Microsoft announced a new feature for Microsoft Defender for Endpoint (MDE) to help organizations prevent attackers and malware from using compromised unmanaged devices to move laterally across the network.
This new feature allows administrators to “contain” unmanaged Windows devices on their network if they have been compromised or are suspected of being compromised.
Once tagged as contained, the Enterprise Endpoint Security Platform will instruct Windows systems on the network to block all communication to and from the device.
This can help prevent malicious actors from moving laterally within the organization using unmanaged devices and prevent the spread of an infection that would otherwise cause further damage.
“This action can help prevent neighboring devices from being compromised while the security operations analyst locates, identifies, and remediates the threat on the compromised device,” Microsoft explains.
However, there is a catch: the new MDE feature only works with built-in devices running Windows 10 and later or Windows Server 2019 and later.
“Only devices running Windows 10 and later will perform the Contain action, which means only devices running Windows 10 and later enrolled in Microsoft Defender for Endpoint will block ‘Contained’ devices at this time,” Microsoft added. .
This means that while contained from all managed Windows devices on the network, the contained system will still be able to access other devices that have not been onboarded.
How to Contain Compromised Windows Devices
To contain a potentially compromised device, administrators should follow these steps:
- Go to the “Device inventory” page in the Microsoft 365 Defender portal and select the device to contain.
- Select “Contain device” from the device flyout actions menu.
- In the pop-up containing the device, enter a comment and select “Confirm”.
After you contain an unmanaged device, it can take up to 5 minutes for devices integrated with Microsoft Defender for Endpoint to begin blocking communications.
If any of the devices on the network changes its IP address, all registered devices will recognize this and begin blocking communications with the new IP address.
To stop containing a specific device, select it in “Device Inventory” or open the device page. Next, you need to select “Release from containment” from the action menu to restore the device’s connection to the network.