How to Enable Enhanced Phishing Protection in Windows 11

In today’s digital landscape, phishing attacks are a persistent threat, constantly evolving to trick users into revealing sensitive information. Protecting your credentials is paramount, and Windows 11 offers a powerful built-in defense: Enhanced Phishing Protection. This guide provides a comprehensive overview of how to activate and configure this vital security feature, ensuring your passwords and accounts remain safe from cyber threats.

Understanding the Threat: Why Phishing Protection Matters

Phishing attacks exploit human vulnerabilities, using deceptive tactics to steal your passwords, financial data, and other personal information. This can lead to identity theft, financial loss, and severe damage to your reputation. Windows 11’s Enhanced Phishing Protection is designed to combat these threats by identifying and alerting you to potentially risky password behavior. This feature, integrated with Microsoft Defender SmartScreen, acts as an early warning system, helping you avoid falling victim to phishing scams. It protects against:

• Entering Passwords on Malicious Websites: Detects when you enter your Windows password on known phishing sites or suspicious applications.
• Password Reuse: Alerts you if you’re reusing your Windows password on multiple websites or applications.
• Unsafe Password Storage: Warns you if you’re storing your Windows password in plain text, such as in a Notepad file.

Configuring Enhanced Phishing Protection: Step-by-Step Guides

Whether you’re an individual user or an IT professional managing a network, Windows 11 provides flexible options for enabling and customizing phishing protection.

1. Deploying Protection via Microsoft Intune (For Organizations)

For organizations using Microsoft Intune, this method offers centralized control and policy management across all managed devices.

Steps:

1- Access Intune: Log in to the Microsoft Intune admin center and navigate to “Devices.”

2- Create a Configuration Profile: Select “Configuration profiles” under “Manage” and click “Create profile.” Choose “Windows 10 and later” as the platform and “Settings catalog” as the profile type.

3- Basic Settings: Provide a descriptive name and optional description for your policy.

4- Configure Enhanced Phishing Protection: In “Configuration settings,” click “+ Add settings.” Search for “SmartScreen” and select “Enhanced Phishing Protection.” Enable the following settings:

• Service Enabled: Enables the phishing protection service.
• Notify Malicious: Warns users when entering their password on malicious sites.
• Notify Password Reuse: Alerts users about password reuse.
• Notify Unsafe App: Warns users about insecure password storage.
• Automatic Data Collection (Optional): Allows data collection for improved security analysis (consider privacy implications).

5- Assign and Deploy: Assign the policy to the appropriate user or device groups. Review and create the policy. Users will receive notifications after their next password sign-in.

2. Configuring Phishing Protection Using Local Group Policy Editor (For Pro, Enterprise, and Education Editions)

This method is suitable for individual devices or small groups not managed by Intune.

Steps:

1- Open Group Policy Editor: Search for gpedit.msc in the Start menu or Run console.

Navigate to Settings: Go to Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Enhanced Phishing Protection.

2- Enable Policies: Double-click each of the following policies and set them to “Enabled”:

• Service Enabled
• Notify Malicious
• Notify Password Reuse
• Notify Unsafe App
• Automatic Data Collection (Optional)

3- Apply Changes: Close the Group Policy Editor and restart your computer or sign out and back in to apply the changes.

3. Enabling Phishing Protection via Registry Editor (For All Windows 11 Editions)

This method allows advanced users to customize settings, but it’s crucial to proceed with caution.

Steps:

1- Open Registry Editor: Search for regedit.exe in the Start menu or Run console.

2- Navigate to the Key: Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components. If the WTDS\Components keys do not exist, create them.

3- Create or Modify DWORD Values: Right-click in the right-hand pane and create or modify the following DWORD (32-bit) values, setting each to 1 to enable or 0 to disable:

• ServiceEnabled
• NotifyMalicious
• NotifyPasswordReuse
• NotifyUnsafeApp
• CaptureThreatWindow (for data collection)

Example: To enable all features, the following registry entries would be configured: 1Windows Registry Editor Version 5.00 2 3[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components] 4"ServiceEnabled"=dword:00000001 5"NotifyMalicious"=dword:00000001 6"NotifyPasswordReuse"=dword:00000001 7"NotifyUnsafeApp"=dword:00000001 8"CaptureThreatWindow"=dword:00000001

4- Restart Your PC: Restart your computer for the changes to take effect.

4. Manual Configuration via Windows Security App (For Individual Users)

This method is simple for individual users on unmanaged devices.

Steps:

1- Open Windows Security: Open the Windows Security app from the Start menu.

2- Navigate to App & Browser Control: Click on “App & browser control.”

3- Access Reputation-based protection: Select “Reputation-based protection settings.”

4- Enable Phishing Protection: Under “Phishing protection,” toggle the switch to “On.” Check all available boxes:

• Warn about malicious apps and websites.
• Warn about password reuse.
• Warn about insecure password storage.

5- Confirm Changes: Approve any User Account Control prompts and restart your device.

Understanding How Phishing Protection Works

When phishing protection is active, Windows Security actively monitors your actions to detect potential security risks:

• Password Entry Monitoring: Tracks where you enter your Windows password, including websites and applications.
• Password Reuse Detection: Identifies if you are reusing your Windows password across multiple sites.
• Unsafe Storage Alerts: Alerts you to the presence of stored passwords in vulnerable formats such as plain text.

When a risk is detected, you’ll receive a pop-up notification, often with a direct link to reset or change your password.

Important Note: Phishing protection is active only when you sign in to Windows with a password. If you use Windows Hello (PIN or biometrics), the feature remains inactive because the password is not cached.

Conclusion:

Enhanced Phishing Protection in Windows 11 is a powerful tool for safeguarding your digital identity. By understanding how this feature works and implementing the configuration steps outlined above, you can significantly reduce your risk of falling victim to phishing attacks. Remember, staying vigilant and proactive in your security practices is crucial in today’s complex threat landscape. Enable Enhanced Phishing Protection today and take the first step towards a more secure online experience.