mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-29 05:37:22 +00:00
Merge branch 'master' of https://cpubwin.visualstudio.com/_git/it-client into tibdraft
This commit is contained in:
Celeste de Guzman
commit
00d2352d93
BIN
store-for-business/images/msfb-add-collection.PNG
Normal file
BIN
store-for-business/images/msfb-add-collection.PNG
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 10 KiB |
BIN
store-for-business/images/msfb-click-private-store.png
Normal file
BIN
store-for-business/images/msfb-click-private-store.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 6.6 KiB |
BIN
store-for-business/images/msfb-wn-1711-export-user.png
Normal file
BIN
store-for-business/images/msfb-wn-1711-export-user.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 4.6 KiB |
@ -7,6 +7,7 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: store
|
||||
author: TrudyHa
|
||||
ms.date: 11/28/2017
|
||||
ms.localizationpriority: high
|
||||
---
|
||||
|
||||
@ -24,13 +25,31 @@ The name of your private store is shown on a tab in Microsoft Store app, or on [
|
||||
|
||||
|
||||
You can change the name of your private store in Microsoft Store.
|
||||
|
||||
<!---
|
||||
## Change private store name
|
||||
**To change the name of your private store**
|
||||
|
||||
1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com)
|
||||
1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
2. Click **Manage**, click **Permissions**.
|
||||
3. On the **Private store ** tab, click **Change**.
|
||||
4. Type a new display name for your private store, and click **Save**.
|
||||
|
||||
|
||||
|
||||
## Add a Collection
|
||||
You can create collections of apps within your private store. Collections allow you to group or categorize apps - you might want a group of apps for different job functions in your company, or classes in your school.
|
||||
|
||||
**To add a collection to your private store**
|
||||
1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
2. Click your private store.</br>
|
||||
|
||||
|
||||
3. Click **Add a Collection**.</br>
|
||||
|
||||
|
||||
|
||||
4. Enter a name for your collection, and then click **Next**.
|
||||
5. Add products to ytour collection, and then click **Done**.
|
||||
|
||||
Currently, it takes about thirty-six hours for new collections to be available in your private store.
|
||||
-->
|
||||
@ -6,7 +6,7 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: store
|
||||
author: TrudyHa
|
||||
ms.date: 10/24/2017
|
||||
ms.date: 11/30/2017
|
||||
---
|
||||
|
||||
# Microsoft Store for Business and Education release history
|
||||
@ -15,8 +15,11 @@ Microsoft Store for Business and Education regularly releases new and improved f
|
||||
|
||||
Looking for info on the latest release? Check out [What's new in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md)
|
||||
|
||||
## October 2017
|
||||
|
||||
- Bug fixes and permformance improvements.
|
||||
|
||||
## September 2017
|
||||
We shared info about these updates in September, 2017.
|
||||
|
||||
- **Manage Windows device deployment with Windows AutoPilot Deployment** - In Microsoft Store for Business, you can manage devices for your organization and apply an AutoPilot deployment profile to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows, based on the AutoPilot deployment profile you applied to the device. [Get more info](add-profile-to-devices.md)
|
||||
- **Request an app** - People in your organization can reqest additional licenses for apps in your private store, and then Admins or Purchasers can make the purchases. [Get more info](https://docs.microsoft.com/microsoft-store/acquire-apps-microsoft-store-for-business#request-apps)
|
||||
|
||||
@ -6,7 +6,7 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: store
|
||||
author: TrudyHa
|
||||
ms.date: 10/31/2017
|
||||
ms.date: 11/30/2017
|
||||
---
|
||||
|
||||
# What's new in Microsoft Store for Business and Education
|
||||
@ -15,24 +15,26 @@ Microsoft Store for Business and Education regularly releases new and improved f
|
||||
|
||||
## Latest updates for Store for Business and Education
|
||||
|
||||
**October 2017**
|
||||
**November 2017**
|
||||
|
||||
We’ve been working on bug fixes and performance improvements to provide you a better experience. Stay tuned for new features!
|
||||
| | |
|
||||
|-----------------------|---------------------------------|
|
||||
|  |**Export list of Minecraft: Education Edition users**<br /><br />Admins and teachers can now export a list of users who have Minecraft: Education Edition licenses assigned to them. Click **Export users**, and Store for Education creates an Excel spreadsheet for you, and saves it as a .csv file.<br /><br />**Applies to**:<br /> Microsoft Store for Education |
|
||||
|
||||
<!---
|
||||
We’ve been working on bug fixes and performance improvements to provide you a better experience. Stay tuned for new features!
