# Ensure 'Allow files to download and save to the host operating system from Microsoft Defender Application Guard' is set to 'Disabled'

Necessity: Microsoft Defender Application Guard (MDAG) provides security by isolating potentially malicious websites in a virtualized container. Allowing files to be downloaded from this isolated environment to the host operating system creates a direct vector for malware to bypass this protection and compromise the host. Disabling this feature is critical to maintaining the integrity of the security boundary MDAG establishes, preventing container-to-host attacks.

Auditing and Remediation: The audit script checks the configuration by reading the 'AllowFileDrop' registry value. A return value of '0' confirms the setting is secure ('Disabled'), while '1' indicates it is insecure ('Enabled' or 'Not Configured'). The remediation script directly modifies this registry value, enabling an administrator to enforce the 'Disabled' state and close this potential security gap.

Recommended State Rationale: 
- Basic: ['0'] (Disabled). This is the fundamental recommendation. Allowing any file transfer from an untrusted, isolated environment to the trusted host OS violates the principle of least privilege and negates the primary benefit of Application Guard. 
- Moderate: ['0'] (Disabled). For a moderate security posture, maintaining the disabled state is non-negotiable as the risk of compromise is significant. 
- Strict: ['0'] (Disabled). In a strict security environment, there is no acceptable reason to enable this feature. This is a binary security control; the only secure state is 'Disabled'. Therefore, all hardening levels recommend the same state.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value 'AllowFileDrop' at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. The script should return '0' if the value data is 0 (Disabled). If the value data is not 0, or if the key or value does not exist, the script should return '1' (Enabled/Not Configured). The output must be only the numerical value.

## Remediation Script Working

PowerShell script that accepts a single positional argument ('0' for Disabled or '1' for Enabled). The script must set the REG_DWORD value 'AllowFileDrop' at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI' to the provided argument. It must create the registry key path if it does not exist. The script must return '$true' on success and '$false' on failure.

