mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-29 13:47:23 +00:00
Merge remote-tracking branch 'refs/remotes/origin/master' into jdholo
This commit is contained in:
Jeanie Decker
commit
0233210dbe
@ -15,19 +15,26 @@ ms.topic: article
|
||||
---
|
||||
|
||||
# Deploying the latest firmware and drivers for Surface devices
|
||||
Although Surface devices are typically automatically updated with the latest device drivers and firmware via Windows Update, sometimes it's necessary to download and install updates manually, such as during a Windows deployment. If you need to install drivers and firmware separately from Windows Update, you can find the requisite files on the Microsoft Download Center. Installation files for administrative tools, drivers for accessories, and updates for Windows are also available for some devices.
|
||||
Although Surface devices are typically automatically updated with the latest device drivers and firmware via Windows Update, sometimes it's necessary to download and install updates manually, such as during a Windows deployment.
|
||||
|
||||
## Downloading MSI files
|
||||
To download MSI files, refer to the following Microsoft Support page:
|
||||
|
||||
- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware-for-surface)<br>
|
||||
Installation files for administrative tools, drivers for accessories, and updates for Windows are also available for some devices.
|
||||
|
||||
## Deploying MSI files
|
||||
Driver and firmware updates for Surface devices containing all required cumulative updates are available as separate MSI files packaged for specific versions of Windows 10. For example, for Surface Pro 6, there are separate MSI files for Windows 10 versions 16299, 17134, and 17763.
|
||||
When deploying updates to Surface devices in your organization, you need to first determine the appropriate .MSI file for the Windows version running on your target devices.
|
||||
Driver and firmware updates for Surface devices containing all required cumulative updates are packaged in separate MSI files for specific versions of Windows 10.
|
||||
In the name of each of these files you will find a Windows build number, this number indicates the minimum supported build required to install the drivers and firmware contained within. Refer to [Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information) for a list of the build numbers for each version. For example, to install the drivers contained in SurfacePro6_Win10_16299_1900307_0.msi file you must have Windows 10 Fall Creators Update version 1709, or newer installed on your Surface Pro 6.
|
||||
|
||||
### Naming convention for Surface MSI files
|
||||
Each .MSI file is named in accordance with a formula that begins with the product and Windows release information, followed by the Windows OS floor number and version number, and ending with the revision of version number:
|
||||
|
||||
### Surface MSI naming convention
|
||||
Each .MSI file is named in accordance with a formula that begins with the product and Windows release information, followed by the Windows build number and version number, and ending with the revision of version number. SurfacePro6_Win10_16299_1900307_0.msi is classified as follows:
|
||||
|
||||
**Example:**
|
||||
SurfacePro6_Win10_16299_1900307_0.msi :
|
||||
|
||||
| Product | Windows release | OS floor | Version | Revision of version |
|
||||
| Product | Windows release | Build | Version | Revision of version |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| SurfacePro6 | Win10 | 16299 | 1900307 | 0 |
|
||||
| | | | Indicates key date and sequence information | Indicates release history of the MSI file |
|
||||
@ -42,31 +49,9 @@ Look to the **version** number to determine the latest files that contain the mo
|
||||
|
||||
The first file — SurfacePro6_Win10_16299_1900307_0.msi — is the newest because its VERSION field has the newest build in 2019; the other files are from 2018.
|
||||
|
||||
### Downloading MSI files
|
||||
To download MSI files, refer to the following Microsoft Support page:
|
||||
|
||||
- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware-for-surface)
|
||||
## Supported devices
|
||||
Downloadable MSI files are available for Surface devices from Surface Pro 2 and later.
|
||||
|
||||
|
||||
The following MSI files are available:
|
||||
|
||||
- Surface Laptop 2
|
||||
- Surface Pro 6
|
||||
- Surface Go
|
||||
- Surface Go with LTE Advanced
|
||||
- Surface Book 2
|
||||
- Surface Laptop
|
||||
- Surface Pro
|
||||
- Surface Pro with LTE Advanced
|
||||
- Surface Pro 6
|
||||
- Surface Studio
|
||||
- Surface Studio 2
|
||||
- Surface Book
|
||||
- Surface Pro 4
|
||||
- Surface Pro 3
|
||||
- Surface 3
|
||||
- Surface 3 LTE
|
||||
- Surface Pro 2
|
||||
|
||||
[!NOTE]
|
||||
There are no downloadable firmware or driver updates available for Surface devices with Windows RT, including Surface RT and Surface 2. Updates can only be applied using Windows Update.
|
||||
|
||||
@ -277,6 +277,7 @@ Sample syncxml to provision the firewall settings to evaluate
|
||||
</ul>
|
||||
<p style="margin-left: 20px">If not specified, the default is All.</p>
|
||||
<p style="margin-left: 20px">Value type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
<p style="margin-left: 20px">The tokens "Intranet", "RmtIntranet", "Internet" and "Ply2Renders" are supported on Windows 10, version 1809, and later.</p>
|
||||
|
||||
<a href="" id="description"></a>**FirewallRules/_FirewallRuleName_/Description**
|
||||
<p style="margin-left: 20px">Specifies the description of the rule.</p>
|
||||
@ -306,7 +307,7 @@ Sample syncxml to provision the firewall settings to evaluate
|
||||
<p style="margin-left: 20px">Value type is integer. Supported operations are Get and Replace.</p>
|
||||
|
||||
<a href="" id="direction"></a>**FirewallRules/_FirewallRuleName_/Direction**
|
||||
<p style="margin-left: 20px">Comma separated list. The rule is enabled based on the traffic direction as following. Supported values:</p>
|
||||
<p style="margin-left: 20px">The rule is enabled based on the traffic direction as following. Supported values:</p>
|
||||
<ul>
|
||||
<li>IN - the rule applies to inbound traffic.</li>
|
||||
<li>OUT - the rule applies to outbound traffic.</li>
|
||||
@ -320,7 +321,6 @@ Sample syncxml to provision the firewall settings to evaluate
|
||||
<li>RemoteAccess</li>
|
||||
<li>Wireless</li>
|
||||
<li>Lan</li>
|
||||
<li>MobileBroadband</li>
|
||||
</ul>
|
||||
<p style="margin-left: 20px">If not specified, the default is All.</p>
|
||||
<p style="margin-left: 20px">Value type is string. Supported operations are Get and Replace.</p>
|
||||
|
||||
@ -42,6 +42,8 @@ If you've followed the steps in the [Enrolling devices in Windows Analytics](win
|
||||
|
||||
[Device names not appearing for Windows 10 devices](#device-names-not-appearing-for-windows-10-devices)
|
||||
|
||||
[Custom log queries using the AbnormalShutdownCount field of Device Health show zero or lower than expected results](#custom-log-queries-using-the-abnormalshutdowncount-field-of-device-health-show-zero-or-lower-than-expected-results)
|
||||
|
||||
[Disable Upgrade Readiness](#disable-upgrade-readiness)
|
||||
|
||||
[Exporting large data sets](#exporting-large-data-sets)
|
||||
@ -54,7 +56,7 @@ In Log Analytics, go to **Settings > Connected sources > Windows telemetry** and
|
||||
Even though devices can take 2-3 days after enrollment to show up due to latency in the system, you can now verify the status of your devices with a few hours of running the deployment script as described in [You can now check on the status of your computers within hours of running the deployment script](https://blogs.technet.microsoft.com/upgradeanalytics/2017/05/12/wheres-my-data/) on the Windows Analytics blog.
|
||||
|
||||
>[!NOTE]
|
||||
> If you generate the status report and get an error message saying "Sorry! We’re not recognizing your Commercial Id," go to **Settings > Connected sources > Windows telemetry** and unsubscribe, wait a minute and then re-subscribe to Upgrade Readiness.
|
||||
> If you generate the status report and get an error message saying "Sorry! We’re not recognizing your Commercial Id," go to **Settings > Connected sources > Windows telemetry** remove the Upgrade Readiness solution, and then re-add it.
|
||||
|
||||
If devices are not showing up as expected, find a representative device and follow these steps to run the latest pilot version of the Upgrade Readiness deployment script on it to troubleshoot issues:
|
||||
|
||||
@ -201,6 +203,20 @@ Finally, Upgrade Readiness only collects IE site discovery data on devices that
|
||||
### Device names not appearing for Windows 10 devices
|
||||
Starting with Windows 10, version 1803, the device name is no longer collected by default and requires a separate opt-in. For more information, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). Allowing device names to be collected can make it easier for you to identify individual devices that report problems. Without the device name, Windows Analytics can only label devices by a GUID that it generates.
