The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →To enable Block at First Sight, Microsoft Defender Antivirus needs cloud-delivered protection turned on, automatic sample submission configured, and up-to-date antivirus protection. The setup route depends on whether Windows is unmanaged or controlled by an organization’s policy system; there is not one universal switch.
What Block at First Sight does
When Defender encounters a suspicious file it has not seen before, it can query Microsoft’s cloud protection service. The service uses heuristics, machine learning, and automated analysis to assess whether the file is malicious or safe. If it cannot decide immediately, Defender can stop the file from running and send a copy for further analysis. A later verdict can inform how Defender handles subsequent encounters. Microsoft says the process can reduce response time for new malware from hours to seconds in many cases; that is a qualified description, not a guarantee for every file. Microsoft’s Block at First Sight configuration guide describes the feature and its requirements.
As an Amazon Associate I earn from qualifying purchases.
The cloud check is limited to certain executable and nonportable executable files, including examples such as JavaScript, VBScript, and macros, downloaded from the internet or identified as originating from the Internet zone. Defender checks an executable’s hash to determine whether it is previously undetected. This is not a promise to analyze or block every file type or every threat.
Recommended Free Tools
Before you enable it
Microsoft says the feature is enabled when all three conditions are met:
#1 Best Overall
- Cloud-delivered protection is on. This is also called cloud protection in policy settings.
- Automatic sample submission is configured, either to send safe samples or to send all samples automatically.
- Microsoft Defender Antivirus is up to date.
Sample submission is a functional prerequisite, not an optional companion setting: Microsoft says Never Send prevents Block at First Sight from working, while Always Prompt lowers the protection state. Choose a submission option that fits your privacy and organizational requirements; sending all samples is not required if the safe-samples option is appropriate.
Enable it on an unmanaged Windows device
- Open Windows Security.
- Go to Virus & threat protection > Manage settings.
- Turn on Cloud-delivered protection.
- Turn on Automatic sample submission.
Keep Microsoft Defender Antivirus up to date as well. Microsoft documents this Windows Security route for unmanaged devices in its configuration instructions.
Choose the policy route for a managed device
For an organization-managed endpoint, configure the policy system that already owns its security settings. Local changes may be overridden or unavailable when a central policy controls the device.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors| Management method | What to configure | When it fits |
|---|---|---|
| Intune or the Microsoft Defender portal | Set Allow cloud protection to Allowed, and Submit samples consent to Send safe samples automatically or Send all samples automatically. | Central policy deployment. Microsoft recommends Intune for configuring and distributing Defender for Endpoint features; Intune is separate from Defender for Endpoint and may require an eligible subscription, standalone subscription, or add-on. |
| Configuration Manager | Configure cloud protection membership and automatic sample submission in the antimalware policy; there is no separate Block at First Sight setting. | Devices whose antimalware settings are managed through Configuration Manager. |
| Group Policy | Use the MAPS policy settings described below. | Windows devices managed through domain or local Group Policy. |
| PowerShell | Set the MAPS reporting, sample consent, and Block at First Sight preference values. | Direct configuration or verification by an administrator in an elevated session. |
Group Policy
In the Group Policy editor, go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > MAPS. Enable Configure the ‘Block at First Sight’ feature and configure Send file samples when further analysis is required to send safe samples (0x1) or all samples (0x3). Microsoft’s ADMX policy reference also identifies downloaded-file scanning and real-time protection requirements and notes that tamper protection can affect changes.
Rank #3
PowerShell
Run PowerShell as an administrator. The following command enables Block at First Sight, selects Advanced MAPS reporting, and sends safe samples automatically:
Set-MpPreference -MAPSReporting Advanced -SubmitSamplesConsent SendSafeSamples -DisableBlockAtFirstSeen $falseTo check the current values, run:
Get-MpPreference | Select-Object MAPSReporting, SubmitSamplesConsent, DisableBlockAtFirstSeenMicrosoft documents these enabled-state values: MAPSReporting = 2, SubmitSamplesConsent = 1 (safe samples) or 3 (all samples), and DisableBlockAtFirstSeen = False. The Microsoft configuration guide includes the command and value mapping.
Why the setting may be greyed out or not take effect
- Group Policy owns the setting: Windows Security can show policy-managed settings as unavailable. Apply the change through the controlling policy rather than trying to override it in the local UI.
- Policy has not reached the device: A Group Policy change must be received by the endpoint before Windows Security reflects it. Confirm policy application and then check the setting again.
- Tamper protection blocks the change: Microsoft warns that tamper protection can cause changes to protected antivirus settings to be ignored. See the policy reference for the relevant policy behavior.
- A prerequisite is missing: Check cloud-delivered protection, automatic sample submission, and Defender Antivirus updates. Never Send disables Block at First Sight based on sample analysis; Always Prompt lowers protection.
What to expect while Defender checks a file
A cloud analysis can temporarily hold a suspicious file while Defender waits for a verdict. Microsoft documents a typical cloud-check timeout of 10 seconds. Administrators can configure an extended check for up to 50 additional seconds, making the total timeout up to 60 seconds. The extended setting depends on Block at First Sight, cloud protection, and automatic sample submission being enabled; see Microsoft’s Defender Policy CSP documentation.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
