Turn on App & browser control via Group Policy or the registry

Question

I asked this question in the Microsoft Community and was directed to ask it here.

In the latest version of Windows 10 Pro (20H2 at the moment), is there a way to turn on App & browser control via LOCAL Group Policy or the registry?
I need "On" to be the default when a new user logs into a computer.

I know how to turn it on for the account that is currently logged in but not for all users and all future users.

As always, any help would be appreciated!

Answer 1

Group policy controls everything so yes you can turn it on via GP. The hard part is finding them. I find using the Local Computer Policy mmc applet and then using the filter option to search for settings easiest. The core settings you're looking for are under Computer Configuration\Administrative Templates\Windows Components

1. Reputation-based protection :: This is a grouping of related settings. You'll have to find and set each option in GP as they are not grouped together.
2. Isolated browsing :: This just gives an option to install AppGuard and that can be done using normal software installation. After that you can configure in GP. For this you should find the subfolder. I'm not sure what is configurable though.
3. Exploit protection :: The settings are under Microsoft Defender Exploit Guard but it requires some sort of configuration file. You'll have to research that some more.

Answer 2

@Michael Taylor , thanks so much for your nearly instantaneous reply.

Unfortunately, I'm not an expert at Group Policy (so much so that I didn't even know about the filter option!).

When I tried using the filter under Computer Configuration\Administrative Templates\Windows Components with Reputation as the keyword, it found nothing. I have all of the type options set to "Any" and all three Within boxes checked.
I've tried with no "Enable Requirments Filters" selected and with the Windows 10 check box checked.
Note: I'm using the local Group policy editor, gpedit.msc.

To explain further what I'm trying to do, when my users log in they see this in their tray:

Clicking on it opens this window:

Then I get calls or tickets asking if their computer is safe. I have them click on "Turn on" and all is good. (Yes, I know there's a debate about whether one needs to turn it on but the powers above me have made that decision for me.)

I'd really like to just have it turned on by default to reduce the needless calls. That's the actual thing I'm looking for, a setting in either local gpedit (that's all I have access to) or the registry that will have the same effect as clicking the turn on button. I can deal with the registry key being in HKCU since I can edit the default user registry hive. Unfortunately, I'm not aware of the appropriate key, if there is one.

Any other suggestions for me?

Answer 3

I don't know how to do it via group policy, but you can turn it on during the laptop imaging process by modifying the registry.

The registry key that gets modified is in the default user profile, this means that when any user logs into the computer for the first time and it clones the default profile it will set the protection accordingly.

You can either load the default user hive and then modify the key listed below manually or run the bellow commands in an elevated Powershell session, but remember it will only apply to accounts that have never logged in before so it's best to run it as part of your imaging process if you are mass deploying endpoints

# Loads the default user registry hive
reg load HKLM\DEFAULT c:\users\default\ntuser.dat

# Turn on app and browser control
reg add "HKLM\DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_DWORD /d 1 /f

# Unload the default user registry hive
reg unload HKLM\DEFAULT