|
||||
| | |
|
||||
|-----------------------|---------------------------------|
|
||||
| <iframe width="288" height="232" src="https://www.youtube.com/embed/IpLIZU_j7Z0" frameborder="0" allowfullscreen></iframe>| **Manage Windows device deployment with Windows AutoPilot Deployment** <br /><br /> In Microsoft Store for Business, you can manage devices for your organization and apply an AutoPilot deployment profile to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows, based on the AutoPilot deployment profile you applied to the device.<br /><br />[Get more info](add-profile-to-devices.md)<br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
|
||||
|  |**Request an app**<br /><br />People in your organization can reqest additional licenses for apps in your private store, and then Admins or Purchasers can make the purchases. <br /><br />[Get more info](https://docs.microsoft.com/microsoft-store/acquire-apps-microsoft-store-for-business#request-apps)<br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
|
||||
|  |**My organization**<br /><br> **My organization** shows you all Agreements that apply to your organization. You can also update profile info for you org, such as mailing address and email associated with your account. <br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
|
||||
|  |**Manage prepaid Office 365 subscriptions**<br /><br />Office 365 prepaid subscriptions can be redeemed using a prepaid token. Tokens are available through 3rd-party businesses, outside of Microsoft Store for Business or the Office 365 Admin portal. After redemming prepaid subscriptions, Admins can add more licenses or extend the subscription's expiration date. <br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
|
||||
|  |**Manage Office 365 subscriptions acquired by partners**<br /><br />Office 365 subscriptions purchased for your organization by a partner or reseller can be managed in Microsoft Store for Business. Admins can assign and manage licenses for these subscriptions. <br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
|
||||
|  |**Edge extensions in Microsoft Store**<br /><br />Edge Extensions are now available from Microsoft Store! You can acquire and distribute them from Microsoft Store for Business just like any other app. <br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
|
||||
|  |**Search results in Microsoft Store for Business**<br /><br />Search results now have sub categories to help you refine search results. <br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
|
||||
||  |**Private store collections**<br /><br> You can groups of apps in your private store with **Collections**. This can help you organize apps and help people find apps for their job or classroom. <br /><br />[Get more info](https://review.docs.microsoft.com/microsoft-store/manage-private-store-settings?branch=msfb-14856406#add-a-collection)<br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
|
||||
-->
|
||||
|
||||
## Previous releases and updates
|
||||
|
||||
[October 2017](release-history-microsoft-store-business-education.md#october-2017)
|
||||
- Bug fixes and permformance improvements.
|
||||
|
||||
[September 2017](release-history-microsoft-store-business-education.md#september-2017)
|
||||
- Manage Windows device deployment with Windows AutoPilot Deployment
|
||||
- Request an app
|
||||
|
||||
@ -189,9 +189,9 @@ ADMX Info:
|
||||
<!--StartDescription-->
|
||||
<p style="margin-left: 20px">Added in Windows 10, version 1703. This policy setting allows you to hide the Switch account button on the sign-in screen, Start, and the Task Manager. If you enable this policy setting, the Switch account button is hidden from the user who is attempting to sign-in or is signed in to the computer that has this policy applied. If you disable or do not configure this policy setting, the Switch account button is accessible to the user in the three locations.
|
||||
|
||||
<p style="margin-left: 20px">Value type is bool. The following list shows the supported values:
|
||||
<p style="margin-left: 20px">Value type is int. The following list shows the supported values:
|
||||
|
||||
- 0 (default) - Diabled (visible).
|
||||
- 0 (default) - Disabled (visible).
|
||||
- 1 - Enabled (hidden).
|
||||
|
||||
<p style="margin-left: 20px">To validate on Desktop, do the following:
|
||||
|
||||
@ -127,7 +127,7 @@ See the following table for a summary of the management settings for Windows 10
|
||||
| [24. Windows Media Player](#bkmk-wmp) |  | | | |  |
|
||||
| [25. Windows Spotlight](#bkmk-spotlight) |  |  |  |  | |
|
||||
| [26. Microsoft Store](#bkmk-windowsstore) | |  | |  | |
|
||||
| [26.1 General](#bkmk-apps-for-websites) | |  | | |
|
||||
| [26.1 Apps for websites](#bkmk-apps-for-websites) | |  | | |
|
||||
| [27. Windows Update Delivery Optimization](#bkmk-updates) |  |  |  |  | |
|
||||
| [28. Windows Update](#bkmk-wu) |  |  |  | | |
|
||||
|
||||
@ -155,7 +155,7 @@ See the following table for a summary of the management settings for Windows Ser
|
||||
| [23. Windows Defender](#bkmk-defender) | |  |  | |
|
||||
| [24. Windows Media Player](#bkmk-wmp) | | | |  |
|
||||
| [26. Microsoft Store](#bkmk-windowsstore) | |  |  | |
|
||||
| [26.1 General](#bkmk-apps-for-websites) | |  | | |
|
||||
| [26.1 Apps for websites](#bkmk-apps-for-websites) | |  | | |
|
||||
| [28. Windows Update](#bkmk-wu) | |  |  | |
|
||||
|
||||
### Settings for Windows Server 2016 Server Core
|
||||
|
||||
@ -9,7 +9,7 @@ ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: DaniHalfin
|
||||
ms.author: daniha
|
||||
ms.date: 06/30/2017
|
||||
ms.date: 11/30/2017
|
||||
---
|
||||
|
||||
# Overview of Windows AutoPilot
|
||||
@ -40,6 +40,7 @@ Windows AutoPilot allows you to:
|
||||
|
||||
* [Devices must be registered to the organization](#registering-devices-to-your-organization)
|
||||
* [Company branding needs to be configured](#configure-company-branding-for-oobe)
|
||||
* [Network connectivity to cloud services used by Windows AutoPilot](#network-connectivity-requirements)
|
||||
* Devices have to be pre-installed with Windows 10 Professional, Enterprise or Education, of version 1703 or later
|
||||
* Devices must have access to the internet
|
||||
* [Azure AD Premium P1 or P2](https://www.microsoft.com/cloud-platform/azure-active-directory-features)
|
||||
@ -77,7 +78,13 @@ If you would like to capture that information by yourself, you can use the [Get-
|
||||
By uploading this information to the Microsoft Store for Business or Partner Center admin portal, you'll be able to assign devices to your organization.
