Microsoft Defender Application Guard for Office以前称为Office 365 高级威胁防护^{(Office 365 Advanced Threat Protection)}，可防止潜在风险文件访问受信任的系统资源。它通过硬件虚拟化在隔离环境中打开不受信任的文档。

Microsoft Defender Application Guard for Office可保护您的系统免受此隔离容器中的恶意软件的侵害，该容器采用独立和自动化模式。在自动化模式（又名企业管理模式^{(AKA Enterprise Management Mode)}）中，管理员将定义一些受信任的网站。

来自定义域的任何文档都将在您的计算机上正常打开。同时，Application Guard会在虚拟环境中启动来自这些定义的受信任站点之外的网站的文件。

Microsoft Defender Application Guard for Office (Application Guard for Office) helps prevent untrusted files from accessing trusted resources, keeping your enterprise safe from new and emerging attacks. This article walks admins through setting up devices for a preview of Application Guard for Office. It provides information about system requirements and installation steps to enable Application Guard for Office on a device, says Microsoft.

注意：^{(NOTE: )}要启用Office应用程序防护^{(Application Guard)}，您首先必须使用Windows 10累积每月安全更新KB4571756更新您的系统。

启用或禁用适用于Office的^(Office)Microsoft Defender 应用程序防护^{(Microsoft Defender Application Guard)}

现在您已经了解了Microsoft Defender Application Guard for Windows的概述，本部分将向您展示如何在您的Windows计算机上启用和禁用它。我们将探索以下内容：

1. 在Windows 功能^{(Windows Features)}中启用或禁用适用于Office的^(Office)应用程序防护^{(Application Guard)}。
2. 使用PowerShell启用或禁用适用于Office的^(Office)应用程序防护^{(Application Guard)}。
3. 在托管模式^{(Managed Mode)}组策略中打开Microsoft Defender 应用程序防护。^{(Microsoft Defender Application Guard)}
4. 仔细检查Office应用程序防护^{(Application Guard)}是否已启用并正常工作。

前两种解决方案是启用或禁用Office应用程序防护^{(Application Guard)}的替代方法。第三部分应在遵循其中一种解决方案后完成。最后，您将看到如何确认Office应用程序防护^{(Application Guard)}已启用并正常工作。

1]在Windows功能中启用^(Enable)或禁用Office的应用程序防护^{(Application Guard)}

 

右键单击^{(Right-click)}“开始^(Start)”按钮并选择“运行”^{(Run )}以打开“运行”对话框。在“运行”^(Run)对话框中 输入 appwiz.cpl ，然后单击“^(appwiz.cpl)确定^(OK)”按钮。

单击 “程序^(Programs)和功能^(Features)”窗口左侧面板中的“打开或关闭 Windows 功能”链接。^{(Turn Windows features on or off)}

从Windows 功能^{(Windows Features)}屏幕上的列表中找到 Microsoft Defender Application Guard  ，然后选中此选项旁边的复选框以启用它。点击 确定 ^(OK )按钮。

启用Microsoft Defender Application Guard后，您需要重新启动计算机。要禁用Microsoft Defender 应用程序防护^{(Microsoft Defender Application Guard)}，只需取消选中Windows 功能^{(Windows Features)}屏幕上的选项并重新启动计算机。

2]使用PowerShell启用^(Enable)或禁用Office的应用程序防护^{(Application Guard)}

您还可以使用PowerShell为Office启用^(Office)Microsoft Defender 应用程序防护^{(Microsoft Defender Application Guard)}。要以管理员身份打开PowerShell，请右键单击“开始^(Start)”按钮并选择 “ Windows PowerShell (Admin) ” 。

在PowerShell^(PowerShell)窗口中复制并粘贴以下命令以启用Windows Defender 应用程序防护^{(Windows Defender Application Guard)}并按ENTER键：

Enable-WindowsOptionalFeature -online -FeatureName Windows-Defender-ApplicationGuard

在运行上述命令时，您已经为Office启用了^(Office)Application Guard。在此之后重新启动计算机以完成该过程。

要禁用Office应用程序防护^{(Application Guard)}，请输入以下命令：

Disable-WindowsOptionalFeature -online -FeatureName Windows-Defender-ApplicationGuard

