Detections
Analytics

18.10.43.1 (L1) Ensure 'Allow auditing events in Microsoft Defender Application Guard' is set to 'Enabled'

Information

This policy setting allows you to decide whether auditing events can be collected from Microsoft Defender Application Guard.

The recommended state for this setting is: Enabled

Note: Microsoft Defender Application Guard requires a 64-bit version of Windows and a CPU supporting hardware-assisted CPU virtualization (Intel VT-x or AMD-V). This feature is not officially supported on virtual hardware, although it can work on VMs (especially for testing) provided that the hardware-assisted CPU virtualization feature is exposed by the host to the guest VM.

More information on system requirements for this feature can be found at

System requirements for Microsoft Defender Application Guard (Windows 10) | Microsoft Docs

Note #2: Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs.

Auditing of Microsoft Defender Application Guard events may be useful when investigating a security incident.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled:

Computer Configuration\Policies\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow auditing events in Microsoft Defender Application Guard

Note: This Group Policy path is provided by the Group Policy template AppHVSI.admx/adml that is included with the Microsoft Windows 10 Release 1709 Administrative Templates (or newer).

Note #2: In older Microsoft Windows Administrative Templates, this setting was initially named

Allow auditing events in Windows Defender Application Guard

, but it was renamed to

Allow auditing events in Microsoft Defender Application Guard

starting with the Windows 10 Release 2004 Administrative Templates.

Impact:

Note: This setting was moved from the Next Generation (NG) profile to the Level 1 (L1) profile for the Windows 11 Operating System only NG profile settings were isolated from the L1 profile due to potential hardware compatibility issues. The Windows 11 Operating System is dependent on the same hardware as the NG settings, so hardware compatibility is no longer an issue.

Microsoft Defender Application Guard will inherit its auditing policies from Microsoft Edge and start to audit system events specifically for Microsoft Defender Application Guard. Collected logs are available for review on Microsoft Edge, outside of Application Guard.

See Also

https://workbench.cisecurity.org/benchmarks/17603

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2

Plugin: Windows

Control ID: a7eca07d509ec37b2ade5d917c7bbb1bb564b8f87403c07559115c7ec937f73a