|
||||
Additional options and customization is available through these portals to pre-configure the devices.
|
||||
|
||||
Options available for Windows 10, starting with version 1703:
|
||||
For information on how to upload device information, see [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#add-devices-and-apply-autopilot-deployment-profile) or [Partner Center](https://msdn.microsoft.com/partner-center/autopilot) guidance.
|
||||
|
||||
#### OOBE customization
|
||||
|
||||
Deployment profiles are used to configure the Out-Of-the-Box-Experience (OOBE) on devices deployed through the Windows AutoPilot Deployment Program.
|
||||
|
||||
These are the OOBE customization options available for Windows 10, starting with version 1703:
|
||||
* Skipping Work or Home usage selection (*Automatic*)
|
||||
* Skipping OEM registration, OneDrive and Cortana (*Automatic*)
|
||||
* Skipping privacy settings
|
||||
@ -86,17 +93,43 @@ Options available for Windows 10, starting with version 1703:
|
||||
|
||||
We are working to add additional options to further personalize and streamline the setup experience in future releases.
|
||||
|
||||
To see additional details on how to customize the OOBE experience and how to follow this process, see guidance for [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices) or [Partner Center](https://msdn.microsoft.com/partner-center/autopilot).
|
||||
To configure and apply deployment profiles, see guidance for the various available administration options:
|
||||
* [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles)
|
||||
* [Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot)
|
||||
* [Microsoft 365 Business & Office 365 Admin](https://support.office.com/article/Create-and-edit-AutoPilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa)
|
||||
* [Partner Center](https://msdn.microsoft.com/partner-center/autopilot)
|
||||
|
||||
#### Configure company branding for OOBE
|
||||
##### Configure company branding for OOBE
|
||||
|
||||
In order for your company branding to appear during the Out-of-the-Box Experience, you'll need to configure it in Azure Active Directory first.
|
||||
In order for your company branding to appear during the OOBE, you'll need to configure it in Azure Active Directory first.
|
||||
|
||||
See [Add company branding to your directory](https://docs.microsoft.com/azure/active-directory/customize-branding#add-company-branding-to-your-directory), to configure these settings.
|
||||
|
||||
#### Network connectivity requirements
|
||||
|
||||
The Windows AutoPilot Deployment Program uses a number of cloud services to get your devices to a productive state. This means those services need to be accessible from devices registered as Windows Autopilot devices.
|
||||
|
||||
To manage devices behind firewalls and proxy servers, the following URLs need to be accessible:
|
||||
|
||||
* https://go.microsoft.com
|
||||
* https://login.microsoftonline.com
|
||||
* https://login.live.com
|
||||
* https://account.live.com
|
||||
* https://signup.live.com
|
||||
* https://licensing.mp.microsoft.com
|
||||
* https://licensing.md.mp.microsoft.com
|
||||
* ctldl.windowsupdate.com
|
||||
* download.windowsupdate.com
|
||||
|
||||
>[!NOTE]
|
||||
>Where not explicitly specified, both HTTPS (443) and HTTP (80) need to be accessible.
|
||||
|
||||
>[!TIP]
|
||||
>If you're auto-enrolling your devices into Microsoft Intune, or deploying Microsoft Office, make sure you follow the networking guidlines for [Microsoft Intune](https://docs.microsoft.com/en-us/intune/network-bandwidth-use#network-communication-requirements) and [Office 365](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2).
|
||||
|
||||
### IT-Driven
|
||||
|
||||
If you are planning to use to configure these devices with traditional on-premises or cloud-based solutions, the [Windows Configuration Designer](https://www.microsoft.com/store/p/windows-configuration-designer/9nblggh4tx22) can be used to help automate the process. This is more suited to scenarios in which you require a higher level of control over the provisioning process. For more information on creating provisioning packages with Windows Configuration Designer, see [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package).
