How to Enable and Configure SmartScreen Network Protection via PowerShell in Windows 11

Microsoft Defender SmartScreen plays a pivotal role in shielding Windows 11 endpoints from phishing domains, exploit kits, and malicious file downloads. While standard SmartScreen filters operate primarily inside Microsoft Edge and File Explorer, SmartScreen Network Protection expands this defensive perimeter to the entire operating system. Operating at the transport layer, Network Protection intercepts low-level outbound network connections attempted by any application—including third-party browsers, command-line utilities, and background services—blocking access to untrusted domains flagged by Microsoft Threat Intelligence. System administrators and enterprise power users can manage, audit, and enforce this protective boundary directly through elevated PowerShell commands.

Understanding SmartScreen Network Protection Modes

Network Protection in Microsoft Defender Antivirus functions under four distinct operational modes:

• Disabled (0): Network traffic is completely unmonitored by the Network Protection engine. Outbound connections are permitted without domain reputation evaluation.
• Enabled / Block Mode (1): Malicious and suspicious outbound HTTP and HTTPS connections are immediately terminated. Users receive a desktop toast notification and access is denied across all system processes.
• Audit Mode (2): Connections to untrusted domains are permitted, but an entry is logged in the Windows Event Viewer. This mode is ideal for enterprise staging environments to evaluate legitimate traffic without disrupting business operations.
• Warn Mode (3): Users are presented with a blocking warning dialogue but retain the ability to bypass the prompt and proceed to the requested domain if necessary.

Verifying the Current Network Protection Status via PowerShell

To inspect the current configuration of Defender Network Protection on your Windows 11 system:

1. Click Start, type PowerShell, right-click Windows PowerShell, and select Run as administrator.
2. Execute the following cmdlet to query the active Defender preference settings:

Get-MpPreference | Select-Object -Property EnableNetworkProtection

The output returns a single numeric integer corresponding to the active mode: 0 (Disabled), 1 (Enabled), or 2 (Audit Mode). If the property returns empty or 0, Network Protection is currently inactive.

Enabling Full Enforcement Block Mode

To enforce immediate blocking against malicious infrastructure across all system applications, apply Block Mode using Set-MpPreference:

Set-MpPreference -EnableNetworkProtection Enabled

Alternatively, you can specify the numeric equivalent directly:

Set-MpPreference -EnableNetworkProtection 1

The command executes silently without requiring a system reboot. To confirm the policy has applied successfully, rerun Get-MpPreference | Select-Object EnableNetworkProtection and verify that the output displays 1.

Configuring Audit Mode for Enterprise Testing

Before implementing full blocking on critical workstations or developer environments, activating Audit Mode enables you to discover potential false positives:

Set-MpPreference -EnableNetworkProtection AuditMode

When set to Audit Mode, Defender monitors outbound socket creation and writes event log records whenever a connection targets a domain flagged by Microsoft SmartScreen. You can inspect these audit trails using the PowerShell Get-WinEvent cmdlet:

Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-Windows Defender/Operational'
    Id = 1126
} | Format-Table TimeCreated, Message -Wrap

Event ID 1125 corresponds to an active block event under Mode 1, whereas Event ID 1126 denotes an audit-only notification under Mode 2, detailing the initiating process executable path and destination IP address or domain name.

Configuring Network Protection via the Windows Registry

In environments where Group Policy or automated provisioning scripts manage registry hives directly, Network Protection can be configured via the local machine registry:

$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection"

if (-not (Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}

New-ItemProperty -Path $regPath -Name "EnableNetworkProtection" -Value 1 -PropertyType DWord -Force

Testing Network Protection Enforcement

Microsoft maintains dedicated, benign demonstration endpoints designed specifically to validate SmartScreen and Defender Exploit Guard policies. To test your active configuration:

1. Open a standard web browser or third-party terminal.
2. Navigate to Microsoft’s official testing URL: https://smartscreentestratings2.net
3. If Block Mode (1) is active, the browser or terminal immediately halts the request, rendering a Defender warning or connection timeout, and logs Event ID 1125 in the operational log.