# Ensure 'Allow files to download and save to the host operating system from Microsoft Defender Application Guard' is set to 'Disabled'

Necessity: Microsoft Defender Application Guard (MDAG) provides a hardware-isolated environment to protect the host system from malicious web content. Allowing files to be downloaded from this isolated container directly to the host OS creates a potential pathway for malware to breach the isolation. Disabling this feature is a critical security measure that prevents users from inadvertently transferring malicious files from an untrusted session to the corporate environment, thereby mitigating the risk of malware infection and data compromise.

Auditing and Remediation: The audit script verifies the current configuration by checking the specific registry key that controls file downloads from MDAG. The remediation script directly modifies this registry key to align the system with the desired security policy, either enabling or disabling the download capability as specified.

Recommended State Rationale:
- Basic: ['Disabled']. This is the fundamental security recommendation aligned with benchmarks like CIS. It enforces the principle of isolation by default, closing a direct vector for malware to reach the host system.
- Moderate: ['Disabled']. For this setting, there is no meaningful intermediate configuration. The security benefit is binary; downloads are either allowed or they are not. Maintaining the disabled state is essential for a robust security posture.
- Strict: ['Disabled']. This is the most secure configuration, enforcing a zero-trust approach to content originating from untrusted sources within MDAG. In high-security environments, preventing any data transfer from the isolated container to the host is paramount to ensure the integrity of the host operating system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the state of the 'Allow files to download and save to the host operating system from Microsoft Defender Application Guard' policy. The script should read the DWORD value of 'AllowFileDownloads' at 'HKLM:\Software\Policies\Microsoft\AppHVSI'. If the value is 0, it must return 'Disabled'. If the value is 1 or does not exist, it must return 'Enabled'. The script's output must only be the current state string.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('Enabled' or 'Disabled') to configure the 'Allow files to download and save to the host operating system from Microsoft Defender Application Guard' setting. If the argument is 'Disabled', the script must set the registry value 'AllowFileDownloads' at 'HKLM:\Software\Policies\Microsoft\AppHVSI' to 0 (REG_DWORD). If 'Enabled', it must set it to 1. The script must create the registry path if it does not exist and return $true on success or $false on failure.