|
||||
If you are planning to configure devices with traditional on-premises or cloud-based solutions, the [Windows Configuration Designer](https://www.microsoft.com/store/p/windows-configuration-designer/9nblggh4tx22) can be used to help automate the process. This is more suited to scenarios in which you require a higher level of control over the provisioning process. For more information on creating provisioning packages with Windows Configuration Designer, see [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package).
|
||||
|
||||
### Teacher-Driven
|
||||
|
||||
|
||||
@ -77,7 +77,7 @@ The following procedures describe how to manage the TPM command lists. You must
|
||||
|
||||
## Use the TPM cmdlets
|
||||
|
||||
You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx).
|
||||
You can manage the TPM using Windows PowerShell. For details, see [TrustedPlatformModule PowerShell cmdlets](https://docs.microsoft.com/powershell/module/trustedplatformmodule/?view=win10-ps).
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -136,6 +136,7 @@
|
||||
#### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
##### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines)
|
||||
##### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines)
|
||||
### [Windows Defender ATP service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md)
|
||||
### [Configure Windows Defender ATP preferences settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md)
|
||||
#### [Update general settings](windows-defender-atp\general-settings-windows-defender-advanced-threat-protection.md)
|
||||
#### [Turn on advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md)
|
||||
@ -145,8 +146,9 @@
|
||||
#### [Enable Threat intel API](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
#### [Enable and create Power BI reports using Windows Defender ATP data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
#### [Enable Security Analytics security controls](windows-defender-atp\enable-security-analytics-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
### [Windows Defender ATP settings](windows-defender-atp\settings-windows-defender-advanced-threat-protection.md)
|
||||
### [Windows Defender ATP service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md)
|
||||
### [Access the Windows Defender ATP Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md)
|
||||
### [Troubleshoot Windows Defender ATP](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
### [Review events and errors on endpoints with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md)
|
||||
### [Windows Defender Antivirus compatibility with Windows Defender ATP](windows-defender-atp\defender-compatibility-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -43,6 +43,11 @@ You can also [specify how long the file should be prevented from running](config
|
||||
> [!IMPORTANT]
|
||||
> There is no specific individual setting in System Center Configuration Manager to enable or disable Block at First Sight. It is enabled by default when the pre-requisite settings are configured correctly. You must use Group Policy settings to enable or disable the feature.
|
||||
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work.
|
||||
|
||||
|
||||
## How it works
|
||||
|
||||
When a Windows Defender Antivirus client encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend will apply heuristics, machine learning, and automated analysis of the file to determine the files as malicious or clean.
|
||||
|
||||
@ -32,6 +32,12 @@ This topic lists the connections that must be allowed, such as by using firewall
|
||||
|
||||
See the Enterprise Mobility and Security blog post [Important changes to Microsoft Active Protection Services endpoint](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/important-changes-to-microsoft-active-protection-service-maps-endpoint/) for some details about network connectivity.
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working:
|
||||
>- Cloud-delivered protection
|
||||
>- Fast learning (including Black at first sight)
|
||||
>- Potentially unwanted application blocking
|
||||
|
||||
## Allow connections to the Windows Defender Antivirus cloud
|
||||
|
||||
The Windows Defender Antivirus cloud provides fast, strong protection for your endpoints. Enabling the cloud-delivered protection service is optional, however it is highly recommend as it provides very important protection against malware on your endpoints and across your network.
|
||||
|
||||
@ -41,6 +41,9 @@ Typical PUA behavior includes:
|
||||
|
||||
These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications.
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
## How it works
|
||||
|
||||
PUAs are blocked when a user attempts to download or install the detected file, and if the file meets one of the following conditions:
|
||||
|
||||
@ -86,10 +86,10 @@ Use the following cmdlets to enable cloud-delivered protection:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -MAPSReporting Advanced
|
||||
Set-MpPreference -SubmitSamplesConsent 3
|
||||
Set-MpPreference -SubmitSamplesConsent Always
|
||||
```
|
||||
>[!NOTE]
|
||||
>You can also set -SubmitSamplesConsent to 1. Setting it to 0 will lower the protection state of the device, and setting it to 2 means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function.
|
||||
>You can also set -SubmitSamplesConsent to `None`. Setting it to `Never` will lower the protection state of the device, and setting it to 2 means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function.
|
||||
|
||||
|
||||
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus.
|
||||
|
||||
@ -28,6 +28,13 @@ ms.date: 08/25/2017
|
||||
|
||||
If you're an enterprise security administrator, and you want to determine how well Windows Defender Antivirus protects you from viruses, malware, and potentially unwanted applications, then you can use this guide to help you evaluate Microsoft protection.
