PUAs don’t fall under the definition of “malware” as they’re not malicious, but still, some PUAs are classified as “risky.”<\/p>\n
Bottom line:<\/strong> You don’t need “Potentially Unwanted” stuff in your system regardless of the risk level unless you seriously believe that the benefits offered by a particular program outweigh the risks or inconvenience created by the PUP which accompanied the main program.<\/p>\n On Windows 10 2004 (and higher) and Windows 11, Windows Defender scans for PUAs by default. Also, you have the option Potentially unwanted app blocking<\/strong> on the Windows Defender Security settings page. You can enable\/disable the option using GUI.<\/p>\n For earlier versions of Windows, follow the procedure below to enable the scanning of PUAs.<\/p>\n<\/div>\n Here is how to enable scanning and removal of adware, PUP\/PUA using Windows Defender (in Windows 8 and higher).<\/p>\n There are three different ways to enable PUA protection in Windows Defender, but I’m unsure which setting takes precedence in the event of a conflict. The registry location is different in each method described. It’s advisable to use only one<\/strong> of the following methods to avoid confusion.<\/em><\/p>\n Start PowerShell ( Run the following command and press ENTER:<\/p>\n This PowerShell command adds a registry value to the following key:<\/p>\n Note that manually setting the registry value would still work. But the above registry path is protected and can’t be edited using the Registry Editor unless you’re editing it as SYSTEM.<\/p>\n This method uses the same registry value but implements it under the Policies registry key.<\/p>\n Start Regedit.exe and go to the following key:<\/p>\n Create a DWORD value named PUAProtection<\/strong><\/p>\n Double-click Start the Registry Editor (regedit.exe) and go to the following key:<\/p>\n Create a subkey named “ Under Double-click This configures Windows Defender to enable real-time scanning and removal of “Potentially Unwanted” stuff.<\/p>\n Exit the Registry Editor.<\/p>\n Of those three methods, 1 & 2 are not yet documented by Microsoft — but I managed to find them out when playing with PowerShell. Methods 1 & 2 were tested in a system running Windows 10. Method 3 was initially published by the MMPC blog.<\/em><\/p>\n Do one of these things to apply the changes:<\/p>\n PUA will be blocked only at download or install time. A file will be included for blocking if it meets one of the following conditions:<\/p>\n The Microsoft Malware Protection Center (MMPC) blog<\/a> announced this opt-in Windows Defender feature last year. But, as the MMPC blog post references only “enterprise” systems, some home users may be wondering whether or not the PUA detection feature works on standalone computers.<\/p>\n Yes. Windows Defender PUA scanning works in standalone systems, as well.<\/b><\/p>\n The following test shows that Windows Defender PUA detection certainly works in systems not part of a domain network.<\/p>\n MMPC Security Portal<\/a> has the complete list of “Potentially Unwanted Programs” or “Potentially Unwanted Applications,” each threat name is prefixed with “PUA:”.<\/p>\n For example, PUA: Win32\/CandyOpen<\/a> is a PUP\/PUA bundled with Magical jelly bean Keyfinder and other programs.<\/p>\n (Magical Jelly Bean Keyfinder, otherwise, is a useful piece of software.)<\/p>\n Before activating Windows Defender PUA protection, I downloaded Magicaljellybean’s Keyfinder and tried to run it on a Windows 10 v1607 standalone computer. Windows Defender allowed me to download the installer and run it.<\/p>\n After setting the “MpEnablePus” value data to 1 using the Registry Editor and updating the definitions, Windows Defender blocked the setup program from running.<\/p>\n Also, when I tried to download a new copy of the Keyfinder installer, the file was blocked as it landed up in the Downloads or %temp% folder. The result was the same when I chose a folder other than “Downloads”.<\/p>\n And the Windows Defender notification message was shown.<\/p>\n Windows Defender has found an untrusted app<\/p>\n Your IT settings cause the blocking of any app that might perform unwanted actions on your computer<\/p>\n<\/div>\n Whereas, the notification message verbatim is different for “malware” detections, in which case it would say “Found some malware.”<\/p>\n And the PUA was quarantined, as shown in the Windows Defender scan history.<\/p>\n Magical Jelly Bean Keyfinder seems to bundle different PUAs in its installer from time to time. For example, when tested in May 2019, the installer contained another\u00a0PUA<\/a> (named GUI option<\/h4>\n
![\"defender](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-pua-option-gui.png\")
<\/p>\n\n
\n
\n
\n
<\/a>Enable Windows Defender real-time scanning for PUA\/PUP<\/h2>\n
<\/a>Method 1: Enable PUA Protection Using PowerShell<\/h3>\n
powershell.exe<\/code>) as administrator.<\/p>\nSet-MpPreference -PUAProtection 1<\/strong><\/pre>\n
![\"enable](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-pua-7.png\")
<\/p>\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender<\/pre>\n
\n
<\/a>Method 2: Enable PUA Protection Manually [Registry Location 2]<\/h3>\n
HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender<\/pre>\n
PUAProtection<\/code> and set its data to 1<\/code>.<\/p>\n<\/a>Method 3: Enable PUA Protection Manually [Registry Location 3]<\/h3>\n
HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender<\/pre>\n
MpEngine<\/code>”<\/p>\nMpEngine<\/code>, create a DWORD value named MpEnablePus<\/strong><\/p>\nMpEnablePus<\/code> and set its value data to 1<\/p>\n![\"configure](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-pua-protection-2.png\")
<\/p>\nApply the changes<\/h4>\n
\n
\n
<\/a>Does Windows Defender PUA Protection work on systems not part of an enterprise network?<\/h3>\n
![\"configure](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-pua-protection-3.png\")
<\/p>\n![\"configure](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-pua-protection-1.png\")
<\/p>\n![\"configure](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-pua-protection-5.png\")
<\/p>\n![\"set](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-pua-6.png\")
<\/p>\n![\"configure](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-pua-protection-4.png\")
<\/p>\nPUA:Win32\/Vigua.A<\/code>) with threat level “Severe.”<\/p>\n![\"block](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/keyfinder-blocked-pua-info.png\")
<\/p>\n![\"block](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/keyfinder-blocked-pua.png\")
<\/p>\n
![\"block](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/keyfinder-blocked-pua-message.png\")
<\/p>\n