About The Downloaded MDECloudProtectionDemo Test

If the cloud-delivered protection test file downloads and opens instead of being detected and removed, cloud-delivered protection is not working correctly on that device.

Use this check path:

1. Verify Microsoft Defender Antivirus settings:
   • Open Start > Settings > Update & Security > Windows Security > Virus & threat protection.
   • Select Manage settings.
   • Confirm these are turned On:
     • Cloud-delivered protection
     • Automatic sample submission
2. Confirm real-time protection is enabled.
   • The test requires Microsoft Defender real-time protection to be on.
3. Update Defender before testing again:
   • Open Windows Security > Virus & threat protection.
   • Under Virus & threat protection updates, select Check for updates.
   • Under Threat definitions, select Check for updates.
4. Run the Microsoft cloud-delivered protection test again.
   • The test file is harmless and is designed to simulate malware detection.
   • Expected result: Microsoft Defender Antivirus should detect the file, show a warning, and delete or quarantine it.
5. Check whether the detection was recorded:
   • Open Windows Security.
   • Go to Virus & threat protection > Protection history.
   • Under Quarantined threats, select See full history.
   • A successful test can also appear in the Windows event log as Microsoft Defender Antivirus event ID 1116.
6. If the file still executes or is only blocked by SmartScreen, validate Defender network connectivity.
   • Microsoft states that if the file executes, or if only Microsoft Defender SmartScreen blocks it, cloud-delivered protection is not working.
   • In that case, use the Microsoft Defender Antivirus network connection validation guidance.
7. If downloaded files are being blocked or warned on by Windows itself, check whether Attachment Manager or SmartScreen is involved.
   • In File Explorer, right-click the file > Properties.
   • On the General tab, check for a security message such as the file being blocked because it came from another computer.
   • In Microsoft Edge, check Settings and more (...) > Settings > Privacy, search, and services > Security and verify Microsoft Defender SmartScreen is on.
   • Turning off SmartScreen makes the device more vulnerable.

If suspicious files are still not detected after those checks, submit the file to Microsoft for analysis.

• Cloud-delivered protection demonstration
• Configure and validate Microsoft Defender Antivirus network connections
• Troubleshoot problems with detecting and removing malware
• Information about the Attachment Manager in Microsoft Windows