How to create and deploy antimalware policies for Endpoint Protection in Configuration Manager

Applies to: Configuration Manager (current branch)

You can deploy antimalware policies to collections of Configuration Manager client computers to specify how Endpoint Protection protects them from malware and other threats. These policies include information about the scan schedule, the types of files and folders to scan, and the actions to take when malware is detected. When you enable Endpoint Protection, a default antimalware policy is applied to client computers. You can also use one of the supplied policy templates or create a custom policy to meet the specific needs of your environment.

Configuration Manager supplies a selection of predefined templates. These are optimized for various scenarios and can be imported into Configuration Manager. These templates are available in the folder <ConfigMgr Install Folder>\AdminConsole\XMLStorage\EPTemplates.

Use the procedures in this topic to create or import antimalware policies and assign them to Configuration Manager client computers in your hierarchy.

Modify the default antimalware policy

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, expand Endpoint Protection, and then click Antimalware Policies.

3. Select the antimalware policy Default Client Antimalware Policy and then, on the Home tab, in the Properties group, click Properties.

4. In the Default Antimalware Policy dialog box, configure the settings that you require for this antimalware policy, and then click OK.

   Note

   For a list of settings that you can configure, see List of Antimalware Policy Settings in this topic.

Create a new antimalware policy

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, expand Endpoint Protection, and then click Antimalware Policies.

3. On the Home tab, in the Create group, click Create Antimalware Policy.

4. In the General section of the Create Antimalware Policy dialog box, enter a name and a description for the policy.

5. In the Create Antimalware Policy dialog box, configure the settings that you require for this antimalware policy, and then click OK. For a list of settings that you can configure, see List of Antimalware Policy Settings.

6. Verify that the new antimalware policy is displayed in the Antimalware Policies list.

Import an antimalware policy

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, expand Endpoint Protection, and then click Antimalware Policies.

3. In the Home tab, in the Create group, click Import.

4. In the Open dialog box, browse to the policy file to import, and then click Open.

5. In the Create Antimalware Policy dialog box, review the settings to use, and then click OK.

6. Verify that the new antimalware policy is displayed in the Antimalware Policies list.

Deploy an antimalware policy to client computers

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, expand Endpoint Protection, and then click Antimalware Policies.

3. In the Antimalware Policies list, select the antimalware policy to deploy. Then, on the Home tab, in the Deployment group, click Deploy.

   Note

   The Deploy option cannot be used with the default client malware policy.

4. In the Select Collection dialog box, select the device collection to which you want to deploy the antimalware policy, and then click OK.

List of Antimalware Policy Settings

Many of the antimalware settings are self-explanatory. Use the following sections for more information about the settings that might require more information before you configure them.

• Scheduled Scans Settings
• Scan Settings
• Default Actions Settings
• Real-time Protection Settings
• Exclusion Settings
• Advanced Settings
• Threat Overrides Settings
• Cloud Protection Service
• Definition Updates Settings

Scheduled Scans Settings

Scan type - You can specify one of two scan types to run on client computers:

• Quick scan - This type of scan checks the in-memory processes and folders where malware is typically found. It requires fewer resources than a full scan.

• Full Scan - This type of scan adds a full check of all local files and folders to the items scanned in the quick scan. This scan takes longer than a quick scan and uses more CPU processing and memory resources on client computers.

  In most cases, use Quick scan to minimize the use of system resources on client computers. If malware removal requires a full scan, Endpoint Protection generates an alert that is displayed in the Configuration Manager console. The default value is Quick scan.

Scan Settings

Scan email and email attachments - Set to Yes to turn on e-mail scanning.

Scan removable storage devices such as USB drives - Set to Yes to scan removable drives during full scans.

Scan network files - Set to Yes to scan network files.

Scan mapped network drives when running a full scan - Set to Yes to scan any mapped network drives on client computers. Enabling this setting might significantly increase the scan time on client computers.

• The Scan network files setting must be set to Yes for this setting to be available to configure.

• By default, this setting is set to No, meaning that a full scan will not access mapped network drives.

Scan archived files - Set to Yes to scan archived files such as .zip or .rar files.

Allow users to configure CPU usage during scans - Set to Yes to allow users to specify maximum percentage of CPU utilization during a scan. Scans will not always use the maximum load defined by users, but they cannot exceed it.

User control of scheduled scans - Specify level of user control. Allow users to set Scan time only or Full control of antivirus scans on their devices.

Default Actions Settings

Select the action to take when malware is detected on client computers. The following actions can be applied, depending on the alert threat level of the detected malware.

• Recommended - Use the action recommended in the malware definition file.

• Quarantine - Quarantine the malware but do not remove it.

• Remove - Remove the malware from the computer.

• Allow - Do not remove or quarantine the malware.

