18.9.77.3.1 (L1) Ensure 'Configure local setting override for reporting to Microsoft MAPS' is set to 'Disabled'

Information

This policy setting configures a local override for the configuration to join Microsoft Active Protection Service (MAPS), which Microsoft has now renamed to 'Windows Defender Antivirus Cloud Protection Service'. This setting can only be set by Group Policy.
The recommended state for this setting is: Disabled.

Rationale:
The decision on whether or not to participate in Microsoft MAPS / Windows Defender Antivirus Cloud Protection Service for malicious software reporting should be made centrally in an enterprise managed environment, so that all computers within it behave consistently in that regard. Configuring this setting to Disabled ensures that the decision remains centrally managed.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled:
Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Defender Antivirus\MAPS\Configure local setting override for reporting to Microsoft MAPS
Note: This Group Policy path may not exist by default. It is provided by the Group Policy template WindowsDefender.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates (or newer).

Impact:
None - this is the default behavior.

Default Value:
Disabled. (Group Policy will take priority over the local preference setting.)

References:
1. CCE-33833-5

See Also

https://workbench.cisecurity.org/benchmarks/14249

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CM-7(5), 800-53|SI-3, CSCv6|8, CSCv7|2.7, CSCv7|8.1, CSCv7|8.2

Plugin: Windows

Control ID: ecad1b9043ffac5426946b388ac31d27ae4ac025d8ba949978d6336885f0a6f7