Enable or Disable Microsoft Defender PUA Protection in Windows 11

This tutorial will show you how to turn on or off Microsoft Defender’s protection against potentially unwanted applications (PUA) in Windows 11.

What Are Potentially Unwanted Applications?

Potentially unwanted apps (PUA) aren’t viruses, but they can cause problems. They might show you ads, use your computer to mine cryptocurrency, or slow down your PC. Potentially unwanted applications (PUA) are programs that can make your computer run slowly, display surprise ads, or install other harmful software.

Microsoft Defender Antivirus automatically blocks detected PUA files. It stops them from downloading, moving, running, or installing. Blocked files get moved to quarantine, and you’ll get a notification when one is found.

Before You Start

⚠️ Admin Required: You must be signed in as an administrator to enable or disable PUA protection.

To download a test PUA file to check if your protection works: Feature Settings Check AMTSO | Detects Potentially Unwanted Applications (PUAs)

Learn more about PUA protection:

• Protect your PC from potentially unwanted applications – Microsoft Support
• Block potentially unwanted applications with Microsoft Defender Antivirus – Microsoft Defender for Endpoint
• How Microsoft identifies malware and potentially unwanted applications – Unified security operations

Option One: Microsoft Edge Settings

1. Open Microsoft Edge.
2. Click the three dots menu (Settings and more) in the top right corner. Press Alt+F on your keyboard.
3. Click Settings.
4. Click Privacy, search, and services in the left menu.
5. Under Security, find Block potentially unwanted apps.
6. Toggle it On (default) or Off based on what you want.

Note: If Microsoft Defender SmartScreen is turned off, this setting will be grayed out.

You can now close the Settings tab.

Option Two: Windows Security App

1. Open Windows Security. You can search for it in the Start menu.
2. Click App & browser control on the left side.
3. Click Reputation-based protection settings.
4. Turn Potentially unwanted app blocking On (default) or Off.

When you turn it On, you get two options:

• Block apps: Finds PUA that you’ve already downloaded or installed. This works in any browser.
• Block downloads: Stops PUA while it’s downloading in Microsoft Edge.

You can turn each option on or off separately. You can now close Windows Security.

Option Three: PowerShell Command

⚠️ Admin Required: This requires administrator access.

Note: This method doesn’t affect the Microsoft Edge download blocking setting.

1. Open Windows Terminal as an administrator. Search for it in the Start menu, then click “Run as administrator.”
2. Select Windows PowerShell from the dropdown.
3. Copy and paste one of the commands below and press Enter.

Turn off PUA protection (don’t block apps):

Set-MpPreference -PUAProtection 0

or

Set-MpPreference -PUAProtection Disabled

Turn on PUA protection and block apps (default):

Set-MpPreference -PUAProtection 1

or

Set-MpPreference -PUAProtection Enabled

Audit Mode (detect PUA but don’t block them):

Set-MpPreference -PUAProtection 2

or

Set-MpPreference -PUAProtection AuditMode

You can now close Windows Terminal.

Option Four: Local Group Policy Editor

⚠️ Admin Required: This requires administrator access.

Note: Local Group Policy Editor only works on Windows 11 Pro, Enterprise, and Education versions. If you have Windows 11 Home, use Option Five instead.

Note: This method doesn’t affect the Microsoft Edge download blocking setting.

1. Open the Local Group Policy Editor. Press Windows key + R, type gpedit.msc, and press Enter.
2. Navigate to this location in the left pane:
   

   Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus

3. In the right pane, find and double-click Configure detection for potentially unwanted applications.
4. Choose one of the options below:

Always Block PUA (recommended):

1. Select the dot next to Enabled.
2. In the Options dropdown, select Block.
3. Click OK.

Audit Mode (detect but don’t block):

1. Select the dot next to Enabled.
2. In the Options dropdown, select Audit Mode.
3. Click OK.

Always Disable PUA Protection:

1. Select the dot next to Enabled.
2. In the Options dropdown, select Disable.
3. Click OK.

Allow Users to Change Settings (default):

1. Select the dot next to Not Configured.
2. Click OK.

You can now close the Local Group Policy Editor.

Option Five: Registry Editor

⚠️ Admin Required: This requires administrator access.

Note: This method doesn’t affect the Microsoft Edge download blocking setting.

Always Block PUA:

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 1 /f

Audit Mode (detect but don’t block):

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 2 /f

Always Disable PUA Protection:

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f

Allow Users to Change Settings (default):

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v PUAProtection /f

Summary

Potentially unwanted applications can slow down your computer and show unwanted ads. Windows 11 includes PUA protection in Microsoft Defender to keep your PC safe. You have five different ways to control this protection:

• Option One uses Microsoft Edge settings (easiest for Edge users)
• Option Two uses the Windows Security app (simple graphical interface)
• Option Three uses PowerShell commands (for advanced users)
• Option Four uses Group Policy Editor (Windows Pro/Enterprise only)
• Option Five uses Registry Editor (for all Windows versions)

For most users, Option Two (Windows Security) is the easiest method. You can choose to block apps, block downloads, or both. You can also enable Audit Mode to test PUA detection without blocking anything. Remember that you need administrator access to make these changes.