Skip to content
Get packs

Guide · Agent skill

How to use the Windows Defender Hardening agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains the configuring-windows-defender-advanced-settings skill, an agent skill that helps an AI agent configure Microsoft Defender for Endpoint (MDE) advanced protections on Windows computers. It is aimed at IT administrators and security engineers who manage enterprise endpoints. By the end you will know how to install the skill, ask for the right things in plain language, and apply its changes carefully.

Windows Defender Hardeningmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings, Capabilities, Skills in the Claude apps.
  2. 2Confirm your environment. Check that the endpoints run Windows 10 or 11 with Microsoft Defender Antivirus, and that you have the required Microsoft 365 E5 or Defender for Endpoint Plan 2 license for the features you need.
  3. 3Ask for a gap report. Ask the agent to compare current Defender settings against a recommended baseline. The bundled scripts produce this report, which gives you a list of differences to review.
  4. 4Choose the settings to change. Pick the ASR rules, Controlled Folder Access, Network Protection, or exploit protection settings that match your compliance goals.
  5. 5Enable audit mode first. Have the agent set the chosen features to audit mode so you can see what would be blocked without enforcing anything yet.
  6. 6Review audit events. Check Event IDs 1124 and 1125 in the Microsoft-Windows-Windows Defender/Operational log and add exclusions or allowed applications for legitimate software.
  7. 7Enforce on a test group. After review, move to Block mode on a test group first, then deploy more widely through Intune, SCCM, or Group Policy.

What an agent skill is and what this one does

An agent skill is a folder of instructions and supporting files that an AI agent loads when your request matches the skill's purpose. This skill covers advanced Microsoft Defender settings: Attack Surface Reduction (ASR) rules, Controlled Folder Access against ransomware, Network Protection, and Exploit Protection. It also covers cloud-delivered protection and scan and update settings.

Once installed, the agent writes PowerShell commands for these settings using cmdlets such as Get-MpPreference, Set-MpPreference, and Set-ProcessMitigation. It recommends audit mode before enforcement. The bundled scripts read current Defender settings, compare them against recommended baselines, and produce a gap report.

  • Use it for: hardening Windows endpoints beyond default Defender settings
  • Use it for: producing compliance evidence for endpoint malware defenses
  • Do not use it for: third-party EDR such as CrowdStrike or SentinelOne, or Microsoft Defender for Cloud

Install the skill from the ZIP or the Claude apps

Download the skill's ZIP file from this page. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. The skill's folder should contain SKILL.md along with the scripts and references folders.

If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there.

  • Personal install: unzip into ~/.claude/skills/
  • Project install: unzip into the project's .claude/skills/ folder
  • Claude apps: Settings → Capabilities → Skills, then upload

Check the requirements before you start

The skill needs Windows 10 or 11 with Microsoft Defender Antivirus. Full MDE features need a Microsoft 365 E5 or Defender for Endpoint Plan 2 license. Some features, including Web Content Filtering, are managed in the Microsoft 365 Defender portal and require the Plan 2 license.

You need PowerShell for the configuration commands and Python 3 to run the bundled audit scripts. Intune, SCCM, or Group Policy is optional and used for enterprise deployment. The source also notes that endpoints should not run third-party antivirus in active mode, because Defender then enters passive mode.

  • Windows 10/11 with Microsoft Defender Antivirus
  • Microsoft 365 E5 or Defender for Endpoint Plan 2 for full features
  • PowerShell and Python 3
  • Intune, SCCM, or Group Policy for enterprise rollout (optional)

Trigger the skill with natural requests

You do not need to name the skill. The skill activates for requests about Windows Defender configuration, ASR rules, MDE tuning, Controlled Folder Access, network protection, exploit protection, or Microsoft endpoint security. Be specific about the endpoint's scope and whether you want a change or an assessment.

Good requests name the feature and the mode. For example, ask for an audit-mode rollout first, or ask for a gap report against a baseline before any changes are made.

  • Review our Windows endpoints' Defender settings against a recommended baseline and give me a gap report.
  • Set up ASR rules for Office applications in audit mode first, and explain what each rule blocks.
  • Turn on Controlled Folder Access in audit mode and tell me which legitimate apps need allowing.
  • Write the PowerShell to enable Network Protection in audit mode for our test group.

Apply a setting safely, starting in audit mode

The source describes the mode values for ASR rules: 0 is Disabled, 1 is Block, 2 is Audit, and 6 is Warn. For Controlled Folder Access and Network Protection, the skill recommends setting audit mode first to find legitimate applications and traffic that would be affected. Event IDs 1124 and 1125 in the Microsoft-Windows-Windows Defender/Operational log record these audit results.

Review the commands the agent produces before running them. Enforcing ASR rules or Controlled Folder Access can block legitimate applications, so test on a non-production group first.

  • Read the gap report and decide which settings to change.
  • Enable audit mode, then review Event IDs 1124 and 1125 for blocked or flagged activity.
  • Add exclusions or allowed applications for legitimate software.
  • Move to Block mode on a test group, then roll out more widely.
Set-MpPreference -EnableControlledFolderAccess AuditMode

What people use it for

  • Generating a gap report of an endpoint fleet's Defender settings against a recommended baseline for an internal audit.
  • Drafting PowerShell to enable the ASR rules that target Office macros, child processes, and credential theft from LSASS, in audit mode first.
  • Planning a Controlled Folder Access rollout by listing the protected folders and the applications that need allowed access.
  • Writing exploit protection commands for Office applications such as WINWORD.EXE, EXCEL.EXE, and POWERPNT.EXE, after exporting current settings for reference.
  • Collecting compliance evidence on endpoint malware defenses for a security review.

Frequently asked questions

How do I install the Windows Defender hardening agent skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings, Capabilities, Skills.

Is this skill free to use?

The skill is licensed under Apache-2.0, as listed on this page. The Microsoft features it configures are licensed separately, and several need a Microsoft 365 E5 or Defender for Endpoint Plan 2 license.

What license do I need for the skill's features?

Full MDE features need a Microsoft 365 E5 or Defender for Endpoint Plan 2 license. Basic Defender Antivirus runs on Windows 10 or 11 without these, but the advanced features in this skill depend on the higher license.

Can I use this skill with CrowdStrike or SentinelOne?

No. The skill says not to use it for third-party EDR deployment such as CrowdStrike or SentinelOne, and it is not for Microsoft Defender for Cloud either.

Why does the skill recommend audit mode first?

Enforcing ASR rules or Controlled Folder Access can block legitimate applications. Audit mode lets you see what would be blocked, through Event IDs 1124 and 1125, so you can add exclusions before enforcing.

Does the skill send my data over the network?

The listing says the skill does not use the network. It does run scripts, including Python 3 audit scripts that read current Defender settings, so review those scripts before running them.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits IT administrators and security engineers who run Microsoft Defender for Endpoint and need to harden Windows endpoints against a baseline with audit-first changes. Home users, small setups without an MDE license, and environments running third-party EDR should choose a different tool or skip it.

Download the skill