Enable or Disable Microsoft Defender PUA Protection in Windows 11

What Are Potentially Unwanted Applications?

Microsoft Defender Antivirus blocks Potentially Unwanted Applications (PUAs). PUAs are programs that cause problems, such as showing annoying ads or slowing your computer. Microsoft Defender Antivirus detects PUA files before they download or install, keeping your PC safer from these unwanted programs.

Microsoft Defender Antivirus automatically blocks detected PUA files. It stops them from downloading, moving, running, or installing. Blocked files get moved to quarantine, and you’ll get a notification when one is found.

Before You Start

Before you change Microsoft Defender’s PUA protection settings, make sure you have administrator access on your Windows 11 computer. You can check if your PUA protection is working by downloading a special test file from AMTSO. This file is designed to find potentially unwanted applications, confirming your settings are active and protecting your PC.

To download a test PUA file to check if your protection works: Feature Settings Check AMTSO | Detects Potentially Unwanted Applications (PUAs)

Learn more about PUA protection:

• Protect your PC from potentially unwanted applications – Microsoft Support
• Block potentially unwanted applications with Microsoft Defender Antivirus – Microsoft Defender for Endpoint
• How Microsoft identifies malware and potentially unwanted applications – Unified security operations

Option 1Microsoft Edge Settings

1. Open Microsoft Edge.
2. Click the three dots menu (Settings and more) in the top right corner. Press Alt+F on your keyboard.
3. Click Settings.
4. Click Privacy, search, and services in the left menu.
5. Under Security, find Block potentially unwanted apps.
6. Toggle it On (default) or Off based on what you want.

You can easily turn Microsoft Defender’s PUA protection on or off directly within the Microsoft Edge browser settings. Simply open Edge, go to ⚙️ the Settings menu, and find the ‘Block potentially unwanted apps’ option under Privacy, search, and services. Toggling this setting controls whether Edge blocks unwanted apps during downloads.

You can now close ⚙️ the Settings tab.

Option 2Windows Security App

1. Open Windows Security. You can search for it in the ⊞ Start menu.
2. Click App & browser control on the left side.
3. Click Reputation-based protection settings.
4. Turn Potentially unwanted app blocking On (default) or Off.

The Windows Security app provides a straightforward way to manage Microsoft Defender’s PUA protection without needing your web browser. Open the Windows Security app, click on ‘App & browser control’ in the left menu, and then select ‘Reputation-based protection settings.’ Here, you can easily turn Potentially unwanted app blocking On or Off.

• Block apps: Finds PUA that you’ve already downloaded or installed. This works in any browser.
• Block downloads: Stops PUA while it’s ⬇️ downloading in Microsoft Edge.

You can turn each option on or off separately. You can now close Windows Security.

Option 3PowerShell Command

For users comfortable with commands, you can manage Microsoft Defender’s PUA protection using PowerShell with administrator rights. Open Windows Terminal as an administrator, select Windows PowerShell, and use specific commands to control PUA blocking. Keep in mind this method controls system-wide PUA blocking but doesn’t affect Edge’s download protection.

1. Open Windows Terminal as an administrator. Search for it in the ⊞ Start menu, then click “Run as administrator.”
2. Select Windows PowerShell from the dropdown.
3. Copy and paste one of the commands below and press Enter.

Turn off PUA protection (don’t block apps):

Set-MpPreference -PUAProtection 0

or

Set-MpPreference -PUAProtection Disabled

Turn on PUA protection and block apps (default):

Set-MpPreference -PUAProtection 1

or

Set-MpPreference -PUAProtection Enabled

Audit Mode (detect PUA but don’t block them):

Set-MpPreference -PUAProtection 2

or

Set-MpPreference -PUAProtection AuditMode

You can now close Windows Terminal.

Option 4Local Group Policy Editor

Windows 11 Pro, Enterprise, and Education users can manage Microsoft Defender’s PUA protection settings using the Local Group Policy Editor. This tool allows central control over security features. However, this method does not change the Microsoft Edge download blocking setting and is not available on Windows 11 Home editions.

Note: This method doesn’t affect the Microsoft Edge download blocking setting.

1. Open the Local Group Policy Editor. Press Windows key + R, type gpedit.msc, and press Enter.
2. Navigate to this location in the left pane:
   

   💻Code

   Copy

   Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus

3. In the right pane, find and double-click Configure detection for potentially unwanted applications.
4. Choose one of the options below:

Always Block PUA (recommended):

1. Select the dot next to Enabled.
2. In the Options dropdown, select Block.
3. Click OK.

Audit Mode (detect but don’t block):

1. Select the dot next to Enabled.
2. In the Options dropdown, select Audit Mode.
3. Click OK.

Always Disable PUA Protection:

1. Select the dot next to Enabled.
2. In the Options dropdown, select Disable.
3. Click OK.

Allow Users to Change Settings (default):

1. Select the dot next to Not Configured.
2. Click OK.

You can now close the Local Group Policy Editor.

Option 5Registry Editor

You can control Microsoft Defender’s PUA protection by editing the Windows Registry, but this is an advanced method requiring administrator access. Using the specific command `reg add “🗝️HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defendercopy” /v PUAProtection /t REG_DWORD /d 1 /f` will always block PUAs. Note that this registry edit does not affect Edge’s download blocking feature.

Note: This method doesn’t affect the Microsoft Edge download blocking setting.

Always Block PUA:

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 1 /f

Audit Mode (detect but don’t block):

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 2 /f

Always Disable PUA Protection:

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f

Allow Users to Change Settings (default):

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v PUAProtection /f

Summary

Microsoft Defender in Windows 11 helps protect your PC from potentially unwanted applications that can slow things down or show unwanted ads. You can manage this PUA protection easily using Microsoft Edge settings or the Windows Security app. For more advanced users, options include PowerShell, Local Group Policy Editor, or the Registry Editor to control these settings.

• Option One uses Microsoft Edge settings (easiest for Edge users)
• Option Two uses the Windows Security app (simple graphical interface)
• Option Three uses PowerShell commands (for advanced users)
• Option Four uses Group Policy Editor (Windows Pro/Enterprise only)
• Option Five uses Registry Editor (for all Windows versions)

For most users, Option Two (Windows Security) is the easiest method. You can choose to block apps, block downloads, or both. You can also enable Audit Mode to test PUA detection without blocking anything. Remember that you need administrator access to make these changes.