MT.1165 - Network Protection should be enabled

Overview

Checks that Network Protection is enabled in block or audit mode in all assigned Microsoft Defender Antivirus policies.

Disabled network protection allows web-based threats and malicious IP connections, exposing endpoints to phishing sites and command-and-control traffic.

Remediation action:

1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
2. Edit the relevant Microsoft Defender Antivirus policy
3. Set Network Protection to Enabled or Audit mode

Related links

• Configure Microsoft Defender Antivirus
• Microsoft Endpoint Manager

Test Metadata

Field	Value
Test ID	MT.1165
Severity	High
Suite	Maester
Category	Defender
PowerShell test	Test-MtMdeNetworkProtection
Tags	Defender, Maester, MT.1165

Source

• Pester test: tests/Maester/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
• PowerShell source: powershell/public/maester/defender/Test-MtMdeNetworkProtection.ps1