# Ensure 'Configure Microsoft Defender Application Guard clipboard settings: Clipboard behaviour setting' is set to 'Enabled: Enable clipboard operation from an isolated session to the host'

Necessity: Microsoft Defender Application Guard (MDAG) provides a hardware-isolated browsing environment to protect the host system from malicious web content. Controlling clipboard access between this isolated session and the host OS is critical to prevent data exfiltration and infiltration. A misconfiguration could allow malicious code or data from an untrusted website to be copied to the host, or allow sensitive data from the host to be pasted into a compromised isolated session. This setting directly manages that data flow risk.\n\nAuditing and Remediation: The audit script checks the current policy by reading the 'ClipboardRedirection' DWORD value in the registry under 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. The remediation script modifies this same registry value to enforce the desired clipboard behavior, effectively enabling, disabling, or restricting the direction of clipboard operations.\n\nRecommended State Rationale:\n- Basic (['2']): 'Enable clipboard operation from an isolated session to the host.' This state provides user convenience, allowing content discovered in the safe environment to be brought back to the host. It's considered basic because it allows a data path from the untrusted environment to the trusted one.\n- Moderate (['1']): 'Enable clipboard operation from the host to an isolated session.' This is more secure as it prevents data exfiltration from the isolated session. Users can copy trusted data (like URLs) into the safe environment, but nothing can be copied out, reducing the risk of malicious content reaching the host.\n- Strict (['0']): 'Disable clipboard operations entirely.' This is the most secure state, enforcing maximum isolation. It completely severs the clipboard connection between the host and the MDAG container, eliminating this vector for data leakage in either direction. This is recommended for high-security environments where data containment is paramount.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['2']` |
| **Moderate** | `['1']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'ClipboardRedirection' at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. The script must return only the numerical data of this DWORD value. If the value or key does not exist, the script should return 'Not Configured'.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument (the desired numerical value). The script must set the DWORD registry value 'ClipboardRedirection' at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI' to the provided argument, creating the path if it does not exist. The script must return '$true' on success and '$false' on failure.

