SOLVED: The Complete Guide to Installing & Using Defender Application Guard with Chromium Edge, Google Chrome or Firefox Browsers

WHAT IS DEFENDER APPLICATION GUARD:

Application Guard is a fantastic option to run programs in a very secure space that is separated from the host operating system, thereby eliminating many potential hacks.  For instance if you ran the WannaCry cryptolocker program from a website running with Application Guard, it would fail to encrypt your hard drive.

HISTORY:

Microsoft introduced Windows Defender Application Guard (WDAG) in September 2016 and renamed it Microsoft Defender Application Guard (MDAG) in 2019.  We refer to it as Application Guard for simplicity.  As of summer 2020, only the Microsoft Edge Brower (both old and new CrEdge) make use of Application Guard although the Windows Sandbox uses the same technology but it is packaged differently.

REQUIREMENTS:

Put simply, Application Guard requires a PC manufactured after 2015 with Windows 10 Pro, Enterprise, or Education v1803 or newer.  It does not function on Windows 10 Home Editions.  Here are the actual minimum specs:

• At least a 4 core 64Bit CPU from Intel or AMD capable of virtualization
• 8GB RAM
• 5GB Disk space

DOES APPLICATION GUARD FUNCTION DIFFERENTLY ON WINDOWS 10 PRO vs ENTERPRISE:

In a word, yes.  In eight words, it is nearly useless on Windows 10 Pro.  This is because Defender Application Guard can only be started manually in Windows 10 Pro.  Windows 10 Enterprise, on the other hand allows admins to use SCCM or InTune or Group Policy to define can kick off Application Guard automatically for sites you have not pre-approved via GPO, SCCM or InTune/EndPoint Manager.

HOW TO INSTALL DEFENDER APPLICATION GUARD:

Installing Application Guard is simple:

1. Right click on the START button and select APPS AND FEATURES
2. Click the PROGRAMS AND FEATURES link (link in top right corner OR at the bottom of the page)
3. Click on WINDOWS DEFENDER APPLICATION GUARD or MICROSOFT DEFENDER APPLICATION GUARD
4. Click OK
5. Wait a minute for it to install and then reboot

Alternately, you can install Application Guard using a PowerShell command:

Enable-WindowsOptionalFeature -online -FeatureName Windows-Defender-ApplicationGuard

Defender Application Guard can even be installed using what used to be called InTune and is now Microsoft Endpoint Manager:

1. Surf to endpoint.microsoft.com and sign in
2. Expand Devices > Configuration profiles > + Create profile
3. In Platform list, select Windows 10 and later
4. In Profile list, select Endpoint protection and click Create
5. Complete the profile:
   1. Name and Description
   2. In Select a category to configure settings section, choose Microsoft Defender Application Guard.
   3. In Application Guard list, choose Enabled for Edge
   4. Set your preferences for Clipboard behavior, External content, and the remaining settings
6. Click OK, and then OK again
7. Review your settings and then click Create
8. Click Assignments:
   1. On the Include tab (in the Assign to list) click an option
   2. If you have any devices or users you want to exclude from this endpoint protection profile, specify those on the Exclude tab
   3. Click Save

WHAT ARE THE GPO SETTINGS FOR APPLICATION GUARD:

As mentioned above, these only apply to Window 10 Enterprise and will have no effect on Pro machines.  The GPO’s are found at:

Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Application Guard

For more details on these settings see THIS Microsoft article.

HOW DOES APPLICATION GUARD WORK:

We have a separate article explaining the details of Application Guard including many images which you can read HERE, but put simply it uses Microsoft’s most secure “container” level.  The container is just like a virtual machine but instead of sharing the hardware, it is sharing the operating system.

App Guard starts as an 18MB container then copies files FROM the base operating system when it needs them.  It never copies things back to the base operating system and that keeps you safe.

Once the container is called, it is displayed on the desktop using a very thin custom built RDP client that is very restricted to keep you safe.

Don’t worry about your default settings from the original software you launched Application Guard from (i.e. Edge Browser), because when the container is built it copies your source settings into itself.

HOW TO USE APPLICATION GUARD WITH GOOGLE CHROME OR FIREFOX:

If you want to use Defender Application Guard with Firefox or Chrome, you just need to download the extension

HOW TO USE APPLICATION GUARD WITH INTERNET EXPLORER:

That is a good question we are still trying to figure out.