0
(0)

 Tip

Want to experience Defender for Endpoint? Sign up for a free trial.

This article provides troubleshooting information for network protection, in cases, such as:

  • Network protection blocks a website that is safe (false positive)
  • Network protection fails to block a suspicious or known malicious website (false negative)

There are four steps to troubleshooting these problems:

  1. Confirm prerequisites
  2. Use audit mode to test the rule
  3. Add exclusions for the specified rule (for false positives)
  4. Submit support logs

Confirm prerequisites

Network protection will only work on devices with the following conditions:

Use audit mode

You can enable network protection in audit mode and then visit a website that we’ve created to demo the feature. All website connections will be allowed by network protection but an event will be logged to indicate any connection that would have been blocked if network protection was enabled.

  1. Set network protection to Audit mode.
    PowerShell

    Set-MpPreference -EnableNetworkProtection AuditMode
    
  2. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don’t want to block).
  3. Review the network protection event logs to see if the feature would have blocked the connection if it had been set to Enabled.

    If network protection isn’t blocking a connection that you’re expecting it should block, enable the feature.

    PowerShell

    Set-MpPreference -EnableNetworkProtection Enabled
    

Report a false positive or false negative

If you’ve tested the feature with the demo site and with audit mode, and network protection is working on pre-configured scenarios, but isn’t working as expected for a specific connection, use the Windows Defender Security Intelligence web-based submission form to report a false negative or false positive for network protection. With an E5 subscription, you can also provide a link to any associated alert.

See Address false positives/negatives in Microsoft Defender for Endpoint.

Add exclusions

The current exclusion options are:

  1. Setting up a custom allow indicator.
  2. Using IP exclusions: Add-MpPreference -ExclusionIpAddress 192.168.1.1
  3. Excluding an entire process. For more information, see Microsoft Defender Antivirus exclusions.

Collect diagnostic data for file submissions

When you report a problem with network protection, you’re asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues.

  1. Open an elevated command prompt and change to the Windows Defender directory:
    Console

    cd c:\program files\windows defender
    
  2. Run this command to generate the diagnostic logs:
    Console

    mpcmdrun -getfiles
    
  3. Attach the file to the submission form. By default, diagnostic logs are saved at C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab.

Resolve connectivity issues with network protection (for E5 customers)

Due to the environment where network protection runs, Microsoft is unable to see your operating system proxy settings. In some cases, network protection clients are unable to reach the cloud service. To resolve connectivity issues with network protection, configure one of the following registry keys so that network protection becomes aware of the proxy configuration:

PowerShell

Set-MpPreference -ProxyServer <proxy IP address: Port>

—OR—

PowerShell

Set-MpPreference -ProxyPacUrl <Proxy PAC url>

You can configure the registry key by using PowerShell, Microsoft Endpoint Manager, or Group Policy. Here are some resources to help:

Source : Official Microsoft Brand
Editor by : BEST Antivirus KBS Team

How useful was this post?

Click on a star to rate it!

Average rating 0 / 5. Vote count: 0

No votes so far! Be the first to rate this post.