|
||||
|
||||
### Custom log queries using the AbnormalShutdownCount field of Device Health show zero or lower than expected results
|
||||
This issue affects custom queries of the Device Health data by using the **Logs > Search page** or API. It does not impact any of the built-in tiles or reports of the Device Health solution. The **AbnormalShutdownCount** field of the **DHOSReliability** data table represents abnormal shutdowns other than crashes, such as sudden power loss or holding down the power button.
|
||||
|
||||
We have identified an incompatibility between AbnormalShutdownCount and the Limited Enhanced diagnostic data level on Windows 10, versions 1709, 1803, and 1809. Such devices do not send the abnormal shutdown signal to Microsoft. You should not rely on AbnormalShutdownCount in your custom queries unless you use any one of the following workarounds:
|
||||
|
||||
|
||||
- Upgrade devices to Windows 10, version 1903 when available. Participants in the Windows Insider program can preview this change using Windows Insider builds.
|
||||
- Change the diagnostic data setting from devices running Windows 10, versions 1709, 1803, and 1809 normal Enhanced level instead of Limited Enhanced.
|
||||
- Use alternative data from devices to track abnormal shutdowns. For example, you can forward abnormal shutdown events from the Windows Event Log to your Log Analytics workspace by using the Log Analytics agent. Suggested events to forward include:
|
||||
- Log: System, ID: 41, Source: Kernel-Power
|
||||
- Log System, ID: 6008, Source: EventLog
|
||||
|
||||
|
||||
|
||||
### Disable Upgrade Readiness
|
||||
|
||||
If you want to stop using Upgrade Readiness and stop sending diagnostic data to Microsoft, follow these steps:
|
||||
|
||||
@ -51,4 +51,7 @@ Use Upgrade Readiness to get:
|
||||
- Application usage information, allowing targeted validation; workflow to track validation progress and decisions
|
||||
- Data export to commonly used software deployment tools, including System Center Configuration Manager
|
||||
|
||||
To get started with any of these solutions, visit the links for instructions to add it to Azure Portal.
|
||||
To get started with any of these solutions, visit the links for instructions to add it to Azure Portal.
|
||||
|
||||
>[!NOTE]
|
||||
> For details about licensing requirements and costs associated with using Windows Analytics solutions, see [What are the requirements and costs for Windows Analytics solutions?](windows-analytics-FAQ-troubleshooting.md#what-are-the-requirements-and-costs-for-windows-analytics-solutions).
|
||||
|
||||
@ -9,6 +9,8 @@ ms.sitesec: library
|
||||
ms.pagetype: mdt
|
||||
author: greg-lindsay
|
||||
ms.collection: M365-modern-desktop
|
||||
search.appverid:
|
||||
- MET150
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
@ -6,8 +6,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: aadake
|
||||
ms.date: 12/20/2018
|
||||
ms.topic: article
|
||||
ms.author: justinha
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 03/26/2019
|
||||
---
|
||||
|
||||
# Kernel DMA Protection for Thunderbolt™ 3
|
||||
@ -98,12 +102,12 @@ No, Kernel DMA Protection only protects against drive-by DMA attacks after the O
|
||||
DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping.
|
||||
Please check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external).
|
||||
|
||||
*For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the image below
|
||||
*For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the following image.
|
||||
|
||||
|
||||
|
||||
### What should I do if the drivers for my Thunderbolt™ 3 peripherals do not support DMA-remapping?
|
||||
If the peripherals do have class drivers provided by Windows 10, please use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, please contact your peripheral vendor/driver vendor to update the driver to support this functionality. Details for driver compatibility requirements can be found here (add link to OEM documentation).
|
||||
If the peripherals do have class drivers provided by Windows 10, please use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, please contact your peripheral vendor/driver vendor to update the driver to support this functionality. Details for driver compatibility requirements can be found at the [Microsoft Partner Center](https://partner.microsoft.com/dashboard/collaborate/packages/4142).
|
||||
|
||||
### Do Microsoft drivers support DMA-remapping?
|
||||
In Windows 10 1803 and beyond, the Microsoft inbox drivers for USB XHCI (3.x) Controllers, Storage AHCI/SATA Controllers and Storage NVMe Controllers support DMA-remapping.
|
||||
|
||||
@ -78,7 +78,7 @@ All x86-based Certified For Windows 10 PCs must meet several requirements relat
|
||||
|
||||
These requirements help protect you from rootkits while allowing you to run any operating system you want. You have three options for running non-Microsoft operating systems:
|
||||
|
||||
- **Use an operating system with a certified bootloader.** Because all Certified For Windows 10 PCs must trust Microsoft’s certificate, Microsoft offers a service to analyze and sign any non-Microsoft bootloader so that it will be trusted by all Certified For Windows 10 PCs. In fact, an [open source bootloader](http://mjg59.dreamwidth.org/20303.html) capable of loading Linux is already available. To begin the process of obtaining a certificate, go to <http://sysdev.microsoft.com>.
|
||||
- **Use an operating system with a certified bootloader.** Because all Certified For Windows 10 PCs must trust Microsoft’s certificate, Microsoft offers a service to analyze and sign any non-Microsoft bootloader so that it will be trusted by all Certified For Windows 10 PCs. In fact, an [open source bootloader](http://mjg59.dreamwidth.org/20303.html) capable of loading Linux is already available. To begin the process of obtaining a certificate, go to <http://partner.microsoft.com/dashboard>.
|
||||
- **Configure UEFI to trust your custom bootloader.** All Certified For Windows 10 PCs allow you to trust a non-certified bootloader by adding a signature to the UEFI database, allowing you to run any operating system, including homemade operating systems.
|
||||
- **Turn off Secure Boot.** All Certified For Windows 10 PCs allow you to turn off Secure Boot so that you can run any software. This does not help protect you from bootkits, however.
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 03/15/2019
|
||||
ms.date: 03/25/2019
|
||||
---
|
||||
|
||||
# Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune
|
||||
@ -67,6 +67,9 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or
|
||||
- [Recommended apps](#add-recommended-apps)
|
||||
- [Store apps](#add-store-apps)
|
||||
- [Desktop apps](#add-desktop-apps)
|
||||
|
||||
>[!NOTE]
|
||||
>An application might return access denied errors after removing it from the list of protected apps. Rather than remove it from the list, uninstall and reinstall the application or exempt it from WIP policy.
|
||||
|
||||
### Add recommended apps
|
||||
|
||||
@ -397,7 +400,7 @@ To define the network boundaries, click **App policy** > the name of your policy
|
||||
|
||||
|
||||
|
||||
Select the type of network boundary to add from the **Boundary type** box. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the following options, and then click **OK**.
|
||||
Select the type of network boundary to add from the **Boundary type** box. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the options covered in the following subsections, and then click **OK**.
|
||||
|
||||
### Cloud resources
|
||||
|
||||
|
||||
@ -13,7 +13,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/26/2019
|
||||
ms.date: 03/25/2019
|
||||
---
|
||||
|
||||
# Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)
|
||||
@ -38,8 +38,15 @@ This table includes the recommended URLs to add to your Enterprise Cloud Resourc
|
||||
|Visual Studio Online |contoso.visualstudio.com |
|
||||
|Power BI |contoso.powerbi.com |
|
||||
|
||||
>[!NOTE]
|
||||
>You can add other work-only apps to the Cloud Resource list, or you can create a packaged app rule for the .exe file to protect every file the app creates or modifies. Depending on how the app is accessed, you might want to add both.
|
||||
You can add other work-only apps to the Cloud Resource list, or you can create a packaged app rule for the .exe file to protect every file the app creates or modifies. Depending on how the app is accessed, you might want to add both.
|
||||
|
||||
For Office 365 endpoints, see [Office 365 URLs and IP address ranges](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges).
|
||||
Office 365 endpoints are updated monthly.
|
||||
Allow the domains listed in section number 46 Allow Required and add also add the apps.
|
||||
Note that apps from officeapps.live.com can also store personal data.
|
||||
|
||||
When multiple files are selected from SharePoint Online or OneDrive, the files are aggregated and the URL can change. In this case, add a entry for a second-level domain and use a wildcard such as .svc.ms.
|
||||
|
||||
|
||||
## Recommended Neutral Resources
|
||||
We recommended adding these URLs if you use the Neutral Resources network setting with Windows Information Protection (WIP).
