Windows Defender Antivirus Domain Controller Baseline and Exploit Guard

Target Scope

Applicable Systems: Domain Controllers.
Operating Systems: Windows Server 2016 (and above).

Implementation Details

Priority: High
GPO Path / Registry Location:
- Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus

Rationale

Domain Controllers are the most critical assets in an Active Directory environment, containing the Active Directory database (NTDS.dit) and credential material for the entire enterprise. Because Domain Controllers are Tier 0 assets, protective security agents running on them must be hardened to prevent credential access, lateral movement, and tampering.

This submodule contains individual requirement controls for each advanced protective mechanism and configuration parameter within Windows Defender Antivirus for Domain Controllers.

Legacy Impact & Compatibility

ASR PSExec and WMI Rule: Enforcing "Block process creations originating from PSExec and WMI commands" (d1e49aac-8f56-4280-b9ba-993a6d77406c) can disrupt enterprise remote administration, monitoring agents, and backup orchestrators. In environments utilizing such orchestrators, this rule should be set to Audit mode or configured with explicit process exclusions rather than hard Block mode.
Office Application Rules: Rules targeting Microsoft Office or Adobe applications are documented but will not affect Domain Controllers, as these applications must never be installed on Tier 0 systems.
Reboot Requirement: Activating Sandbox Execution via MP_FORCE_USE_SANDBOX requires a reboot of the Domain Controllers to take effect. This should be scheduled during standard maintenance windows.
AMSI Provider Signatures: Any third-party security agents registering as AMSI providers must have a valid, trusted Authenticode signature. Unsigned or self-signed providers will be prevented from loading.

Defender Hardening Requirements for Domain Controllers

The following Defender Antivirus configurations must be enforced on Domain Controllers:

Sources & Compliance References

CIS Microsoft Windows Server Benchmark: Section 18.9 (Windows Defender Antivirus configuration parameters)
ANSSI Active Directory Hardening Guide: Protective controls baselines on Domain Controllers

REQ-DC-020 - Windows Defender Antivirus Domain Controller Baseline and Exploit Guard