How to Configure Application Guard and Hardware Isolation in Microsoft Edge Using PowerShell

Browsing untrusted internet domains poses severe security risks from zero-day browser exploits, malicious JavaScript heaps, and credential phishing. Microsoft Defender Application Guard isolates untrusted web browsing inside a lightweight, hardware-isolated Hyper-V container completely separated from the host operating system. Even if a user visits a malicious website that executes arbitrary remote code, the payload remains trapped inside the disposable container and is permanently destroyed when the browsing session closes.

Architectural Overview of Application Guard Container Isolation

Application Guard combines hardware virtualization with Microsoft Edge enterprise policies:

• Hyper-V Micro-VM: Untrusted sites execute within a miniature Windows kernel running in an isolated virtualized container with zero access to host storage, credentials, or local memory.
• Network Boundary Definitions: Corporate intranets, trusted domains, and cloud resources run natively in Microsoft Edge, while unclassified public internet traffic automatically transitions into Application Guard.
• Ephemeral Sandbox: Closing the Application Guard window purges all temporary files, cookies, downloaded malware, and cached credentials.

Enabling the Application Guard Windows Feature via PowerShell

Launch PowerShell as Administrator and enable the optional Windows feature:

# Install Microsoft Defender Application Guard
Enable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-ApplicationGuard" -NoRestart

# Restart the workstation to complete installation
Restart-Computer -Force

Configuring Microsoft Edge Application Guard Policies via Registry

Configure Edge browser policy flags using PowerShell registry commands:

# Define Microsoft Edge policy registry path
$EdgePolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"

# Ensure registry path exists
if (-not (Test-Path $EdgePolicyPath)) {
    New-Item -Path $EdgePolicyPath -Force | Out-Null
}

# Enable Application Guard in Microsoft Edge
New-ItemProperty -Path $EdgePolicyPath -Name "ApplicationGuardEnabled" -Value 1 -PropertyType DWord -Force

# Block copy/paste from isolated container back to host OS
New-ItemProperty -Path $EdgePolicyPath -Name "ApplicationGuardClipboardFileType" -Value 1 -PropertyType DWord -Force

# Block file printing from isolated container
New-ItemProperty -Path $EdgePolicyPath -Name "ApplicationGuardPrintFileType" -Value 0 -PropertyType DWord -Force

Verifying Application Guard in Microsoft Edge

Confirm that hardware-isolated browsing is operational:

1. Launch Microsoft Edge.
2. Click the Settings and more (three dots) menu in the upper-right corner.
3. Select New Application Guard window.
4. A dedicated browser window opens, distinguished by a prominent shield icon in the title bar and tab strip.
5. Navigate to edge://application-guard-internals in the address bar to inspect container health, virtualization status, and network boundary mappings.