|
||||
|
||||
@ -127,10 +127,10 @@
|
||||
|
||||
### [Configure and manage capabilities](windows-defender-atp/onboard.md)
|
||||
#### [Configure attack surface reduction](windows-defender-atp/configure-attack-surface-reduction.md)
|
||||
####Hardware-based isolation
|
||||
##### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md)
|
||||
##### [Application isolation](windows-defender-application-guard/install-wd-app-guard.md)
|
||||
###### [Configuration settings](windows-defender-application-guard/configure-wd-app-guard.md)
|
||||
#####Hardware-based isolation
|
||||
###### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md)
|
||||
###### [Application isolation](windows-defender-application-guard/install-wd-app-guard.md)
|
||||
####### [Configuration settings](windows-defender-application-guard/configure-wd-app-guard.md)
|
||||
##### [Application control](windows-defender-application-control/windows-defender-application-control.md)
|
||||
##### Device control
|
||||
###### [Control USB devices](device-control/control-usb-devices-using-intune.md)
|
||||
@ -139,7 +139,6 @@
|
||||
######## [Hardware qualifications](windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md)
|
||||
######## [Enable HVCI](windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md)
|
||||
##### [Exploit protection](windows-defender-exploit-guard/enable-exploit-protection.md)
|
||||
###### [Customize exploit protection](windows-defender-exploit-guard/customize-exploit-protection.md)
|
||||
###### [Import/export configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md)
|
||||
##### [Network protection](windows-defender-exploit-guard/enable-network-protection.md)
|
||||
##### [Controlled folder access](windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md)
|
||||
@ -388,7 +387,8 @@
|
||||
|
||||
#####Rules
|
||||
###### [Manage suppression rules](windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage automation allowed/blocked](windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage automation allowed/blocked lists](windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage allowed/blocked lists](windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage automation file uploads](windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage automation folder exclusions](windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -413,6 +413,7 @@
|
||||
####Troubleshoot attack surface reduction
|
||||
##### [Network protection](windows-defender-exploit-guard/troubleshoot-np.md)
|
||||
##### [Attack surface reduction rules](windows-defender-exploit-guard/troubleshoot-asr.md)
|
||||
##### [Collect diagnostic data for files](windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md)
|
||||
|
||||
#### [Troubleshoot next generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md)
|
||||
|
||||
|
||||
@ -49,4 +49,4 @@ To be eligible for VIA your organization must:
|
||||
|
||||
3. Be willing to sign and adhere to the VIA membership agreement.
|
||||
|
||||
If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry).
|
||||
If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/en-us/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/en-us/wdsi/alliances/collaboration-inquiry).
|
||||
@ -53,4 +53,4 @@ Your organization must meet the following eligibility requirements to qualify fo
|
||||
|
||||
### Apply now
|
||||
|
||||
If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry).
|
||||
If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/en-us/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/en-us/wdsi/alliances/collaboration-inquiry).
|
||||
|
||||
@ -136,7 +136,6 @@
|
||||
####### [Hardware qualifications](../windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md)
|
||||
####### [Enable HVCI](../windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md)
|
||||
#### [Exploit protection](../windows-defender-exploit-guard/enable-exploit-protection.md)
|
||||
##### [Customize exploit protection](../windows-defender-exploit-guard/customize-exploit-protection.md)
|
||||
##### [Import/export configurations](../windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md)
|
||||
#### [Network protection](../windows-defender-exploit-guard/enable-network-protection.md)
|
||||
#### [Controlled folder access](../windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md)
|
||||
@ -375,7 +374,8 @@
|
||||
|
||||
####Rules
|
||||
##### [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation allowed/blocked](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage allowed/blocked lists](manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -402,5 +402,7 @@
|
||||
###Troubleshoot attack surface reduction
|
||||
#### [Network protection](../windows-defender-exploit-guard/troubleshoot-np.md)
|
||||
#### [Attack surface reduction rules](../windows-defender-exploit-guard/troubleshoot-asr.md)
|
||||
#### [Collect diagnostic data for files](../windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md)
|
||||
|
||||
|
||||
### [Troubleshoot next generation protection](../windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md)
|
||||
|
||||
@ -15,7 +15,6 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 11/16/2018
|
||||
---
|
||||
|
||||
# Configure advanced features in Windows Defender ATP
|
||||
|
||||
@ -66,7 +66,7 @@ Add-MsolRoleMember -RoleName "Security Administrator" -RoleMemberEmailAddress "s
|
||||
Add-MsolRoleMember -RoleName "Security Reader" -RoleMemberEmailAddress "reader@Contoso.onmicrosoft.com"
|
||||
```
|
||||
|
||||
For more information see, [Manage Azure AD group and role membership](https://technet.microsoft.com/library/321d532e-407d-4e29-a00a-8afbe23008dd#BKMK_ManageGroups).
|
||||
For more information see, [Add or remove group memberships](https://technet.microsoft.com/library/321d532e-407d-4e29-a00a-8afbe23008dd#BKMK_ManageGroups).
|
||||
|
||||
## Assign user access using the Azure portal
|
||||
For more information, see [Assign administrator and non-administrator roles to uses with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal).
|
||||
|
||||
@ -48,7 +48,7 @@ ms.date: 04/24/2018
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a folder called *OptionalParamsPolicy* and the file *WindowsDefenderATPOnboardingScript.cmd*.
|
||||
|
||||
3. Open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**.
|
||||
3. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**.
|
||||
|
||||
4. In the **Group Policy Management Editor**, go to **Computer configuration**, then **Preferences**, and then **Control panel settings**.
|
||||
|
||||
@ -78,7 +78,7 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa
|
||||
|
||||
b. Copy _AtpConfiguration.adml_ into _C:\\Windows\\PolicyDefinitions\\en-US_
|
||||
|
||||
2. Open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the GPO you want to configure and click **Edit**.
|
||||
2. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11), right-click the GPO you want to configure and click **Edit**.
|
||||
|
||||
3. In the **Group Policy Management Editor**, go to **Computer configuration**.
|
||||
|
||||
@ -110,7 +110,7 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*.
|
||||
|
||||
3. Open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**.
|
||||
3. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**.
|
||||
|
||||
4. In the **Group Policy Management Editor**, go to **Computer configuration,** then **Preferences**, and then **Control panel settings**.
|
||||
|
||||
|
||||
@ -61,7 +61,7 @@ You can use existing System Center Configuration Manager functionality to create
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOnboardingScript.cmd*.
|
||||
|
||||
3. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682178.aspx) topic.
|
||||
3. Deploy the package by following the steps in the [Packages and Programs in Configuration Manager](https://docs.microsoft.com/en-us/sccm/apps/deploy-use/packages-and-programs) topic.
|
||||
|
||||
a. Choose a predefined device collection to deploy the package to.
|
||||
|
||||
@ -92,7 +92,7 @@ Possible values are:
|
||||
|
||||
The default value in case the registry key doesn’t exist is 1.
|
||||
|
||||
For more information about System Center Configuration Manager Compliance see [Compliance Settings in Configuration Manager](https://technet.microsoft.com/library/gg681958.aspx).
|
||||
For more information about System Center Configuration Manager Compliance see [Get started with compliance settings in System Center Configuration Manager](https://docs.microsoft.com/sccm/compliance/get-started/get-started-with-compliance-settings).
|
||||
|
||||
|
||||
|
||||
@ -115,7 +115,7 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*.
|
||||
|
||||
3. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682178.aspx) topic.
|
||||
3. Deploy the package by following the steps in the [Packages and Programs in Configuration Manager](https://docs.microsoft.com/en-us/sccm/apps/deploy-use/packages-and-programs) topic.
|
||||
|
||||
a. Choose a predefined device collection to deploy the package to.
|
||||
|
||||
@ -155,7 +155,7 @@ Path: “HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status”
|
||||
Name: “OnboardingState”
|
||||
Value: “1”
|
||||
```
|
||||
For more information about System Center Configuration Manager Compliance see [Compliance Settings in Configuration Manager](https://technet.microsoft.com/library/gg681958.aspx).
|
||||
For more information about System Center Configuration Manager Compliance see [Get started with compliance settings in System Center Configuration Manager](https://docs.microsoft.com/sccm/compliance/get-started/get-started-with-compliance-settings).
