18.9.80.1.1 Ensure 'Configure Windows Defender SmartScreen' is set to 'Enabled: Warn and prevent bypass' - ShellSmartScreenLevel

Information

This policy setting allows you to manage the behavior of Windows SmartScreen. Windows SmartScreen helps keep PCs safer by warning users before running unrecognized programs downloaded from the Internet. Some information is sent to Microsoft about files and programs run on PCs with this feature enabled.

The recommended state for this setting is: Enabled: Warn and prevent bypass.

Rationale:

Windows SmartScreen helps keep PCs safer by warning users before running unrecognized programs downloaded from the Internet. However, due to the fact that some information is sent to Microsoft about files and programs run on PCs some organizations may prefer to disable it.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: Warn and prevent bypass:

Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template WindowsExplorer.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative Templates (or newer).
Note #2: In older Microsoft Windows Administrative Templates, this setting was initially named Configure Windows SmartScreen, but it was renamed starting with the Windows 10 Release 1703 Administrative Templates.

Impact:

Users will be warned before they are allowed to run unrecognized programs downloaded from the Internet.

Default Value:

Disabled. (Windows SmartScreen behavior is managed by administrators on the PC by using Windows SmartScreen Settings in Action Center.)

See Also

https://workbench.cisecurity.org/files/2781

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10), CCE|CCE-35859-8, CSCv6|2, CSCv7|2.6, CSCv7|2.7, CSCv7|7.2, CSCv7|7.3

Plugin: Windows

Control ID: e4d31d147627ae0dff46543fb04fc389d6f96cdd2b14518c3defe88f6a060a2d