# Ensure 'Allow files to download and save to the host operating system from Microsoft Defender Application Guard' is set to 'Disabled'

Necessity: Microsoft Defender Application Guard provides a hardware-isolated browsing environment to protect the host operating system from malware and zero-day attacks from untrusted websites. Allowing files to be downloaded from this isolated container directly to the host OS creates a potential vector for malicious content to escape the sandbox and compromise the system. Disabling this feature enforces the security boundary and ensures that any content from an Application Guard session remains isolated, mitigating the risk of malware persistence and execution on the host machine. Auditing and Remediation: The audit script checks the configuration by reading the registry value 'AppHVSI_SaveFilesToHost' under 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. The remediation script modifies this same registry value to enable or disable the setting according to the provided argument, thereby controlling whether file downloads from Application Guard to the host are permitted. Recommended State Rationale: The recommendation is consistently 'Disabled' across all security levels because the nature of this setting is binary from a security perspective. Basic: At a basic level of hardening, it is essential to close this potential attack vector to maintain the integrity of the Application Guard sandbox. Moderate: For a moderate security posture, there is no justification for weakening this boundary. The risk of malware escaping the sandbox is significant, so the setting must remain disabled. Strict: In a strict security environment, maintaining the strongest possible isolation is paramount. Any feature that allows data to cross from an untrusted, isolated environment to the trusted host presents an unacceptable risk. Therefore, this setting must be disabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'AppHVSI_SaveFilesToHost' at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI'. The script must return 'Enabled' if the value data is 1, and 'Disabled' if the value data is 0 or if the value/key does not exist. The output should only be the current state string, with no additional text.

## Remediation Script Working

PowerShell script that accepts a single positional string argument ('Enabled' or 'Disabled'). The script must configure the 'AppHVSI_SaveFilesToHost' REG_DWORD value at 'HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI', setting its data to 1 for 'Enabled' and 0 for 'Disabled'. If the path does not exist, it must be created. The script must return the boolean value $true on success and $false on failure.

