Skip to content
Get packs

Windows Defender Hardening

Guides an agent through configuring advanced Microsoft Defender for Endpoint protections on Windows.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

When installed, the agent knows how to configure Microsoft Defender's advanced protections on Windows computers, such as Attack Surface Reduction rules, Controlled Folder Access against ransomware, Network Protection, and Exploit Protection. It writes PowerShell commands for these settings, recommends audit mode before enforcement, and includes bundled scripts that read current Defender settings and compare them against recommended baselines to produce a gap report.

Great for

  • IT administrators hardening Windows endpoints in enterprises that use Microsoft Defender for Endpoint
  • Security engineers preparing compliance evidence for endpoint malware defenses
  • Teams reviewing Defender configuration against a recommended baseline

Skip it if

  • Home users or small setups without an MDE license, since several features need Microsoft 365 E5 or MDE Plan 2 and the commands could disrupt a machine if applied blindly
  • Environments running third-party EDR such as CrowdStrike or SentinelOne, which the skill explicitly says not to use it for
  • Changing production endpoints without testing, because enforcing ASR rules or Controlled Folder Access can block legitimate applications

Try asking

  • “Audit our Windows laptops' Defender settings against a recommended hardening baseline”
  • “Write PowerShell to enable ASR rules for Office macro and child process blocking in audit mode first”
  • “Set up Controlled Folder Access with a custom protected folder and an allowed backup application”
  • “Explain how to deploy these Defender settings via Intune or Group Policy”
Step-by-step guide: how to use Windows Defender HardeningInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    configuring-windows-defender-advanced-settings.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip configuring-windows-defender-advanced-settings.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip configuring-windows-defender-advanced-settings.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run in audit mode first and review Event IDs 1124 and 1125 before switching ASR rules, Controlled Folder Access, or Network Protection to block mode
  • Review the bundled scripts before running them, since they execute PowerShell commands on the local machine and the agent may run them with administrator rights
  • Test changes on a pilot group of endpoints before rolling out enterprise-wide through Intune or GPO

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.