---
title: Configure attack surface reduction
description: Configure attack surface reduction
keywords: asr, attack surface reduction, windows defender, microsoft defender, antivirus, av
search.product: eADQiWindows 10XVcnh
search.appverid: met150
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance 
ms.topic: conceptual
ms.date: 07/01/2018
---

# Configure attack surface reduction

You can configure attack surface reduction with a number of tools, including:

* Microsoft Intune
* Microsoft Endpoint Configuration Manager
* Group Policy
* PowerShell cmdlets

The topics in this section describe how to configure attack surface reduction. Each topic includes instructions for the applicable configuration tool (or tools).

## In this section

Topic | Description
-|-
[Enable hardware-based isolation for Microsoft Edge](../windows-defender-application-guard/install-wd-app-guard.md) | How to prepare for and install Application Guard, including hardware and software requirements
[Enable application control](../windows-defender-application-control/windows-defender-application-control.md)|How to control applications run by users and protect kernel mode processes
[Exploit protection](./enable-exploit-protection.md)|How to automatically apply exploit mitigation techniques on both operating system processes and on individual apps
[Network protection](./enable-network-protection.md)|How to prevent users from using any apps to access dangerous domains
[Controlled folder access](./enable-controlled-folders.md)|How to protect valuable data from malicious apps
[Attack surface reduction](./enable-attack-surface-reduction.md)|How to prevent actions and apps that are typically used by exploit-seeking malware
[Network firewall](../windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md)|How to protect devices and data across a network