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -14,7 +14,6 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 12/14/2018
|
||||
---
|
||||
|
||||
# Onboard servers to the Windows Defender ATP service
|
||||
@ -45,7 +44,22 @@ For a practical guidance on what needs to be in place for licensing and infrastr
|
||||
|
||||
## Windows Server 2012 R2 and Windows Server 2016
|
||||
|
||||
To onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP, you’ll need to:
|
||||
There are two options to onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP:
|
||||
|
||||
- **Option 1**: Onboard through Azure Security Center
|
||||
- **Option 2**: Onboard through Windows Defender Security Center
|
||||
|
||||
### Option 1: Onboard servers through Azure Security Center
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
|
||||
2. Select Windows Server 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Onboard Servers in Azure Security Center**.
|
||||
|
||||
4. Follow the onboarding instructions in [Windows Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
|
||||
### Option 2: Onboard servers through Windows Defender Security Center
|
||||
You'll need to tak the following steps if you choose to onboard servers through Windows Defender Security Center.
|
||||
|
||||
- For Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients.
|
||||
|
||||
@ -53,7 +67,7 @@ To onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender AT
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
- Turn on server monitoring from Windows Defender Security Center.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Operations Management Suite (OMS), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through [Multi Homing support](https://blogs.technet.microsoft.com/msoms/2016/05/26/oms-log-analytics-agent-multi-homing-support/). Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Operations Management Suite (OMS), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through Multi Homing support. Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below.
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
@ -73,7 +87,7 @@ The following steps are required to enable this integration:
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
|
||||
2. Select Windows Server 2012R2 and 2016 as the operating system.
|
||||
2. Select Windows Server 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
|
||||
@ -201,7 +215,7 @@ To offboard the server, you can use either of the following methods:
|
||||
1. Get your Workspace ID:
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
b. Select **Windows Server 2012R2 and 2016** as the operating system and get your Workspace ID:
|
||||
b. Select **Windows Server 2012 R2 and 2016** as the operating system and get your Workspace ID:
|
||||
|
||||
|
||||
|
||||
|
||||
@ -44,6 +44,11 @@ A reinstalled or renamed machine will generate a new machine entity in Windows D
|
||||
**Machine was offboarded**</br>
|
||||
If the machine was offboarded it will still appear in machines list. After 7 days, the machine health state should change to inactive.
|
||||
|
||||
|
||||
**Machine is not sending signals**
|
||||
If the machine is not sending any signals for more than 7 days to any of the Windows Defender ATP channels for any reason including conditions that fall under misconfigured machines classification, a machine can be considered inactive.
|
||||
|
||||
|
||||
Do you expect a machine to be in ‘Active’ status? [Open a support ticket ticket](https://support.microsoft.com/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636206786382823561).
|
||||
|
||||
## Misconfigured machines
|
||||
|
||||
@ -0,0 +1,82 @@
|
||||
---
|
||||
title: Manage allowed/blocked lists
|
||||
description: Create indicators for a file hash, IP address, URLs or domains that define the detection, prevention, and exclusion of entities.
|
||||
keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Manage allowed/blocked lists
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink)
|
||||
|
||||
|
||||
Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to.
|
||||
|
||||
On the top navigation you can:
|
||||
- Import a list
|
||||
- Add an indicator
|
||||
- Customize columns to add or remove columns
|
||||
- Export the entire list in CSV format
|
||||
- Select the items to show per page
|
||||
- Navigate between pages
|
||||
- Apply filters
|
||||
|
||||
## Create an indicator
|
||||
1. In the navigation pane, select **Settings** > **Allowed/blocked list**.
|
||||
|
||||
2. Select the tab of the type of entity you'd like to create an indicator for. You can choose any of the following entities:
|
||||
- File hash
|
||||
- IP address
|
||||
- URLs/Domains
|
||||
|
||||
3. Click **Add indicator**.
|
||||
|
||||
4. For each attribute specify the following details:
|
||||
- Indicator - Specify the entity details and define the expiration of the indicator.
|
||||
- Action - Specify the action to be taken and provide a description.
|
||||
- Scope - Define the scope of the machine group.
|
||||
|
||||
5. Review the details in the Summary tab, then click **Save**.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Blocking IPs, domains, or URLs is currently available on limited preview only. This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforeced. While the option is not yet generally available, it will only be used when identified during an investigation.
|
||||
|
||||
|
||||
## Manage indicators
|
||||
1. In the navigation pane, select **Settings** > **Allowed/blocked list**.
|
||||
|
||||
2. Select the tab of the entity type you'd like to manage.
|
||||
|
||||
3. Update the details of the indicator and click **Save** or click the **Delete** button if you'd like to remove the entity from the list.
|
||||
|
||||
## Import a list
|
||||
You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details.
|
||||
|
||||
Download the sample CSV to know the supported column attributes.
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -15,14 +15,11 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 06/14/2018
|
||||
---
|
||||
|
||||
# Manage automation allowed/blocked lists
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
@ -70,4 +67,5 @@ You can define the conditions for when entities are identified as malicious or s
|
||||
|
||||
## Related topics
|
||||
- [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage allowed/blocked lists](manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Minimum requirements for Windows Defender ATP
|
||||
description: Minimum network and data storage configuration, machine hardware and software requirements, and deployment channel requirements for Windows Defender ATP.
|
||||
keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, machine configuration, deployment channel
|
||||
description: Understand the licensing requirements and requirements for onboarding machines to the sercvie
|
||||
keywords: minimum requirements, licensing, comparison table
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -15,7 +15,6 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 11/20/2018
|
||||
---
|
||||
|
||||
# Minimum requirements for Windows Defender ATP
|
||||
@ -43,6 +42,7 @@ For more information on the array of features in Windows 10 editions, see [Compa
|
||||
|
||||
For a detailed comparison table of Windows 10 commercial edition comparison, see the [comparison PDF](https://go.microsoft.com/fwlink/p/?linkid=2069559).
|
||||
|
||||
For more information about licensing requirements for Windows Defender ATP platform on Windows Server, see [Protecting Windows Servers with Windows Defender ATP](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114).
|
||||
|
||||
|
||||
## Related topic
|
||||
|
||||
@ -66,7 +66,7 @@ Review the following details to verify minimum system requirements:
|
||||
|
||||
- Install either [.NET framework 4.5](https://www.microsoft.com/en-us/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework)
|
||||
|
||||
>[NOTE]
|
||||
>[!NOTE]
|
||||
>Only applicable for Windows 7 SP1 Enterprise and Windows 7 SP1 Pro.
|
||||
>Don't install .NET framework 4.0.x, since it will negate the above installation.
|
||||
|
||||
|
||||
@ -44,7 +44,7 @@ When you open the portal, you’ll see the main areas of the application:
|
||||
- (3) Search, Community center, Time settings, Help and support, Feedback
|
||||
|
||||
> [!NOTE]
|
||||
> Malware related detections will only appear if your machines are using [Windows Defender Antivirus](https://technet.microsoft.com/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
|
||||
> Malware related detections will only appear if your machines are using Windows Defender Antivirus as the default real-time protection antimalware product.
|
||||
|
||||
You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section.
|
||||
|
||||
|
||||
@ -1,313 +1,312 @@
|
||||
---
|
||||
title: Troubleshoot Windows Defender ATP onboarding issues
|
||||
description: Troubleshoot issues that might arise during the onboarding of machines or to the Windows Defender ATP service.
|
||||
keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds, sensor data and diagnostics
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 09/07/2018
|
||||
---
|
||||
|
||||
# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
|
||||
You might need to troubleshoot the Windows Defender ATP onboarding process if you encounter issues.
|
||||
This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the machines.
|
||||
|
||||
If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, it might indicate an onboarding or connectivity problem.
|
||||
|
||||
## Troubleshoot onboarding when deploying with Group Policy
|
||||
Deployment with Group Policy is done by running the onboarding script on the machines. The Group Policy console does not indicate if the deployment has succeeded or not.
|
||||
|
||||
If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, you can check the output of the script on the machines. For more information, see [Troubleshoot onboarding when deploying with a script](#troubleshoot-onboarding-when-deploying-with-a-script).
|
||||
|
||||
If the script completes successfully, see [Troubleshoot onboarding issues](#troubleshoot-onboarding-issues) for additional errors that might occur.
|
||||
|
||||
## Troubleshoot onboarding issues when deploying with System Center Configuration Manager
|
||||
When onboarding machines using the following versions of System Center Configuration Manager:
|
||||
- System Center 2012 Configuration Manager
|
||||
- System Center 2012 R2 Configuration Manager
|
||||
- System Center Configuration Manager (current branch) version 1511
|
||||
- System Center Configuration Manager (current branch) version 1602
|
||||
|
||||
|
||||
Deployment with the above-mentioned versions of System Center Configuration Manager is done by running the onboarding script on the machines. You can track the deployment in the Configuration Manager Console.
|
||||
|
||||
If the deployment fails, you can check the output of the script on the machines.
|
||||
|
||||
If the onboarding completed successfully but the machines are not showing up in the **Machines list** after an hour, see [Troubleshoot onboarding issues](#troubleshoot-onboarding-issues) for additional errors that might occur.