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
|
||||
>- Cloud-delivered protection
|
||||
>- Fast learning (including Black at first sight)
|
||||
>- Potentially unwanted application blocking
|
||||
|
||||
|
||||
It explains the important features available for both small and large enterprises in Windows Defender, and how they will increase malware detection and protection across your network.
|
||||
|
||||
You can choose to configure and evaluate each setting independently, or all at once. We have grouped similar settings based upon typical evaluation scenarios, and include instructions for using PowerShell to enable the settings.
|
||||
|
||||
@ -34,6 +34,11 @@ The tables list:
|
||||
- [Windows Defender AV client error codes](#error-codes)
|
||||
- [Internal Windows Defender AV client error codes (used by Microsoft during development and testing)](#internal-error-codes)
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working:
|
||||
>- Cloud-delivered protection
|
||||
>- Fast learning (including Black at first sight)
|
||||
>- Potentially unwanted application blocking
|
||||
|
||||
<a id="windows-defender-av-ids"></a>
|
||||
## Windows Defender AV event IDs
|
||||
@ -1637,8 +1642,8 @@ The Windows Defender client attempted to download and install the latest definit
|
||||
To troubleshoot this event:
|
||||
<ol>
|
||||
<li>Restart the computer and try again.</li>
|
||||
<li>Download the latest definitions from the <a href="https://go.microsoft.com/fwlink/?LinkID=200965">Microsoft Malware Protection Center</a>.
|
||||
Note: The size of the definitions file downloaded from the <a href="https://go.microsoft.com/fwlink/?LinkID=200965">Microsoft Malware Protection Center</a> can exceed 60 MB and should not be used as a long-term solution for updating definitions.
|
||||
<li>Download the latest definitions from the <a href="https://aka.ms/wdsi">Windows Defender Security Intelligence site</a>.
|
||||
Note: The size of the definitions file downloaded from the site can exceed 60 MB and should not be used as a long-term solution for updating definitions.
|
||||
</li>
|
||||
<li>Contact <a href="https://go.microsoft.com/fwlink/?LinkId=215491">Microsoft Technical Support</a>.
|
||||
</li>
|
||||
@ -2708,8 +2713,8 @@ This error indicates that there might be a problem with your security product.
|
||||
<li>Update the definitions. Either:<ol>
|
||||
<li>Click the <b>Update definitions</b> button on the <b>Update</b> tab in Windows Defender. <img src="images/defender-updatedefs2.png" alt="Update definitions in Windows Defender"/>Or,
|
||||
</li>
|
||||
<li>Download the latest definitions from the <a href="https://go.microsoft.com/fwlink/?LinkID=200965">Microsoft Malware Protection Center</a>.
|
||||
Note: The size of the definitions file downloaded from the <a href="https://go.microsoft.com/fwlink/?LinkID=200965">Microsoft Malware Protection Center</a> can exceed 60 MB and should not be used as a long-term solution for updating definitions.
|
||||
<li>Download the latest definitions from the <a href="https://aka.ms/wdsi">Windows Defender Security Intelligence site</a>.
|
||||
Note: The size of the definitions file downloaded from the site can exceed 60 MB and should not be used as a long-term solution for updating definitions.
|
||||
</li>
|
||||
</ol>
|
||||
</li>
|
||||
|
||||
@ -40,6 +40,10 @@ src="https://videoplayercdn.osi.office.net/embed/c2f20f59-ca56-4a7b-ba23-44c60bc
|
||||
|
||||
Cloud-delivered protection is enabled by default, however you may need to re-enable it if it has been disabled as part of previous organizational policies.
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
|
||||
The following table describes the differences in cloud-delivered protection between recent versions of Windows and System Center Configuration Manager.
|
||||
|
||||
|
||||
|
||||
@ -42,6 +42,13 @@ Some of the highlights of Windows Defender AV include:
|
||||
- [Always-on scanning](configure-real-time-protection-windows-defender-antivirus.md), using advanced file and process behavior monitoring and other heuristics (also known as "real-time protection")
|
||||
- [Dedicated protection updates](manage-updates-baselines-windows-defender-antivirus.md) based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research
|
||||
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
|
||||
>- Cloud-delivered protection
|
||||
>- Fast learning (including Black at first sight)
|
||||
>- Potentially unwanted application blocking
|
||||
|
||||
## What's new in Windows 10, version 1703
|
||||
|
||||
New features for Windows Defender AV in Windows 10, version 1703 include:
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
---
|
||||
title: Access the Windows Defender ATP Community Center
|
||||
description: Access the Windows Defender ATP Community Center to share experiences, engange, and learn about the product.
|
||||
keywords: community, community center, tech community, conversation, announcements
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 11/30/2017
|
||||
---
|
||||
|
||||
|
||||
# Access the Windows Defender ATP Community Center
|
||||
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Windows Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product.
