How to Configure Network Protection in Block Mode in Windows 11 Using PowerShell

Phishing attacks, ransomware command-and-control (C2) beaconing, and malicious drive-by downloads frequently exploit non-browser applications that bypass standard web browser URL filters. Microsoft Defender Network Protection extends Microsoft SmartScreen web reputation checks to the network stack level, inspecting all outbound HTTP and HTTPS network traffic across every executing process. Configuring Network Protection in Block Mode ensures suspicious domains are terminated before data exfiltration occurs.

How Microsoft Defender Network Protection Works

Network Protection operates as an integrated component of Microsoft Defender Exploit Guard:

• System-Wide Inspection: Examines outbound connection requests initiated by browsers, background services, PowerShell scripts, and command-line utilities.
• Cloud Reputation Matching: Checks destination hostnames and IP addresses against Microsoft Defender Security Intelligence threat feeds in real time.
• Operational Modes: Operates in either Audit Mode (records telemetry without blocking) or Block Mode (actively resets connections and displays security toast alerts).

Auditing Current Network Protection Status via PowerShell

Open PowerShell as Administrator and query Microsoft Defender configuration preferences:

# Query Network Protection operational state
Get-MpPreference | Select-Object -Property EnableNetworkProtection

The integer value returned for EnableNetworkProtection represents:

• 0 = Disabled (No network traffic inspection).
• 1 = Enabled (Block Mode: malicious domains and IP addresses are actively blocked).
• 2 = Audit Mode (Connections are permitted, but telemetry is logged to Event Log).

Enabling Network Protection in Block Mode via PowerShell

To transition from Audit Mode or Disabled state to enforced Block Mode:

# Enforce Network Protection Block Mode
Set-MpPreference -EnableNetworkProtection Enabled

# Verify the setting was applied successfully
(Get-MpPreference).EnableNetworkProtection

The command executes immediately without requiring an operating system restart.

Testing Network Protection Blocking Capabilities

Microsoft provides safe, dedicated test domains to verify that Network Protection actively intercepts traffic:

1. Launch PowerShell and execute a web request against the Microsoft SmartScreen test domain:

   Invoke-WebRequest -Uri "https://smartscreentestratings2.net"

2. In Block Mode, the request immediately fails with a connection termination error.
3. A Windows Security desktop notification alerts: “Microsoft Defender has blocked a malicious website.”

Reviewing Blocked Network Events in Windows Event Viewer

Audit blocked connections and inspecting originating process IDs via PowerShell:

# Query Defender operational log for Network Protection blocks (Event ID 1125 / 1126)
Get-WinEvent -FilterHashtable @{
    LogName = "Microsoft-Windows-Windows Defender/Operational"
    Id = 1125, 1126
} -MaxEvents 20 | Format-List TimeCreated, Id, Message

Review the captured log details:

• Event ID 1125: Network Protection blocked an outbound connection in Block Mode.
• Event ID 1126: Network Protection detected an outbound connection in Audit Mode.