|
||||
|
||||
## Troubleshoot onboarding when deploying with a script
|
||||
|
||||
**Check the result of the script on the machine**:
|
||||
1. Click **Start**, type **Event Viewer**, and press **Enter**.
|
||||
|
||||
2. Go to **Windows Logs** > **Application**.
|
||||
|
||||
3. Look for an event from **WDATPOnboarding** event source.
|
||||
|
||||
If the script fails and the event is an error, you can check the event ID in the following table to help you troubleshoot the issue.
|
||||
> [!NOTE]
|
||||
> The following event IDs are specific to the onboarding script only.
|
||||
|
||||
Event ID | Error Type | Resolution steps
|
||||
:---|:---|:---
|
||||
5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.
|
||||
10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically<br> ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```.<br>Verify that the script was ran as an administrator.
|
||||
15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). <br> <br> If the machine is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again.
|
||||
15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
|
||||
30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location<br>```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```.<br>The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
65 | Insufficient privileges| Run the script again with administrator privileges.
|
||||
|
||||
## Troubleshoot onboarding issues using Microsoft Intune
|
||||
You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue.
|
||||
|
||||
If you have configured policies in Intune and they are not propagated on machines, you might need to configure automatic MDM enrollment.
|
||||
|
||||
Use the following tables to understand the possible causes of issues while onboarding:
|
||||
|
||||
- Microsoft Intune error codes and OMA-URIs table
|
||||
- Known issues with non-compliance table
|
||||
- Mobile Device Management (MDM) event logs table
|
||||
|
||||
If none of the event logs and troubleshooting steps work, download the Local script from the **Machine management** section of the portal, and run it in an elevated command prompt.
|
||||
|
||||
**Microsoft Intune error codes and OMA-URIs**:
|
||||
|
||||
|
||||
Error Code Hex | Error Code Dec | Error Description | OMA-URI | Possible cause and troubleshooting steps
|
||||
:---|:---|:---|:---|:---
|
||||
0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding <br> Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields. <br><br> **Troubleshooting steps:** <br> Check the event IDs in the [View agent onboarding errors in the machine event log](#view-agent-onboarding-errors-in-the-endpoint-event-log) section. <br><br> Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx).
|
||||
| | | | Onboarding <br> Offboarding <br> SampleSharing | **Possible cause:** Windows Defender ATP Policy registry key does not exist or the OMA DM client doesn't have permissions to write to it. <br><br> **Troubleshooting steps:** Ensure that the following registry key exists: ```HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection``` <br> <br> If it doesn't exist, open an elevated command and add the key.
|
||||
| | | | SenseIsRunning <br> OnboardingState <br> OrgId | **Possible cause:** An attempt to remediate by read-only property. Onboarding has failed. <br><br> **Troubleshooting steps:** Check the troubleshooting steps in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](#troubleshoot-windows-defender-advanced-threat-protection-onboarding-issues). <br><br> Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx).
|
||||
|| | | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU. <br><br> Currently is supported platforms: Enterprise, Education, and Professional. <br> Server is not supported.
|
||||
0x87D101A9 | -2016345687 |Syncml(425): The requested command failed because the sender does not have adequate access control permissions (ACL) on the recipient. | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU. <br><br> Currently is supported platforms: Enterprise, Education, and Professional.
|
||||
|
||||
<br>
|
||||
**Known issues with non-compliance**
|
||||
|
||||
The following table provides information on issues with non-compliance and how you can address the issues.
|
||||
|
||||
Case | Symptoms | Possible cause and troubleshooting steps
|
||||
:---|:---|:---
|
||||
1 | Machine is compliant by SenseIsRunning OMA-URI. But is non-compliant by OrgId, Onboarding and OnboardingState OMA-URIs. | **Possible cause:** Check that user passed OOBE after Windows installation or upgrade. During OOBE onboarding couldn't be completed but SENSE is running already. <br><br> **Troubleshooting steps:** Wait for OOBE to complete.
|
||||
2 | Machine is compliant by OrgId, Onboarding, and OnboardingState OMA-URIs, but is non-compliant by SenseIsRunning OMA-URI. | **Possible cause:** Sense service's startup type is set as "Delayed Start". Sometimes this causes the Microsoft Intune server to report the machine as non-compliant by SenseIsRunning when DM session occurs on system start. <br><br> **Troubleshooting steps:** The issue should automatically be fixed within 24 hours.
|
||||
3 | Machine is non-compliant | **Troubleshooting steps:** Ensure that Onboarding and Offboarding policies are not deployed on the same machine at same time.
|
||||
|
||||
<br>
|
||||
**Mobile Device Management (MDM) event logs**
|
||||
|
||||
View the MDM event logs to troubleshoot issues that might arise during onboarding:
|
||||
|
||||
Log name: Microsoft\Windows\DeviceManagement-EnterpriseDiagnostics-Provider
|
||||
|
||||
Channel name: Admin
|
||||
|
||||
ID | Severity | Event description | Troubleshooting steps
|
||||
:---|:---|:---|:---
|
||||
1819 | Error | Windows Defender Advanced Threat Protection CSP: Failed to Set Node's Value. NodeId: (%1), TokenName: (%2), Result: (%3). | Download the [Cumulative Update for Windows 10, 1607](https://go.microsoft.com/fwlink/?linkid=829760).
|
||||
|
||||
## Troubleshoot onboarding issues on the machine
|
||||
If the deployment tools used does not indicate an error in the onboarding process, but machines are still not appearing in the machines list in an hour, go through the following verification topics to check if an error occurred with the Windows Defender ATP agent:
|
||||
- [View agent onboarding errors in the machine event log](#view-agent-onboarding-errors-in-the-endpoint-event-log)
|
||||
- [Ensure the diagnostic data service is enabled](#ensure-the-diagnostics-service-is-enabled)
|
||||
- [Ensure the service is set to start](#ensure-the-service-is-set-to-start)
|
||||
- [Ensure the machine has an Internet connection](#ensure-the-endpoint-has-an-internet-connection)
|
||||
- [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)
|
||||
|
||||
|
||||
### View agent onboarding errors in the machine event log
|
||||
|
||||
1. Click **Start**, type **Event Viewer**, and press **Enter**.
|
||||
|
||||
2. In the **Event Viewer (Local)** pane, expand **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE**.
|
||||
|
||||
> [!NOTE]
|
||||
> SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP.
|
||||
|
||||
3. Select **Operational** to load the log.
|
||||
|
||||
4. In the **Action** pane, click **Filter Current log**.
|
||||
|
||||
5. On the **Filter** tab, under **Event level:** select **Critical**, **Warning**, and **Error**, and click **OK**.
|
||||
|
||||
|
||||
|
||||
6. Events which can indicate issues will appear in the **Operational** pane. You can attempt to troubleshoot them based on the solutions in the following table:
|
||||
|
||||
Event ID | Message | Resolution steps
|
||||
:---|:---|:---
|
||||
5 | Windows Defender Advanced Threat Protection service failed to connect to the server at _variable_ | [Ensure the machine has Internet access](#ensure-the-endpoint-has-an-internet-connection).
|
||||
6 | Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. Failure code: _variable_ | [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md).
|
||||
7 | Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Ensure the machine has Internet access](#ensure-the-endpoint-has-an-internet-connection), then run the entire onboarding process again.
|
||||
9 | Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: variable | If the event happened during onboarding, reboot and re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). <br><br>If the event happened during offboarding, contact support.
|
||||
10 | Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: variable | If the event happened during onboarding, re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). <br><br>If the problem persists, contact support.
|
||||
15 | Windows Defender Advanced Threat Protection cannot start command channel with URL: _variable_ | [Ensure the machine has Internet access](#ensure-the-endpoint-has-an-internet-connection).
|
||||
17 | Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: variable | [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). If the problem persists, contact support.
|
||||
25 | Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: _variable_ | Contact support.
|
||||
27 | Failed to enable Windows Defender Advanced Threat Protection mode in Windows Defender. Onboarding process failed. Failure code: variable | Contact support.
|
||||
29 | Failed to read the offboarding parameters. Error type: %1, Error code: %2, Description: %3 | Ensure the machine has Internet access, then run the entire offboarding process again.
|
||||
30 | Failed to disable $(build.sense.productDisplayName) mode in Windows Defender Advanced Threat Protection. Failure code: %1 | Contact support.
|
||||
32 | $(build.sense.productDisplayName) service failed to request to stop itself after offboarding process. Failure code: %1 | Verify that the service start type is manual and reboot the machine.
|
||||
55 | Failed to create the Secure ETW autologger. Failure code: %1 | Reboot the machine.
