CFG monitors and checks certain aspects of a program’s control flow, including where execution changes from straight sequential instruction. CFG places restrictions on where an application can execute code, which makes it harder for malicious hackers to execute subjective code through common vulnerabilities, such as buffer overflows. Secure Boot provides a high-value security benefit by using signatures and measurements to help protect boot-loader code and firmware from tampering.ĬFG is a platform security feature that helps prevent memory-corruption vulnerabilities. Moves the Kernel Mode Code Integrity (KMCI) and Hypervisor Code Integrity (HVCI) components into virtual secure mode to harden them from attack.

Virtual Secure Mode Protected Code Integrity.

A Windows component that provides a rules engine to help ensure executable security A virtual shell that isolates the ISASS.exe process from the operating system, which reduces the risk that malicious users will compromise your users’ domain credentials It’s a combination of several features, such as: Windows Defender Device Guard is not a single feature. You can choose exactly what can run inside your environment by using a code-integrity policy to protect your environment. Windows Defender Device Guard can block any software, even if an unauthorized user manages to take control of the operating system. Windows Defender Device Guard uses virtualization-based security to isolate the code-integrity service from the Windows kernel. When you turn it on, instead of trusting all apps except those blocked by an antivirus or other security solution, the operating system will run only the applications on a whitelist your organization defines. Windows Defender Device Guard is a suite of security features introduced in Windows Server 2016. Includes access to parental controls and family settings. Includes exploit-protection mitigations and Windows Defender SmartScreen settings. Includes information about and access to firewall settings, including Windows Defender Firewall settings. Provides information about drivers, storage space and Windows Update. Includes information about and access to antivirus settings and the Controlled folder access feature of Windows Defender Exploit Guard. Here is some of the information and functionality it provides:

The Windows Defender Server 2016 Security Center app can help you identify and remove malware from computers and other devices in your environment.

Windows defender folder protection