Microsoft Defender for Endpoint STIG Checklist

18 items · Security · Hard difficulty · 4 hours

Harden endpoints with the Microsoft Defender for Endpoint STIG checklist.

• Inventory all endpoints with Microsoft Defender for Endpoint installed

  List devices, OS versions, and management status.

• Verify MDE product version and apply recommended updates

  Confirm version matches STIG requirements and patch as needed.

• Enable tamper protection in MDE policy

  Prevents unauthorized changes to protection settings.

• Enable real-time protection and cloud-delivered protection

  Ensure threats are blocked and cloud intelligence is used.

• Enable Endpoint Detection and Response (EDR) and set to block mode if available

  Activate EDR to detect and block advanced threats.

• Deploy MDE sensors to all managed devices

  Install and verify sensor health and connectivity.

• Configure automatic signature and intelligence updates

  Set frequent update cadence for signatures and threat intel.

• Enable network protection and web content filtering

  Block access to known malicious sites and content.

• Enable attack surface reduction (ASR) and exploit protection

  Reduce common exploit paths and application attack surface.

• Enable high-confidence ASR rules

  Start with recommended high-confidence rules to minimize false positives.

• Configure exploit mitigations for browsers and Office apps

  Apply targeted mitigations to commonly exploited applications.

• Configure Controlled Folder Access to protect critical data

  Limit app access to protected folders to prevent ransomware damage.

• Review and remove unnecessary local exclusions

  Audit exclusions to reduce blind spots and security risk.

• Integrate MDE with Microsoft Entra ID and Microsoft Intune where applicable

  Enable identity and device management integrations for policy delivery.

• Configure role-based access control and enable administrative audit logging

  Restrict privileges and log admin actions for accountability.

• Run a full vulnerability and STIG compliance scan and remediate findings

  Execute scans and track remediation until compliance is achieved.

• Document approved exceptions and maintain deviation waivers

  Record rationale, compensating controls, and approval details.

• Schedule periodic policy reviews and update cadence

  Set recurring reviews to adapt to new threats and STIG updates.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.