|
||||
63 | Updating the start type of external service. Name: %1, actual start type: %2, expected start type: %3, exit code: %4 | Identify what is causing changes in start type of mentioned service. If the exit code is not 0, fix the start type manually to expected start type.
|
||||
64 | Starting stopped external service. Name: %1, exit code: %2 | Contact support if the event keeps re-appearing.
|
||||
68 | The start type of the service is unexpected. Service name: %1, actual start type: %2, expected start type: %3 | Identify what is causing changes in start type. Fix mentioned service start type.
|
||||
69 | The service is stopped. Service name: %1 | Start the mentioned service. Contact support if persists.
|
||||
|
||||
<br>
|
||||
There are additional components on the machine that the Windows Defender ATP agent depends on to function properly. If there are no onboarding related errors in the Windows Defender ATP agent event log, proceed with the following steps to ensure that the additional components are configured correctly.
|
||||
|
||||
<span id="ensure-the-diagnostics-service-is-enabled" />
|
||||
### Ensure the diagnostic data service is enabled
|
||||
If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the machine. The service might have been disabled by other programs or user configuration changes.
|
||||
|
||||
First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't).
|
||||
|
||||
### Ensure the service is set to start
|
||||
|
||||
**Use the command line to check the Windows 10 diagnostic data service startup type**:
|
||||
|
||||
1. Open an elevated command-line prompt on the machine:
|
||||
|
||||
a. Click **Start**, type **cmd**, and press **Enter**.
|
||||
|
||||
b. Right-click **Command prompt** and select **Run as administrator**.
|
||||
|
||||
2. Enter the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc qc diagtrack
|
||||
```
|
||||
|
||||
If the service is enabled, then the result should look like the following screenshot:
|
||||
|
||||
|
||||
|
||||
If the `START_TYPE` is not set to `AUTO_START`, then you'll need to set the service to automatically start.
|
||||
|
||||
|
||||
**Use the command line to set the Windows 10 diagnostic data service to automatically start:**
|
||||
|
||||
1. Open an elevated command-line prompt on the machine:
|
||||
|
||||
a. Click **Start**, type **cmd**, and press **Enter**.
|
||||
|
||||
b. Right-click **Command prompt** and select **Run as administrator**.
|
||||
|
||||
2. Enter the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc config diagtrack start=auto
|
||||
```
|
||||
|
||||
3. A success message is displayed. Verify the change by entering the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc qc diagtrack
|
||||
```
|
||||
|
||||
4. Start the service.
|
||||
|
||||
a. In the command prompt, type the following command and press **Enter**:
|
||||
|
||||
```text
|
||||
sc start diagtrack
|
||||
```
|
||||
|
||||
### Ensure the machine has an Internet connection
|
||||
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
|
||||
WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment.
|
||||
|
||||
To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls) topic.
|
||||
|
||||
If the verification fails and your environment is using a proxy to connect to the Internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic.
|
||||
|
||||
### Ensure that Windows Defender Antivirus is not disabled by a policy
|
||||
**Problem**: The Windows Defender ATP service does not start after onboarding.
|
||||
|
||||
**Symptom**: Onboarding successfully completes, but you see error 577 when trying to start the service.
|
||||
|
||||
**Solution**: If your machines are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. You must ensure that it's not disabled in system policy.
|
||||
|
||||
- Depending on the tool that you use to implement policies, you'll need to verify that the following Windows Defender policies are cleared:
|
||||
|
||||
- DisableAntiSpyware
|
||||
- DisableAntiVirus
|
||||
|
||||
For example, in Group Policy there should be no entries such as the following values:
|
||||
|
||||
- ```<Key Path="SOFTWARE\Policies\Microsoft\Windows Defender"><KeyValue Value="0" ValueKind="DWord" Name="DisableAntiSpyware"/></Key>```
|
||||
- ```<Key Path="SOFTWARE\Policies\Microsoft\Windows Defender"><KeyValue Value="0" ValueKind="DWord" Name="DisableAntiVirus"/></Key>```
|
||||
- After clearing the policy, run the onboarding steps again.
|
||||
|
||||
- You can also check the following registry key values to verify that the policy is disabled:
|
||||
|
||||
1. Open the registry ```key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender```.
|
||||
2. Ensure that the value ```DisableAntiSpyware``` is not present.
|
||||
|
||||
|
||||
|
||||
|
||||
## Troubleshoot onboarding issues on a server
|
||||
If you encounter issues while onboarding a server, go through the following verification steps to address possible issues.
|
||||
|
||||
- [Ensure Microsoft Monitoring Agent (MMA) is installed and configured to report sensor data to the service](configure-server-endpoints-windows-defender-advanced-threat-protection.md#server-mma)
|
||||
- [Ensure that the server proxy and Internet connectivity settings are configured properly](configure-server-endpoints-windows-defender-advanced-threat-protection.md#server-proxy)
|
||||
|
||||
You might also need to check the following:
|
||||
- Check that there is a Windows Defender Advanced Threat Protection Service running in the **Processes** tab in **Task Manager**. For example:
|
||||
|
||||
|
||||
|
||||
- Check **Event Viewer** > **Applications and Services Logs** > **Operation Manager** to see if there are any errors.
|
||||
|
||||
- In **Services**, check if the **Microsoft Monitoring Agent** is running on the server. For example,
|
||||
|
||||
|
||||
|
||||
- In **Microsoft Monitoring Agent** > **Azure Log Analytics (OMS)**, check the Workspaces and verify that the status is running.
|
||||
|
||||
|
||||
|
||||
- Check to see that machines are reflected in the **Machines list** in the portal.
|
||||
|
||||
|
||||
## Licensing requirements
|
||||
Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers:
|
||||
|
||||
- Windows 10 Enterprise E5
|
||||
- Windows 10 Education E5
|
||||
- Microsoft 365 Enterprise E5 which includes Windows 10 Enterprise E5
|
||||
|
||||
For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx#tab=2).
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootonboarding-belowfoldlink)
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure machine proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
---
|
||||
title: Troubleshoot Windows Defender ATP onboarding issues
|
||||
description: Troubleshoot issues that might arise during the onboarding of machines or to the Windows Defender ATP service.
|
||||
keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds, sensor data and diagnostics
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: troubleshooting
|
||||
---
|
||||
|
||||
# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
|
||||
You might need to troubleshoot the Windows Defender ATP onboarding process if you encounter issues.
|
||||
This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the machines.
|
||||
|
||||
If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, it might indicate an onboarding or connectivity problem.
|
||||
|
||||
## Troubleshoot onboarding when deploying with Group Policy
|
||||
Deployment with Group Policy is done by running the onboarding script on the machines. The Group Policy console does not indicate if the deployment has succeeded or not.
|
||||
|
||||
If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, you can check the output of the script on the machines. For more information, see [Troubleshoot onboarding when deploying with a script](#troubleshoot-onboarding-when-deploying-with-a-script).
|
||||
|
||||
If the script completes successfully, see [Troubleshoot onboarding issues on the machines](#troubleshoot-onboarding-issues-on-the-machine) for additional errors that might occur.
|
||||
|
||||
## Troubleshoot onboarding issues when deploying with System Center Configuration Manager
|
||||
When onboarding machines using the following versions of System Center Configuration Manager:
|
||||
- System Center 2012 Configuration Manager
|
||||
- System Center 2012 R2 Configuration Manager
|
||||
- System Center Configuration Manager (current branch) version 1511
|
||||
- System Center Configuration Manager (current branch) version 1602
|
||||
|
||||
|
||||
Deployment with the above-mentioned versions of System Center Configuration Manager is done by running the onboarding script on the machines. You can track the deployment in the Configuration Manager Console.
|
||||
|
||||
If the deployment fails, you can check the output of the script on the machines.
|
||||
|
||||
If the onboarding completed successfully but the machines are not showing up in the **Machines list** after an hour, see [Troubleshoot onboarding issues on the machine](#troubleshoot-onboarding-issues-on-the-machine) for additional errors that might occur.
|
||||
|
||||
## Troubleshoot onboarding when deploying with a script
|
||||
|
||||
**Check the result of the script on the machine**:
|
||||
1. Click **Start**, type **Event Viewer**, and press **Enter**.
|
||||
|
||||
2. Go to **Windows Logs** > **Application**.
|
||||
|
||||
3. Look for an event from **WDATPOnboarding** event source.
|
||||
|
||||
If the script fails and the event is an error, you can check the event ID in the following table to help you troubleshoot the issue.
|
||||
> [!NOTE]
|
||||
> The following event IDs are specific to the onboarding script only.
