Edit

Troubleshoot network protection

  • Applies to: Microsoft Defender for Endpoint Plan 1, Microsoft Defender for Endpoint Plan 2, Microsoft Defender for Business

This article provides troubleshooting information for network protection, in cases, such as:

  • Network protection blocks a website that is safe (false positive)
  • Network protection fails to block a suspicious or known malicious website (false negative)

There are four steps to troubleshoot false positives and false negatives in network protection:

  1. Confirm prerequisites
  2. Use audit mode to test the rule
  3. Add exclusions for the specified rule (for false positives)
  4. Submit support logs

Confirm prerequisites

Network protection works on devices with the following conditions:

Use audit mode

You can enable network protection in audit mode and then visit the network protection demo site to test the feature. All website connections are allowed by network protection but an event is logged to indicate any connection that would be blocked if network protection were enabled.

  1. Set network protection to Audit mode. Audit mode allows all connections but logs any connection that would be blocked, so you can test whether blocking is causing the issue.

    Set-MpPreference -EnableNetworkProtection AuditMode

  2. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block).

  3. Review the network protection event logs to see if the feature would block the connection if it were set to Enabled.

    If network protection isn't blocking a connection that you're expecting it should block, run the following command to re-enable Network Protection in block mode and restore enforcement:

    Set-MpPreference -EnableNetworkProtection Enabled

Report a false positive or false negative

If you tested the feature with the demo site and audit mode, network protection might work on preset scenarios but not for a specific connection. To report this issue, use the Windows Defender Security Intelligence web-based submission form to submit a false negative or false positive. With an E5 subscription, you can also link to any related alert from the Alerts queue.

See Address false positives/negatives in Microsoft Defender for Endpoint.

Add exclusions

The current exclusion options are:

  1. Setting up a custom allow indicator.

  2. Using IP exclusions: Add-MpPreference -ExclusionIpAddress 192.168.1.1.

  3. Excluding an entire process. For more information, see Microsoft Defender Antivirus exclusions.

Troubleshoot network performance issues

A network protection component might slow down connections to Domain Controllers or Exchange servers. You might also see Event ID 5783 NETLOGON errors. These errors mean the device can't connect to a Domain Controller.

To fix slow network connections or Event ID 5783 NETLOGON errors, switch Network Protection from 'block mode' to 'audit mode' or 'disabled'. If that resolves the problem, disable Network Protection components one at a time to isolate which component causes the issue.

Disable the following components one at a time and test your network speed after each change:

  1. Disable Datagram Processing on Windows Server
  2. Disable Network Protection Perf Telemetry
  3. Disable FTP parsing
  4. Disable SSH parsing
  5. Disable RDP parsing
  6. Disable HTTP parsing
  7. Disable SMTP parsing
  8. Disable DNS over TCP parsing
  9. Disable DNS parsing
  10. Disable inbound connection filtering
  11. Disable TLS parsing

If your network performance issues persist after disabling each Network Protection component listed earlier, then the issues are probably not related to network protection. Look for other causes of your network performance issues.

Collect diagnostic data for file submissions

When you report a problem with network protection, you're asked to collect and submit diagnostic data for Microsoft support and engineering teams to help troubleshoot issues. You collect and submit the diagnostic data by running MpCmdrun.exe -GetFiles, which saves the data at C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab.

For detailed instructions, see Collect Microsoft Defender Antivirus diagnostic data.

Resolve connectivity issues with network protection (for E5 customers)

Because network protection can't see your operating system proxy settings, network protection clients might be unable to reach the cloud service in some environments. To resolve these connectivity issues, configure one of the following registry keys so that network protection becomes aware of the proxy configuration. You can configure the registry key by using PowerShell, Microsoft Configuration Manager, or Group Policy.

If your environment uses a fixed proxy endpoint, configure Microsoft Defender to route traffic through that proxy server by setting the address and port:

Set-MpPreference -ProxyServer <proxy IP address: Port>

---OR---

If your network routes traffic dynamically through a PAC file instead of a static proxy, use the following command to configure Microsoft Defender to use that PAC URL:

Set-MpPreference -ProxyPacUrl <Proxy PAC url>

You can configure the registry key by using PowerShell, Microsoft Configuration Manager, or Group Policy. Here are some resources to help:

See also

  • Last updated on