3]在托管模式^{(Managed Mode)}组策略中打开^(Turn)Microsoft Defender 应用程序防护^{(Microsoft Defender Application Guard)}

上面的两个选项是启用或禁用Office应用程序防护^{(Application Guard)}的方法。完成上述两种方法中的任何一种后，您现在必须在托管模式^{(Managed Mode)}组策略中打开该功能。

为此，请转到 Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Application Guard。

在这里，将 Options下的值更改为 2 或 3。单击“ 确定^(OK)”按钮保存设置并关闭窗口。在此之后重新启动计算机。

4]仔细检查^{(Double-check)}Office的^(Office)应用程序防护^{(Application Guard)}是否已启用并正常工作

启用Microsoft Defender Application Guard for Office后，您不会确认它正在运行。您可能需要确认您已启用它并且它工作正常。

在继续仔细检查是否已启用Office应用程序防护^{(Application Guard)}之前，请在已部署策略的计算机上打开Microsoft Office应用程序（Word、PowerPoint、Excel等），并确保您拥有Microsoft的激活副本^{(Microsoft Office)}办公室。如果未激活，则必须激活它才能使用Application Guard for Office。

要检查应用程序防护^{(Application Guard)}是否已启用并正常工作，请从 Internet 下载文档或电子邮件附件，以便将其归类为不受信任^(untrusted)的. 接下来，在相应的Office应用程序中打开它。

首次使用Office应用程序打开不受信任的文档时，您可能会注意到初始屏幕显示的时间更长。此延迟是因为它正在激活Office应用程序防护^{(Application Guard)}并打开文件。然而，这只是第一次发生。其他打开会更快。

如果启用了Microsoft Defender 应用程序防护^{(Microsoft Defender Application Guard)}，你将在初始屏幕中看到相关指示。例如，Microsoft Word会说，

To keep you safe, we’re opening this document in Application Guard…

当文件最终打开时，Office处于活动状态的^(Office)Application Guard的另一个指标是，您将在功能区中看到一个标注，上面写着：

File opened in Application Guard.

This file is from an untrusted soure. To keep you safe, we’ve opened it in a protected mode.

此外，您会注意到任务栏中的Microsoft应用程序图标上有一个黑色盾牌。这是应用程序防护^{(Application Guard)}已启用并正常工作的另一个指标。

希望这可以帮助。

Enable or Disable Microsoft Defender Application Guard for Office

Formerly knows as Office 365 Advanced Threat Protection, Microsoft Defender Application Guard for Office prevents potentially risky files from gaining access to trusted system resources. It opens untrusted documents in an isolated environment with hardware virtualization.

Microsoft Defender Application Guard for Office protects your system from malicious software in this isolated container sing standalone and automated modes. In the automated mode, AKA Enterprise Management Mode, the administrator will define some trusted websites.

Any document originating from the defined domains will open normally on your computer. Meanwhile, Application Guard launches files originating from websites outside these defined trusted sites in the virtual environment.

Microsoft Defender Application Guard for Office (Application Guard for Office) helps prevent untrusted files from accessing trusted resources, keeping your enterprise safe from new and emerging attacks. This article walks admins through setting up devices for a preview of Application Guard for Office. It provides information about system requirements and installation steps to enable Application Guard for Office on a device, says Microsoft.

NOTE: To enable Application Guard for Office, you first have to update your system with the Windows 10 cumulative monthly security update KB4571756.

Enable or disable Microsoft Defender Application Guard for Office

Now that you have an overview of Microsoft Defender Application Guard for Windows, this section shows you how to enable and disable it on your Windows computer. We’ll explore the following:

1. Enable or disable Application Guard for Office in Windows Features.
2. Enable or disable Application Guard for Office using PowerShell.
3. Turn on Microsoft Defender Application Guard in Managed Mode group policy.
4. Double-check if Application Guard for Office is enabled and working.

The first two solutions are alternative ways to enable or disable the Application Guard for Office. The third part should be done after following one of the solutions. And finally, you’ll see how to confirm that the Application Guard for Office is enabled and working.

1] Enable or disable Application Guard for Office in Windows Features

 

Right-click on the Start button and select Run to open the Run dialog box. Enter appwiz.cpl in the Run dialog box and click on the OK button.