|
||||
|
||||
There are several spaces you can explore to learn about specific information:
|
||||
- Announcements
|
||||
- What's new
|
||||
- Threat Intelligence
|
||||
|
||||
|
||||
There are several ways you can access the Community Center:
|
||||
- In the Windows Defender ATP portal navigation pane, select **Community center**. A new browser tab opens and takes you to the Windows Defender ATP Tech Community page.
|
||||
- Access the community through the [Windows Defender Advanced Threat Protection Tech Community](https://techcommunity.microsoft.com/t5/Windows-Defender-Advanced-Threat/ct-p/WindowsDefenderAdvanced) page
|
||||
|
||||
|
||||
You can instantly view and read conversations that have been posted in the community.
|
||||
|
||||
To get the full experience within the community such as being able to comment on posts, you'll need to join the community. For more information on how to get started in the Microsoft Tech Community, see [Microsoft Tech Community: Getting Started](https://techcommunity.microsoft.com/t5/Getting-Started/Microsoft-Tech-Community-Getting-Started-Guide/m-p/77888#M15).
|
||||
@ -20,7 +20,7 @@ ms.date: 10/17/2017
|
||||
- Windows Server 2016
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
|
||||
|
||||
@ -58,6 +58,9 @@ Windows Defender ATP supports the use of Power BI data connectors to enable you
|
||||
- [Configure non-Windows endpoints](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)<br>
|
||||
Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the Windows Defender ATP portal and better protect your organization's network. This experience leverages on a third-party security products' sensor data.
|
||||
|
||||
- [Access the Windows Defender ATP Community Center](community-windows-defender-advanced-threat-protection.md)<br>
|
||||
The Windows Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product. Access and join the community to learn and interact with other members on product specific information.
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-preview-belowfoldlink)
|
||||
|
||||
|
||||
@ -46,6 +46,9 @@ Attack surface reduction helps prevent actions and apps that are typically used
|
||||
|
||||
It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
Attack surface reduction works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
The feature is comprised of a number of rules, each of which target specific behaviors that are typically used by malware and malicious apps to infect machines, such as:
|
||||
|
||||
@ -40,6 +40,9 @@ This topic provides links that describe how to enable the audit functionality fo
|
||||
|
||||
You can use Group Policy, PowerShell, and configuration servicer providers (CSPs) to enable audit mode.
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work.
|
||||
|
||||
|
||||
|
||||
Audit options | How to enable audit mode | How to view events
|
||||
@ -58,7 +61,7 @@ You can also use the a custom PowerShell script that enables the features in aud
|
||||
|
||||
2. Right-click **Windows PowerShell**, click **Run as administrator** and click **Yes** or enter admin credentials at the prompt.
|
||||
|
||||
3. Enter the following in the PowerShell window to enable Controlled folder access and Attack surface reduction in audie mode:
|
||||
3. Enter the following in the PowerShell window to enable Controlled folder access and Attack surface reduction in audit mode:
|
||||
```PowerShell
|
||||
Set-ExecutionPolicy Bypass -Force
|
||||
<location>\Enable-ExploitGuardAuditMode.ps1
|
||||
|
||||
@ -42,6 +42,9 @@ Controlled folder access helps you protect valuable data from malicious apps and
|
||||
|
||||
It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
Controlled folder access works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
All apps (any executable file, including .exe, .scr, .dll files and others) are assessed by Windows Defender Antivirus, which then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then it will not be allowed to make changes to any files in any protected folder.
|
||||
|
||||
@ -185,7 +185,7 @@ Exporting the configuration as an XML file allows you to copy the configuration
|
||||
The configuration settings that were most recently modified will always be applied - regardless of whether you use PowerShell or Windows Defender Security Center. This means that if you use the app to configure a mitigation, then use PowerShell to configure the same mitigation, the app will update to show the changes you made with PowerShell. If you were to then use the app to change the mitigation again, that change would apply.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Any changes that are deployed to a machine through Group Policy will override the local configuration. When setting up an initial configuration, use a machine that will not have a Group Policy configuration applied to ensure your changes aren't overriden.
|
||||
>Any changes that are deployed to a machine through Group Policy will override the local configuration. When setting up an initial configuration, use a machine that will not have a Group Policy configuration applied to ensure your changes aren't overridden.
|
||||
|
||||
|
||||
You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app:
|
||||
@ -194,6 +194,15 @@ Exporting the configuration as an XML file allows you to copy the configuration
|
||||
Get-ProcessMitigation -Name processName.exe
|
||||
```
|
||||
|
||||
>[!IMPORTANT]
|
||||
>System-level mitigations that have not been configured will show a status of `NOTSET`.
|
||||
>
|
||||
>For system-level settings, `NOTSET` indicates the default setting for that mitigation has been applied.
|
||||
>
|
||||
>For app-level settings, `NOTSET` indicates the system-level setting for the mitigation will be applied.
