How to prevent suspicious behaviors from infecting your PC on Windows 10

You can now stop apps and files suspicious behaviors from taking over your device and data — Here's how to enable the feature on Windows 10.

Windows Defender Antivirus is a pretty robust security solution capable of protecting your device and data against viruses, spyware, rootkits, and other types of malware, and with Windows 10 version 1809 (Redstone 5), the default antivirus is getting even more powerful.

Starting with the Redstone 5 update, Windows Defender Antivirus is adding “Block suspicious behaviors,” which is a new feature (part of the Windows Defender Exploit Guard attack surface reduction technology) designed to detect and stop apps and files behaviors that might infect your device and data.

In this guide, you’ll learn the steps to enable Windows Defender Antivirus “Block suspicious behaviors” feature to prevent certain apps and files from infecting your device running Windows 10.

How to enable ‘Block suspicious behaviors’ on Windows 10

You can add another security layer to prevent suspicious behaviors from infecting your device using these steps:

  1. Open Windows Security.

  2. Click on Virus & threat protection.

  3. Under “Virus & threat protection settings,” click the Manage settings link.

    Windows Security Virus & threat protection settings
    Windows Security Virus & threat protection settings
  4. Turn on the Block suspicious behavior toggle switch.

    Block suspicious behavior feature on Windows 10 version 1809
    Block suspicious behavior feature on Windows 10 version 1809

Once you’ve completed the steps, the Windows Defender Antivirus will prevent certain behaviors by an app or file that might end up infecting your device and personal files.

If you don’t see this option, it’s because you’re not running a supported version of Windows 10. Block suspicious behaviors option appears in the Windows Security settings starting with Windows 10 version 1809 and later.

Update August 15, 2018: This feature has been removed from Windows 10, but it may return in the feature.

About the author

Mauro Huculak is a Windows How-To Expert who started Pureinfotech in 2010 as an independent online publication. He has also been a Windows Central contributor for nearly a decade. Mauro has over 14 years of experience writing comprehensive guides and creating professional videos about Windows and software, including Android and Linux. Before becoming a technology writer, he was an IT administrator for seven years. In total, Mauro has over 20 years of combined experience in technology. Throughout his career, he achieved different professional certifications from Microsoft (MSCA), Cisco (CCNP), VMware (VCP), and CompTIA (A+ and Network+), and he has been recognized as a Microsoft MVP for many years. You can follow him on X (Twitter), YouTube, LinkedIn and About.me.