Exploit protection: Specify an XML file that contains settings for mitigating exploits of system processes and apps.

You can also specify additional folders that are not protected by default. Controlled folder access: Configure blocking or auditing, and then add Apps that can bypass this policy.You can also exclude specific files or folders from this rule. Attack Surface Reduction: Configure the Office threat, scripting threats, and email threats you want to block or audit.For each component you select, you can then configure additional details. Next, select the Exploit Guard components you want to manage with this policy. On the General page of the Create Configuration Item Wizard, specify a name, and optional description for the configuration item. On the Home tab, in the Create group, click Create Exploit Policy. In the Configuration Manager console, go to Assets and compliance > Endpoint Protection, and then click Windows Defender Exploit Guard. The following requirements must also be satisfied, depending on the components and rules configured: Exploit Guard componentĭevices must have Microsoft Defender for Endpoint always-on protection enabled. Managed devices must run Windor later the minimum Windows Server build is version 1809 or later. For more information, see Enable optional features from updates. You must enable this feature before using it.

Configuration Manager doesn't enable this optional feature by default.

Windows defender protected folders