How to Configure Endpoint Protection in Configuration Manager

To create a configuration item to enable PUA protection

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, open the Compliance Settings folder, right-click on Configuration Items, and then click Create Configuration Item.

3. In the Configuration Item wizard, select a name and the Windows Desktops and Server (custom) Configuration Item type before clicking Next. Select the targeted operating systems, and go to the next page. Click New to create a new setting.

4. In the Create Setting dialog box, select a name for the setting, and specify the following additional information:

   - **Data type** – Select the **Integer** type to set the value type to used
   
   - **Hive** - Select HKEY\_LOCAL\_MACHINE as the hive root
   
   - **Key** – Select the key according to your product version:
   
     <table>
     <colgroup>
     <col style="width: 50%" />
     <col style="width: 50%" />
     </colgroup>
     <thead>
     <tr class="header">
     <th><p>Product name</p></th>
     <th><p>Key</p></th>
     </tr>
     </thead>
     <tbody>
     <tr class="odd">
     <td> 
     <p>System Center Endpoint Protection</p></td>
     <td><p>Software\Policies\Microsoft\Microsoft Antimalware\MpEngine</p></td>
     </tr>
     <tr class="even">
     <td><p>Forefront Endpoint Protection</p></td>
     <td><p>Software\Policies\Microsoft\Microsoft Antimalware\MpEngine</p></td>
     </tr>
     <tr class="odd">
     <td><p>Microsoft Security Essentials</p></td>
     <td><p>Software\Policies\Microsoft\Microsoft Antimalware\MpEngine</p></td>
     </tr>
     <tr class="even">
     <td><p>Windows Defender</p></td>
     <td><p>Software\Policies\Microsoft\Windows Defender\MpEngine</p></td>
     </tr>
     </tbody>
     </table>
   
   - **Value** – Enter MpEnablePus as the registry value name to be configured
   
   - Select **This registry value is associated with a 64-bit application**
   

   Click the Compliant Rules tab

5. In the Compliant Rules tab, click the New button to create a rule.

6. In the Create Rule dialog box, specify the following information:

   - Enter a **Name** for the rule
   
   - Select a **Rule type** of **Value**
   
   - Select the **Equals** operator for the comparison
   
   - Select a value according to the PUA setting you would like to deploy:
   
     <table>
     <colgroup>
     <col style="width: 50%" />
     <col style="width: 50%" />
     </colgroup>
     <tbody>
     <tr class="odd">
     <td><p>Value</p></td>
     <td><p>Description</p></td>
     </tr>
     <tr class="even">
     <td> 
     <p>0 (default)</p></td>
     <td><p>Potentially Unwanted Application protection is disabled</p></td>
     </tr>
     <tr class="odd">
     <td><p>1</p></td>
     <td><p>Potentially Unwanted Application protection is enabled. The applications with unwanted behaviour will be blocked at download and install-time.</p></td>
     </tr>
     </tbody>
     </table>
   
   - Select **Remediate noncompliant rules when supported**
   
   - Select **Report noncompliance if this setting instance is not found**
   

   Click OK to finish creating the rule.

7. In the Create Setting dialog box, click Apply. Click Next until you reach the summary dialog box. Validate the configuration preferences before clicking Next and Close. You have now created the Configuration Item.