Click on the Turn Windows features on or off link at the left-hand panel of the Programs and Features window.

Find Microsoft Defender Application Guard from the list on the Windows Features screen and mark the checkbox next to this option to enable it. Hit the OK button.

After enabling Microsoft Defender Application Guard, you’ll need to restart your machine. To disable Microsoft Defender Application Guard, simply uncheck the option on the Windows Features screen and restart your computer.

2] Enable or disable Application Guard for Office using PowerShell

You can also enable Microsoft Defender Application Guard for Office using PowerShell. To open PowerShell as an administrator, right-click on the Start button and select Windows PowerShell (Admin).

Copy and paste the following command in the PowerShell window to enable Windows Defender Application Guard and hit the ENTER key:

Enable-WindowsOptionalFeature -online -FeatureName Windows-Defender-ApplicationGuard

On running the above command, you’d have enabled Application Guard for Office. Restart your computer following this to finish the process.

To disable Application Guard for Office, enter the following command:

Disable-WindowsOptionalFeature -online -FeatureName Windows-Defender-ApplicationGuard

3] Turn on Microsoft Defender Application Guard in Managed Mode group policy

The two options above are ways to enable or disable the Application Guard for Office. After completing any of the two above methods, you now have to turn on the feature in the Managed Mode group policy.

To do this, go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Application Guard.

Here, change the value under Options to 2 or 3. Click on the OK button to save your settings and close the window. Restart your computer after this.

4] Double-check if Application Guard for Office is enabled and working

After enabling Microsoft Defender Application Guard for Office, you get no confirmation that it’s working. You may want to confirm that you’ve enabled it and it’s working correctly.

Before you go ahead to double-check that you’ve enabled Application Guard for Office, open a Microsoft Office app (Word, PowerPoint, Excel, etc.) on a computer that has policies deployed and ensure that you have an activated copy of Microsoft Office. If it’s not activated, you must activate it to use Application Guard for Office.

To check that Application Guard is enabled and working, download a document or email attachment off the internet so that it’s classed an untrusted. Next, open it in the corresponding Office application.

The first time you use the Office application to open an untrusted document, you might notice that the splash screen shows for a longer time. This delay is because it’s activating Application Guard for Office and opening the file. However, it happens only the first time. Other opens will be quicker.

If Microsoft Defender Application Guard is enabled, you’ll see an indication of that in the splash screen. For example, Microsoft Word will say,

To keep you safe, we’re opening this document in Application Guard…

When the file finally opens, another indicator of an active Application Guard for Office is that you’ll see a callout in the ribbon that says,

File opened in Application Guard.

This file is from an untrusted soure. To keep you safe, we’ve opened it in a protected mode.

Also, you’ll notice a black shield on the Microsoft application’s icon in the taskbar. This is another indicator that Application Guard is enabled and working.

Hope this helps.

Related posts

• Office Microsoft Defender Application Guard - 要求，FAQ等

• 视窗Defender Application Guard Extension为Chrome & Firefox

• 什么是Windows 10中的Control Flow Guard - 如何打开或关闭它

• Error 0x800106ba，Windows Defender Application未能初始化

• 如何手动扫描单独的文件和使用Microsoft Defender

• Sorry，我们无法到达您的帐户现在在Office 365应用程序中出现错误

• 如何下载早期版本的Microsoft Office

• 如何从Office 365 Title Bar删除User Name

• 如何在Microsoft Defender中更改默认计划Scan Type

• Mac的Microsoft Defender ATP现在可用于企业

• 的Microsoft Defender error代码和解决方案列表

• 如何在Microsoft Office程序中更改File Block设置

• 如何在Microsoft Office程序中更改文档主题颜色

• 如何在Office 365应用中关闭Picture Compression

• 如何在Microsoft Office中恢复已删除的字体

• Windows 11/10中的Microsoft Office Click-To-Run High CPU usage

• 如何将Microsoft Office Ribbon Customizations重置为默认值？

• 在Windows 10启用或打开Microsoft Defender的通知

• 如何改变Office 365 Subscription Plan

• 如何在Microsoft Office中使用Accessibility Checker