Real-time Protection Settings

Exclusion Settings

For information about folders, files, and processes that are recommended for exclusion in Configuration Manager 2012 and Current Branch, see Recommended antivirus exclusions for Configuration Manager 2012 and current branch site servers, site systems, and clients.

Excluded files and folders:

Click Set to open the Configure File and Folder Exclusions dialog box and specify the names of the files and folders to exclude from Endpoint Protection scans.

If you want to exclude files and folders that are located on a mapped network drive, specify the name of each folder in the network drive individually. For example, if a network drive is mapped as F:\MyFolder and it contains subfolders named Folder1, Folder2 and Folder 3, specify the following exclusions:

• F:\MyFolder\Folder1

• F:\MyFolder\Folder2

• F:\MyFolder\Folder3

Beginning in version 1602, the existing Exclude files and folders setting in the Exclusion settings section of an antimalware policy is improved to allow device exclusions. For example, you can now specify the following as an exclusion: \device\mvfs (for Multiversion File System). The policy does not validate the device path; the Endpoint Protection policy is provided to the antimalware engine on the client which must be able to interpret the device string.

Excluded file types:

Click Set to open the Configure File Type Exclusions dialog box and specify the file extensions to exclude from Endpoint Protection scans. You can use wildcards when defining items in the exclusion list. For more information, see Use wildcards in the file name and folder path or extension exclusion lists.

Excluded processes:

Click Set to open the Configure Process Exclusions dialog box and specify the processes to exclude from Endpoint Protection scans. You can use wildcards when defining items in the exclusion list, however, there are some limitations. For more information, see Use wildcards in the process exclusion list

Advanced Settings

Enable reparse point scanning - Set to Yes if you want Endpoint Protection to scan NTFS reparse points.

For more information about reparse points, see Reparse Points in the Windows Dev Center.

Randomize the scheduled scan start times (within 30 minutes) - Set to Yes to help avoid flooding the network, which can occur if all computers send their antimalware scans results to the Configuration Manager database at the same time. For Windows Defender Antivirus, this randomizes the scan start time to any interval from 0 to 4 hours, or for FEP and SCEP, to any interval plus or minus 30 minutes. This can be useful in VM or VDI deployments. This setting is also useful when you run multiple virtual machines on a single host. Select this option to reduce the amount of simultaneous disk access for antimalware scanning.

Beginning in version 1602 of Configuration Manager, the antimalware engine may request file samples to be sent to Microsoft for further analysis. By default, it will always prompt before it sends such samples. Administrators can now manage the following settings to configure this behavior:

Enable auto sample file submission to help Microsoft determine whether certain detected items are Malicious - Set to Yes to enable auto sample file submission. By default, this setting is No which means auto sample file submission is disabled and users are prompted before sending samples.

Allow users to modify auto sample file submission settings - This determines whether a user with local admin rights on a device can change the auto sample file submission setting in the client interface. By default, this setting is "No" which means it can only be changed from the Configuration Manager console, and local admins on a device cannot change this configuration.
For example, the following shows this setting set by the administrator as enabled, and greyed out to prevent changes by the user.

Threat Overrides Settings

Threat name and override action - Click Set to customize the remediation action to take for each threat ID when it is detected during a scan.

Cloud Protection Service

Cloud Protection Service enables the collection of information about detected malware on managed systems and the actions taken. This information is sent to Microsoft.

Cloud Protection Service membership

• Do not join Cloud Protection Service - No information is sent
• Basic - Collect and send lists of detected malware
• Advanced - Basic information as well as more comprehensive information that could contain personal information. For example, file paths and partial memory dumps.

Allow users to modify Cloud Protection Service settings - Toggles user control of Cloud Protection Service settings.

Level for blocking suspicious files - Specify the level at which the Endpoint Protection Cloud Protection Service will block suspicious files.

• Normal - The default Windows Defender blocking level
• High - Aggressively blocks unknown files while optimizing for performance (greater chance of blocking non-harmful files)
• High with extra protection - Aggressively blocks unknown files and applies additional protection measures (might impact client device performance)
• Block unknown programs - Blocks all unknown programs

Allow extended cloud check to block and scan for up to (seconds) - Specifies the number of seconds Cloud Protection Service can block a file while the service checks that the file is not known to be malicious.

Details of Cloud Protection Service reporting

Microsoft collects only the names of affected files, not the contents of the files themselves. This information helps determine what systems are especially vulnerable to specific threats.

Definition Updates Settings

Set sources and order for Endpoint Protection client updates - Click Set Source to specify the sources for definition and scanning engine updates. You can also specify the order in which these sources are used. If Configuration Manager is specified as one of the sources, then the other sources are used only if software updates fail to download the client updates.

If you use any of the following methods to update the definitions on client computers, then the client computers must be able to access the Internet.

• Updates distributed from Microsoft Update

• Updates distributed from Microsoft Malware Protection Center