|
||||
|
||||
Event ID | Error Type | Resolution steps
|
||||
:---|:---|:---
|
||||
5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.
|
||||
10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically<br> ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```.<br>Verify that the script was ran as an administrator.
|
||||
15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). <br> <br> If the machine is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again.
|
||||
15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
|
||||
30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location<br>```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```.<br>The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
65 | Insufficient privileges| Run the script again with administrator privileges.
|
||||
|
||||
## Troubleshoot onboarding issues using Microsoft Intune
|
||||
You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue.
|
||||
|
||||
If you have configured policies in Intune and they are not propagated on machines, you might need to configure automatic MDM enrollment.
|
||||
|
||||
Use the following tables to understand the possible causes of issues while onboarding:
|
||||
|
||||
- Microsoft Intune error codes and OMA-URIs table
|
||||
- Known issues with non-compliance table
|
||||
- Mobile Device Management (MDM) event logs table
|
||||
|
||||
If none of the event logs and troubleshooting steps work, download the Local script from the **Machine management** section of the portal, and run it in an elevated command prompt.
|
||||
|
||||
**Microsoft Intune error codes and OMA-URIs**:
|
||||
|
||||
|
||||
Error Code Hex | Error Code Dec | Error Description | OMA-URI | Possible cause and troubleshooting steps
|
||||
:---|:---|:---|:---|:---
|
||||
0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding <br> Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields. <br><br> **Troubleshooting steps:** <br> Check the event IDs in the [View agent onboarding errors in the machine event log](#view-agent-onboarding-errors-in-the-machine-event-log) section. <br><br> Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx).
|
||||
| | | | Onboarding <br> Offboarding <br> SampleSharing | **Possible cause:** Windows Defender ATP Policy registry key does not exist or the OMA DM client doesn't have permissions to write to it. <br><br> **Troubleshooting steps:** Ensure that the following registry key exists: ```HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection``` <br> <br> If it doesn't exist, open an elevated command and add the key.
|
||||
| | | | SenseIsRunning <br> OnboardingState <br> OrgId | **Possible cause:** An attempt to remediate by read-only property. Onboarding has failed. <br><br> **Troubleshooting steps:** Check the troubleshooting steps in [Troubleshoot onboarding issues on the machine](#troubleshoot-onboarding-issues-on-the-machine). <br><br> Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx).
|
||||
|| | | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU. <br><br> Currently is supported platforms: Enterprise, Education, and Professional. <br> Server is not supported.
|
||||
0x87D101A9 | -2016345687 |Syncml(425): The requested command failed because the sender does not have adequate access control permissions (ACL) on the recipient. | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU. <br><br> Currently is supported platforms: Enterprise, Education, and Professional.
|
||||
|
||||
<br>
|
||||
**Known issues with non-compliance**
|
||||
|
||||
The following table provides information on issues with non-compliance and how you can address the issues.
|
||||
|
||||
Case | Symptoms | Possible cause and troubleshooting steps
|
||||
:---|:---|:---
|
||||
1 | Machine is compliant by SenseIsRunning OMA-URI. But is non-compliant by OrgId, Onboarding and OnboardingState OMA-URIs. | **Possible cause:** Check that user passed OOBE after Windows installation or upgrade. During OOBE onboarding couldn't be completed but SENSE is running already. <br><br> **Troubleshooting steps:** Wait for OOBE to complete.
|
||||
2 | Machine is compliant by OrgId, Onboarding, and OnboardingState OMA-URIs, but is non-compliant by SenseIsRunning OMA-URI. | **Possible cause:** Sense service's startup type is set as "Delayed Start". Sometimes this causes the Microsoft Intune server to report the machine as non-compliant by SenseIsRunning when DM session occurs on system start. <br><br> **Troubleshooting steps:** The issue should automatically be fixed within 24 hours.
|
||||
3 | Machine is non-compliant | **Troubleshooting steps:** Ensure that Onboarding and Offboarding policies are not deployed on the same machine at same time.
|
||||
|
||||
<br>
|
||||
**Mobile Device Management (MDM) event logs**
|
||||
|
||||
View the MDM event logs to troubleshoot issues that might arise during onboarding:
|
||||
|
||||
Log name: Microsoft\Windows\DeviceManagement-EnterpriseDiagnostics-Provider
|
||||
|
||||
Channel name: Admin
|
||||
|
||||
ID | Severity | Event description | Troubleshooting steps
|
||||
:---|:---|:---|:---
|
||||
1819 | Error | Windows Defender Advanced Threat Protection CSP: Failed to Set Node's Value. NodeId: (%1), TokenName: (%2), Result: (%3). | Download the [Cumulative Update for Windows 10, 1607](https://go.microsoft.com/fwlink/?linkid=829760).
|
||||
|
||||
## Troubleshoot onboarding issues on the machine
|
||||
If the deployment tools used does not indicate an error in the onboarding process, but machines are still not appearing in the machines list in an hour, go through the following verification topics to check if an error occurred with the Windows Defender ATP agent:
|
||||
- [View agent onboarding errors in the machine event log](#view-agent-onboarding-errors-in-the-machine-event-log)
|
||||
- [Ensure the diagnostic data service is enabled](#ensure-the-diagnostics-service-is-enabled)
|
||||
- [Ensure the service is set to start](#ensure-the-service-is-set-to-start)
|
||||
- [Ensure the machine has an Internet connection](#ensure-the-machine-has-an-internet-connection)
|
||||
- [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)
|
||||
|
||||
|
||||
### View agent onboarding errors in the machine event log
|
||||
|
||||
1. Click **Start**, type **Event Viewer**, and press **Enter**.
|
||||
|
||||
2. In the **Event Viewer (Local)** pane, expand **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE**.
|
||||
|
||||
> [!NOTE]
|
||||
> SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP.
|
||||
|
||||
3. Select **Operational** to load the log.
|
||||
|
||||
4. In the **Action** pane, click **Filter Current log**.
|
||||
|
||||
5. On the **Filter** tab, under **Event level:** select **Critical**, **Warning**, and **Error**, and click **OK**.
|
||||
|
||||
|
||||
|
||||
6. Events which can indicate issues will appear in the **Operational** pane. You can attempt to troubleshoot them based on the solutions in the following table:
|
||||
|
||||
Event ID | Message | Resolution steps
|
||||
:---|:---|:---
|
||||
5 | Windows Defender Advanced Threat Protection service failed to connect to the server at _variable_ | [Ensure the machine has Internet access](#ensure-the-machine-has-an-internet-connection).
|
||||
6 | Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. Failure code: _variable_ | [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md).
|
||||
7 | Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Ensure the machine has Internet access](#ensure-the-machine-has-an-internet-connection), then run the entire onboarding process again.
|
||||
9 | Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: variable | If the event happened during onboarding, reboot and re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). <br><br>If the event happened during offboarding, contact support.
|
||||
10 | Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: variable | If the event happened during onboarding, re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). <br><br>If the problem persists, contact support.
|
||||
15 | Windows Defender Advanced Threat Protection cannot start command channel with URL: _variable_ | [Ensure the machine has Internet access](#ensure-the-machine-has-an-internet-connection).
|
||||
17 | Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: variable | [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). If the problem persists, contact support.
|
||||
25 | Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: _variable_ | Contact support.
|
||||
27 | Failed to enable Windows Defender Advanced Threat Protection mode in Windows Defender. Onboarding process failed. Failure code: variable | Contact support.
|
||||
29 | Failed to read the offboarding parameters. Error type: %1, Error code: %2, Description: %3 | Ensure the machine has Internet access, then run the entire offboarding process again.
|
||||
30 | Failed to disable $(build.sense.productDisplayName) mode in Windows Defender Advanced Threat Protection. Failure code: %1 | Contact support.
|
||||
32 | $(build.sense.productDisplayName) service failed to request to stop itself after offboarding process. Failure code: %1 | Verify that the service start type is manual and reboot the machine.
|
||||
55 | Failed to create the Secure ETW autologger. Failure code: %1 | Reboot the machine.
|
||||
63 | Updating the start type of external service. Name: %1, actual start type: %2, expected start type: %3, exit code: %4 | Identify what is causing changes in start type of mentioned service. If the exit code is not 0, fix the start type manually to expected start type.
|
||||
64 | Starting stopped external service. Name: %1, exit code: %2 | Contact support if the event keeps re-appearing.
|
||||
68 | The start type of the service is unexpected. Service name: %1, actual start type: %2, expected start type: %3 | Identify what is causing changes in start type. Fix mentioned service start type.
|
||||
69 | The service is stopped. Service name: %1 | Start the mentioned service. Contact support if persists.
