# Ensure 'Allow files to download and save to the host operating system from Microsoft Defender Application Guard' is set to 'Disabled'

Necessity: Microsoft Defender Application Guard (MDAG) provides a hardware-isolated browsing environment to protect the host OS from malware and zero-day attacks originating from untrusted websites. Allowing files to be downloaded from this isolated container directly to the host system creates a potential vector for malicious content to breach the isolation boundary. Disabling this feature ensures that any file downloaded within the MDAG session remains sandboxed, significantly reducing the risk of malware infecting the host operating system.

Auditing and Remediation: The audit script checks the configuration by reading the specific registry key that controls file downloads from MDAG. A value of '0' or the absence of the key corresponds to the 'Disabled' state. The remediation script directly modifies this registry value, setting it to '0' to enforce the 'Disabled' state, thereby closing the potential data channel from the isolated environment to the host.

Recommended State Rationale: 
Basic: ['Disabled'] - This is the fundamental security recommendation. The core purpose of Application Guard is isolation, and allowing file downloads from the isolated session to the host fundamentally undermines this principle. It is the baseline for secure configuration.
Moderate: ['Disabled'] - For a setting with such a clear security implication, there is no effective 'moderate' state. The risk associated with enabling file downloads is significant, making 'Disabled' the only prudent choice for any security-conscious environment.
Strict: ['Disabled'] - The strictest security posture mandates complete isolation. Disabling file downloads is a critical component of this posture, ensuring the integrity of the host OS by preventing any user-initiated or malware-driven attempt to move potentially compromised files out of the secure container.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'AllowFileDownload' at 'HKLM:\Software\Policies\Microsoft\AppHVSI'. If the value data is '1', the script must return the string 'Enabled'. If the value data is '0' or if the value/key does not exist, it must return 'Disabled'. The script must not output any other text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which must be either 'Enabled' or 'Disabled'. The script must create or set the DWORD registry value 'AllowFileDownload' at 'HKLM:\Software\Policies\Microsoft\AppHVSI'. If the argument is 'Enabled', set the value to '1'. If the argument is 'Disabled', set the value to '0'. The script must create the registry key path if it does not exist. It must return $true on successful configuration and $false on failure.

