How to Install Microsoft Defender Application Guard on Windows 11

How to install or remove it using the Windows Security app

You can manage this feature right from your settings. Note: This requires administrative access to your computer.

1. Open the Windows Security app. You can find this by clicking your ⊞ Start menu and typing “Windows Security.”

2. Click on the App & browser control section.

3. Under the Isolated browsing area, click the link to install or uninstall the feature.

4. A new window will appear. Check the box next to Microsoft Defender Application Guard to 💿 install it. If you want to remove it, uncheck the box .

Windows will download the files needed. If you are uninstalling, you will be asked to restart your computer to finish the process.

How to install or remove it using PowerShell

You can also use commands to change this setting quickly. Admin Privilege Required: You must run these steps with admin privileges. Open Windows PowerShell or Command Prompt as an administrator.

To install the feature, run this command:

Dism /online /Enable-Feature /FeatureName:"Windows-Defender-ApplicationGuard"

To remove the feature, run this command:

Dism /online /Disable-Feature /FeatureName:"Windows-Defender-ApplicationGuard"

If the computer asks if you want to restart, type Y and press Enter.

Troubleshooting and Verification

After installation, you can verify if the feature is active by checking the Windows Features list or by attempting to open a new Application Guard window. If the option is missing, make sure your computer’s hardware supports virtualization and that it’s enabled in your BIOS/UEFI settings (the basic input/output system or unified extensible firmware interface, which controls your computer’s startup process). You can also check the status using the command: Get-WindowsOptionalFeature -Online -FeatureName Windows-Defender-ApplicationGuard.

Summary

Microsoft Defender Application Guard adds a layer of security by isolating your browsing activity in a virtualized container. While it is a powerful tool for enterprise-managed environments, remember that it is currently being deprecated. You can install or remove it using either the Windows Security app or PowerShell. For advanced configurations, please refer to the official Microsoft documentation.

Is Microsoft Defender Application Guard being deprecated?

Yes, Microsoft has deprecated the Application Guard feature. It is no longer receiving new feature updates and is slated for removal in future Windows versions, specifically starting from Windows 11, version 24H2. Users are encouraged to transition to Microsoft Edge for Business or other modern security isolation technologies.

Does Application Guard work in IE mode?

Yes, Application Guard can be configured to work with Internet Explorer mode in Microsoft Edge. This allows organizations to isolate legacy web applications that require IE mode while maintaining a secure container environment, protecting the host system from potential threats found on older, less secure websites.

Can I download files from the container to the host?

By default, files downloaded inside the Application Guard container are isolated. You can configure policies to allow or block file downloads to the host device. This is typically managed via Group Policy or Intune deployment to ensure that malicious files do not escape the container environment.