with PowerShell, these read-only commands show the same settings. They work in a normal PowerShell window.
Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, IsTamperProtected
Get-MpPreference | Select-Object MAPSReporting, SubmitSamplesConsent, CloudBlockLevel, CloudExtendedTimeout, PUAProtection, EnableNetworkProtection, SignatureUpdateInterval
What to look for:
RealTimeProtectionEnabled, AntivirusEnabled and IsTamperProtected are True.MAPSReporting is 2: cloud protection is on.SubmitSamplesConsent is 1: safe samples are sent automatically.CloudBlockLevel is not 0. Zero is Default; ours is High.CloudExtendedTimeout is 50 and SignatureUpdateInterval is 4.PUAProtection and EnableNetworkProtection are 1: on, blocking.To see the ASR rules, run:
$p = Get-MpPreference; 0..($p.AttackSurfaceReductionRules_Ids.Count - 1) | ForEach-Object { [pscustomobject]@{ Id = $p.AttackSurfaceReductionRules_Ids[$_]; Action = $p.AttackSurfaceReductionRules_Actions[$_] } } | Format-Table -AutoSize
You see 13 rules. 1 means block and 2 means report only.
For SmartScreen, run:
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' | Select-Object EnableSmartScreen, ShellSmartScreenLevel
You'll know it worked when
EnableSmartScreenis1andShellSmartScreenLevelisWarn.
The installer makes sure Defender's real-time protection, behavior monitoring, and scanning of downloaded files, attachments, scripts, archives such as .zip files, and email files are all on. Most are on already in Windows. We set each one so none is left off by an earlier program or setting.
When Defender meets a file it hasn't seen before, it asks Microsoft's cloud service about it as it happens. We turn cloud protection on, with automatic sample submission, and set its level to High. Microsoft describes High as aggressively blocking unknown files while keeping the computer fast, with a somewhat higher chance of a false alarm.
These settings also switch on Microsoft's block at first sight, which detects new malware and blocks it within seconds. It needs cloud protection on and samples sent automatically. Some ASR rules also show their pop-up warning only at the High level or above.
A normal cloud check can hold a suspicious file for 10 seconds. We allow up to 50 seconds more, so Defender can finish the check before the file runs.
Potentially unwanted apps aren't viruses. They show ads, bundle other software you didn't ask for, or try to hide from security tools. On current Defender versions, Windows only reports them by default. We set Defender to block them.
When any app on the computer tries to reach a domain known for phishing, malware, tech-support scams or ransomware control servers, Defender blocks the connection. In Microsoft Edge, SmartScreen does this job. Microsoft lists network protection for Windows 10 and 11 Pro and Enterprise.
Each ASR rule blocks one technique that attackers use. Microsoft's ASR rules reference lists 19 rules today. ASR rules work on any Windows edition that includes Microsoft Defender Antivirus, Home included.
These 9 rules are set to block, by their names in Microsoft's reference:
We also run four more rules in report-only mode while we learn how you work. Report-only rules record what they would have blocked, without blocking it, so we can switch them on without breaking something you rely on.
SmartScreen checks programs and files you download against Microsoft's list of known-bad and well-known files. When a program has no reputation yet, you see a warning, and you can still go ahead if you're sure.
The installer sets this as a Windows policy, "Configure Windows Defender SmartScreen", set to warn. With the policy on, people can't turn Check apps and files off. Microsoft recommends the stricter option, warn and prevent bypass, for organizations. We start with warn so people who install their own tools aren't stopped outright. Ask us if you want the stricter option.
A scheduled task runs a full Defender scan every Sunday at 3:00 AM. If the computer is off then, the scan runs the next time it can. The installer also updates Defender's signatures and starts a quick scan in the background when it runs.
Windows Firewall is on by default. The installer makes sure it's on for all three network types: domain, private and public.
SMBv1 is an old file-sharing protocol with serious security weaknesses. Microsoft strongly advises against using it, and Windows 11 doesn't install it. The installer turns it off where it's still on. The change finishes at the next restart.
If an old network drive, copier or scanner still needs SMBv1, it stops working with that computer. Tell us and we find a fix for that device; usually that means updating or replacing it.
These settings exist, but in a normal office they cause too many false alarms or daily problems. The installer doesn't turn them on. Ask us if your business needs one.
Open a ticket and tell us what stopped working, on which computer, and when. We look at what Defender recorded, then add an exclusion, adjust the rule for your computers, or change it for everyone if we see a pattern. Don't switch Defender settings off yourself: some are locked by policy, and the installer sets them again the next time it runs.
These are settings in Microsoft Defender and Windows, not new software. The one thing added is the weekly scan task.
The installer checks for another antivirus product. When one is in charge, Defender isn't the one protecting the computer, so these settings do little, and our monitoring stage stops. Uninstall the other product, restart, and run the installer again. Huntress works alongside Defender; it isn't another antivirus product to remove.
In AV-TEST's July and August 2026 test of business security products on Windows 11, Microsoft Defender Antivirus scored 6.0 out of 6.0 for protection. What we add is the business configuration that most computers never get.
This baseline is for Windows. For a Mac, ask us what applies.
| [email protected] | |
| Phone | (206) 593-8072, Monday to Friday, 8:00 AM to 6:00 PM Pacific |
For the security services we offer, see rainier-it.com/security.
Last reviewed: October 2026