How to Install Microsoft Defender Application Guard on Windows 11

How to install or remove it using the Windows Security app

The easiest way to install or remove Application Guard is through the Windows Security app. You do not need any command-line tools. The Isolated browsing link in Windows Security opens the same Windows Features dialog you would reach through Control Panel 🎛️. The steps below cover both installing 💿 and removing the feature.

1. Click the Start menu ⊞, type Windows Security, and open the Windows Security app. You should see the Windows Security home screen with the protection areas listed on the left.

2. Click App & browser control in the left pane. The page on the right shows the reputation-based protection settings and, further down, the isolated browsing section.

3. Scroll to the Isolated browsing area and click the link to install or uninstall the feature. If you do not see this area, your edition or build does not offer Application Guard. Windows 11 Home never does. A Windows Features window should open.

4. In the window that opens, find Microsoft Defender Application Guard in the list. To install it 💿, tick the box. To remove it, clear the box. Click OK.

This can take a few minutes. A restart is normally required to finish the change, whether you are installing 💿 or uninstalling. Save your work and restart when Windows asks. To undo an install, repeat these steps and clear the box.

How to install or remove it using PowerShell

If you prefer text commands, or you want to script the setup across several PCs, you can do the same job in PowerShell. It runs the deployment image servicing tool, which adds or removes the Windows feature. It needs administrator rights.

1. Click the Start menu ⊞ and type PowerShell.
2. Right-click Windows PowerShell and choose Run as administrator.
3. Click Yes if User Account Control asks for permission. A blue PowerShell window opens, and its title bar says Administrator.

To install the 💿 feature, run this command:

Dism /online /Enable-Feature /FeatureName:"Windows-Defender-ApplicationGuard"

To remove the feature, run this command instead:

Dism /online /Disable-Feature /FeatureName:"Windows-Defender-ApplicationGuard"

When the command finishes, it may ask whether you want to restart the computer. Type Y and press Enter. If you would rather restart later, type N, but the change does not take effect until you do. If the command returns an error saying the feature name is unknown, your Windows build probably no longer includes Application Guard.

Troubleshooting and Verification

After the restart, check that the feature is installed. There are two ways to do this.

1. Click the Start menu, type Turn Windows features on or off, and open the result. Find Microsoft Defender Application Guard in the list. If its box is ticked, the feature is installed.
2. Open Microsoft Edge, click the Settings and more (three dots) menu, and look for New Application Guard window. If you see it, click it to open an isolated window. Edge marks that window so you can tell it apart from a normal one. If the menu item is missing, the feature may still need a restart, or it may not be set up for your PC. An admin may also need to enable it through policy.

Summary

However, Microsoft has deprecated the feature and plans to remove it in future Windows versions. You can still install and use it for now, but it will not get new features or security patches. For long-term protection, plan to move to another isolation option.

Is Microsoft Defender Application Guard being deprecated?

Yes. Application Guard no longer receives new feature updates, and Microsoft is removing it in future Windows versions, starting with Windows 11, version 24H2. Microsoft encourages users to move to Microsoft Edge for Business or other modern isolation technologies.

Does Application Guard work in IE mode?

Yes, Application Guard can be set up to work with Internet Explorer mode in Microsoft Edge. This lets organizations isolate legacy web applications that need IE mode while keeping a secure container. The host system stays protected from threats on older, less secure websites.

Can I download files from the container to the host?

By default, files you download inside the Application Guard container stay separate from your main device. You can set rules to allow or block downloads from the container to the host. Admins usually manage these rules through Group Policy or Intune, which keeps bad files from leaving the container.