|
||||
>
|
||||
>The default setting for each system-level mitigation can be seen in the Windows Defender Security Center, as described in the [Configure system-level mitigations with the Windows Defender Security Center app section above](#configure-system-level-mitigations-with-the-windows-defender-security-center-app).
|
||||
|
||||
Use `Set` to configure each mitigation in the following format:
|
||||
|
||||
```PowerShell
|
||||
|
||||
@ -49,6 +49,12 @@ You can enable Controlled folder access with the Windows Defender Security Cente
|
||||
|
||||
For further details on how audit mode works, and when you might want to use it, see the [audit Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md).
|
||||
|
||||
>[!NOTE]
|
||||
>The Controlled folder access feature will display the state in the Windows Defender Security Center app under **Virus & threat protection settings**.
|
||||
>If the feature is configured with Group Policy, PowerShell, or MDM CSPs, the state will change in the Windows Defender Security Center app after a restart of the device.
|
||||
>If the feature is set to **Audit mode** with any of those tools, the Windows Defender Security Center app will show the state as **Off**.
|
||||
>See [Use audit mode to evaluate Windows Defender Exploit Guard features](audit-windows-defender-exploit-guard.md) for more details on how audit mode works.
|
||||
|
||||
|
||||
### Use the Windows Defender Security app to enable Controlled folder access
|
||||
|
||||
|
||||
@ -39,12 +39,15 @@ ms.date: 08/25/2017
|
||||
|
||||
Attack surface reduction is a feature that is part of Windows Defender Exploit Guard [that helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines](attack-surface-reduction-exploit-guard.md).
|
||||
|
||||
This topic helps you evaluate Attack surface reduction. It explains how to demo the feature using a specialized tool, and how to enable audit mode so you can test the feature directly in your organisation.
|
||||
This topic helps you evaluate Attack surface reduction. It explains how to demo the feature using a specialized tool, and how to enable audit mode so you can test the feature directly in your organization.
|
||||
|
||||
>[!NOTE]
|
||||
>This topic uses a customized testing tool and PowerShell cmdlets to make it easy to enable the feature and test it.
|
||||
>For instructions on how to use Group Policy, Mobile Device Management (MDM), and System Center Configuration Manager to deploy these settings across your network, see the main [Attack surface reduction topic](attack-surface-reduction-exploit-guard.md).
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
|
||||
## Use the demo tool to see how Attack surface reduction works
|
||||
|
||||
|
||||
@ -38,12 +38,14 @@ Controlled folder access is a feature that is part of Windows Defender Exploit G
|
||||
|
||||
It is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/en-us/wdsi/threats/ransomware) that can attempt to encrypt your files and hold them hostage.
|
||||
|
||||
This topic helps you evaluate Controlled folder access. It explains how to demo the feature using a specialized tool, and how to enable audit mode so you can test the feature directly in your organisation.
|
||||
This topic helps you evaluate Controlled folder access. It explains how to demo the feature using a specialized tool, and how to enable audit mode so you can test the feature directly in your organization.
|
||||
|
||||
>[!NOTE]
|
||||
>This topic uses PowerShell cmdlets to make it easy to enable the feature and test it.
|
||||
>For instructions on how to use Group Policy, Mobile Device Management (MDM), and System Center Configuration Manager to deploy these settings across your network, see the main [Controlled folder access topic](controlled-folders-exploit-guard.md).
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
## Use the demo tool to see how Controlled folder access works
|
||||
|
||||
|
||||
@ -46,6 +46,8 @@ This topcs helps you evaluate Exploit protection. See the [Exploit protection to
|
||||
>This topic uses PowerShell cmdlets to make it easy to enable the feature and test it.
|
||||
>For instructions on how to use Group Policy and Mobile Device Management (MDM to deploy these settings across your network, see the main [Exploit protection topic](exploit-protection-exploit-guard.md) .
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
## Enable and validate an Exploit protection mitigation
|
||||
|
||||
|
||||
@ -45,6 +45,9 @@ This topic helps you evaluate Network protection by enabling the feature and gui
|
||||
>[!NOTE]
|
||||
>The site will replicate the behavior that would happen if a user visted a malicious site or domain. The sites in this evaluation topic are not malicious, they are specially created websites that pretend to be malicious.
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
## Enable Network protection
|
||||
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
|
||||
|
||||
@ -33,7 +33,11 @@ Windows Defender Exploit Guard is a new collection of tools and features that he
|
||||
|
||||
Windows Defender Exploit Guard is comprised of four features. We've developed evaluation guides for each of the features so you can easily and quickly see how they work and determine if they are suitable for your organization.
|
||||
|
||||
Before you begin, you should read the main [Windows Defender Exploit Guard](windows-defender-exploit-guard.md) topic to get an understanding of each of the features and what their prerequisutes are.
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work.
|
||||
|
||||
|
||||
Before you begin, you should read the main [Windows Defender Exploit Guard](windows-defender-exploit-guard.md) topic to get an understanding of each of the features and what their prerequisites are.
|
||||
|
||||
|
||||
- [Evaluate Attack surface reduction](evaluate-attack-surface-reduction.md)
|
||||
@ -45,6 +49,8 @@ You might also be interested in enabling the features in audit mode - which allo
|
||||
|
||||
- [Use audit mode to evaluate Windows Defender Exploit Guard features](audit-windows-defender-exploit-guard.md)
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
Topic | Description
|
||||
|
||||
@ -42,6 +42,9 @@ Exploit protection automatically applies a number of exploit mitigation techniqu
|
||||
|
||||
It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
Exploit protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
You [configure these settings using the Windows Defender Security Center app or PowerShell](customize-exploit-protection.md) on an individual machine, and then [export the configuration as an XML file that you can deploy to other machines](import-export-exploit-protection-emet-xml.md). You can use Group Policy to distribute the XML file to multiple devices at once.
|
||||
|
||||
@ -59,10 +59,13 @@ The [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) contains a sample
|
||||
|
||||
Before you export a configuration file, you need to ensure you have the correct settings.
|
||||
|
||||
You should first configure Exploit protection on a single, dedicated machine. See the [Customize Exploit protection](customize-exploit-protection.md) topic for descriptions about and instrucitons for configuring mitigations.
|
||||
You should first configure Exploit protection on a single, dedicated machine. See the [Customize Exploit protection](customize-exploit-protection.md) topic for descriptions about and instructions for configuring mitigations.
|
||||
|
||||
When you have configured Exploit protection to your desired state (including both system-level and app-level mitigations), you can export the file using either the Windows Defender Security Center app or PowerShell.
|
||||
|
||||
|
||||
|
||||
|
||||
### Use the Windows Defender Security Center app to export a configuration file
|
||||
|
||||
|
||||
@ -114,6 +117,7 @@ After importing, the settings will be instantly applied and can be reviewed in t
|
||||
Change `filename` to the location and name of the Exploit protection XML file.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>
|
||||
>Ensure you import a configuration file that is created specifically for Exploit protection. You cannot directly import an EMET configuration file, you must convert it first.
|
||||
|
||||
|
||||
@ -123,6 +127,15 @@ You can convert an existing EMET configuration file to the new format used by Ex
|
||||
|
||||
You can only do this conversion in PowerShell.
|
||||
|
||||
>[!WARNING]
|
||||
>
|
||||
>You cannot directly convert the default EMET configuration files that are distributed with EMET. These files are intended to help set up EMET for a first-time user. Attempting to directly convert these files into an Exploit protection configuration file will not work.
|
||||
>
|
||||
>However, if you want to apply the same settings as in the default EMET configuration files, you must first import the default configuration file into EMET, then export the settings to a new file.
|
||||
>
|
||||
>You can then convert that file using the PowerShell cmdlet described here before importing the settings into Exploit protection.
|
||||
|
||||
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
|
||||
2. Enter the following cmdlet:
|
||||
|
||||
@ -132,6 +145,13 @@ You can only do this conversion in PowerShell.
|
||||
|
||||
Change `emetFile` to the name and location of the EMET configuration file, and change `filename` to whichever location and file name you want to use.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>
|
||||
>If you have enabled Mandatory ASLR for any apps in EMET, export the EMET settings to an XML file, and then convert the XML file into an Exploit protection configuration file, you will need to manually edit the converted XML file to ensure the Mandatory ASLR mitigation setting is correctly configured:
|
||||
>
|
||||
> 1. Open the PowerShell-converted XML file in a text editor.
|
||||
> 2. Search for `ASLR ForceRelocateImages="false"` and change it to `ASLR ForceRelocateImages="true"` for each app that you want Mandatory ASLR to be enabled.
|
||||
|
||||
|
||||
## Manage or deploy a configuration
|
||||
|
||||
|
||||
@ -42,6 +42,10 @@ It expands the scope of [Windows Defender SmartScreen](../windows-defender-smart
|
||||
|
||||
It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
|
||||
Network protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
When Network protection blocks a connection, a notification will be displayed from the Action Center. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors.
|
||||
|
||||
@ -45,6 +45,9 @@ You can evaluate each feature of Windows Defender EG with the guides at the foll
|
||||
|
||||
You can also [enable audit mode](audit-windows-defender-exploit-guard.md) for the features, which provides you with basic event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security.
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how each of them work.
|
||||
|
||||
Windows Defender EG can be managed and reported on in the Windows Defender Security Center as part of the Windows Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies, which also includes:
|
||||
- [The Windows Defender ATP console](../windows-defender-atp/windows-defender-advanced-threat-protection.md)
|
||||
- [Windows Defender Antivirus in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user