|
||||
|
||||
<br>
|
||||
There are additional components on the machine that the Windows Defender ATP agent depends on to function properly. If there are no onboarding related errors in the Windows Defender ATP agent event log, proceed with the following steps to ensure that the additional components are configured correctly.
|
||||
|
||||
<span id="ensure-the-diagnostics-service-is-enabled" />
|
||||
### Ensure the diagnostic data service is enabled
|
||||
If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the machine. The service might have been disabled by other programs or user configuration changes.
|
||||
|
||||
First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't).
|
||||
|
||||
### Ensure the service is set to start
|
||||
|
||||
**Use the command line to check the Windows 10 diagnostic data service startup type**:
|
||||
|
||||
1. Open an elevated command-line prompt on the machine:
|
||||
|
||||
a. Click **Start**, type **cmd**, and press **Enter**.
|
||||
|
||||
b. Right-click **Command prompt** and select **Run as administrator**.
|
||||
|
||||
2. Enter the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc qc diagtrack
|
||||
```
|
||||
|
||||
If the service is enabled, then the result should look like the following screenshot:
|
||||
|
||||
|
||||
|
||||
If the `START_TYPE` is not set to `AUTO_START`, then you'll need to set the service to automatically start.
|
||||
|
||||
|
||||
**Use the command line to set the Windows 10 diagnostic data service to automatically start:**
|
||||
|
||||
1. Open an elevated command-line prompt on the machine:
|
||||
|
||||
a. Click **Start**, type **cmd**, and press **Enter**.
|
||||
|
||||
b. Right-click **Command prompt** and select **Run as administrator**.
|
||||
|
||||
2. Enter the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc config diagtrack start=auto
|
||||
```
|
||||
|
||||
3. A success message is displayed. Verify the change by entering the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc qc diagtrack
|
||||
```
|
||||
|
||||
4. Start the service.
|
||||
|
||||
a. In the command prompt, type the following command and press **Enter**:
|
||||
|
||||
```text
|
||||
sc start diagtrack
|
||||
```
|
||||
|
||||
### Ensure the machine has an Internet connection
|
||||
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
|
||||
WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment.
|
||||
|
||||
To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls) topic.
|
||||
|
||||
If the verification fails and your environment is using a proxy to connect to the Internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic.
|
||||
|
||||
### Ensure that Windows Defender Antivirus is not disabled by a policy
|
||||
**Problem**: The Windows Defender ATP service does not start after onboarding.
|
||||
|
||||
**Symptom**: Onboarding successfully completes, but you see error 577 when trying to start the service.
|
||||
|
||||
**Solution**: If your machines are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. You must ensure that it's not disabled in system policy.
|
||||
|
||||
- Depending on the tool that you use to implement policies, you'll need to verify that the following Windows Defender policies are cleared:
|
||||
|
||||
- DisableAntiSpyware
|
||||
- DisableAntiVirus
|
||||
|
||||
For example, in Group Policy there should be no entries such as the following values:
|
||||
|
||||
- ```<Key Path="SOFTWARE\Policies\Microsoft\Windows Defender"><KeyValue Value="0" ValueKind="DWord" Name="DisableAntiSpyware"/></Key>```
|
||||
- ```<Key Path="SOFTWARE\Policies\Microsoft\Windows Defender"><KeyValue Value="0" ValueKind="DWord" Name="DisableAntiVirus"/></Key>```
|
||||
- After clearing the policy, run the onboarding steps again.
|
||||
|
||||
- You can also check the following registry key values to verify that the policy is disabled:
|
||||
|
||||
1. Open the registry ```key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender```.
|
||||
2. Ensure that the value ```DisableAntiSpyware``` is not present.
|
||||
|
||||
|
||||
|
||||
|
||||
## Troubleshoot onboarding issues on a server
|
||||
If you encounter issues while onboarding a server, go through the following verification steps to address possible issues.
|
||||
|
||||
- [Ensure Microsoft Monitoring Agent (MMA) is installed and configured to report sensor data to the service](configure-server-endpoints-windows-defender-advanced-threat-protection.md#server-mma)
|
||||
- [Ensure that the server proxy and Internet connectivity settings are configured properly](configure-server-endpoints-windows-defender-advanced-threat-protection.md#server-proxy)
|
||||
|
||||
You might also need to check the following:
|
||||
- Check that there is a Windows Defender Advanced Threat Protection Service running in the **Processes** tab in **Task Manager**. For example:
|
||||
|
||||
|
||||
|
||||
- Check **Event Viewer** > **Applications and Services Logs** > **Operation Manager** to see if there are any errors.
|
||||
|
||||
- In **Services**, check if the **Microsoft Monitoring Agent** is running on the server. For example,
|
||||
|
||||
|
||||
|
||||
- In **Microsoft Monitoring Agent** > **Azure Log Analytics (OMS)**, check the Workspaces and verify that the status is running.
|
||||
|
||||
|
||||
|
||||
- Check to see that machines are reflected in the **Machines list** in the portal.
|
||||
|
||||
|
||||
## Licensing requirements
|
||||
Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers:
|
||||
|
||||
- Windows 10 Enterprise E5
|
||||
- Windows 10 Education E5
|
||||
- Microsoft 365 Enterprise E5 which includes Windows 10 Enterprise E5
|
||||
|
||||
For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx#tab=2).
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootonboarding-belowfoldlink)
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure machine proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
@ -11,6 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/26/2018
|
||||
---
|
||||
|
||||
# Reduce attack surfaces with attack surface reduction rules
|
||||
@ -235,6 +236,16 @@ SCCM name: Not applicable
|
||||
|
||||
GUID: 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
|
||||
|
||||
## Review attack surface reduction events in Windows Event Viewer
|
||||
|
||||
You can review the Windows event log to see events that are created when attack surface rules block (or audit) an app:
|
||||
|
||||
Event ID | Description
|
||||
5007 | Event when settings are changed
|
||||
1121 | Event when an attack surface reduction rule fires in audit mode
|
||||
1122 | Event when an attack surface reduction rule fires in block mode
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Enable attack surface reduction rules](enable-attack-surface-reduction.md)
|
||||
|
||||
@ -40,10 +40,10 @@ You can use Group Policy, PowerShell, and configuration service providers (CSPs)
|
||||
|
||||
Audit options | How to enable audit mode | How to view events
|
||||
- | - | -
|
||||
Audit applies to all events | [Enable controlled folder access](enable-controlled-folders-exploit-guard.md#enable-and-audit-controlled-folder-access) | [Controlled folder access events](controlled-folders-exploit-guard.md#review-controlled-folder-access-events-in-windows-event-viewer)
|
||||
Audit applies to individual rules | [Enable attack surface reduction rules](enable-attack-surface-reduction.md) | [Attack surface reduction rule events](attack-surface-reduction-exploit-guard.md)
|
||||
Audit applies to all events | [Enable network protection](enable-network-protection.md#enable-and-audit-network-protection) | [Network protection events](network-protection-exploit-guard.md#review-network-protection-events-in-windows-event-viewer)
|
||||
Audit applies to individual mitigations | [Enable exploit protection](enable-exploit-protection.md#enable-and-audit-exploit-protection) | [Exploit protection events](exploit-protection-exploit-guard.md#review-exploit-protection-events-in-windows-event-viewer)
|
||||
Audit applies to all events | [Enable controlled folder access](enable-controlled-folders-exploit-guard.md) | [Controlled folder access events](evaluate-controlled-folder-access.md#review-controlled-folder-access-events-in-windows-event-viewer)
|
||||
Audit applies to individual rules | [Enable attack surface reduction rules](enable-attack-surface-reduction.md) | [Attack surface reduction rule events](attack-surface-reduction-exploit-guard.md#review-attack-surface-reduction-events-in-windows-event-viewer)
|
||||
Audit applies to all events | [Enable network protection](enable-network-protection.md) | [Network protection events](evaluate-network-protection.md#review-network-protection-events-in-windows-event-viewer)
|
||||
Audit applies to individual mitigations | [Enable exploit protection](enable-exploit-protection.md) | [Exploit protection events](exploit-protection-exploit-guard.md#review-exploit-protection-events-in-windows-event-viewer)
|
||||
|
||||
|
||||
You can also use the a custom PowerShell script that enables the features in audit mode automatically:
|
||||
|
||||
@ -42,13 +42,13 @@ Before attempting this process, ensure you have met all required pre-requisites
|
||||
|
||||
2. Navigate to the Windows Defender directory. By default, this is C:\Program Files\Windows Defender, as in the following example:
|
||||
|
||||
```Dos
|
||||
```console
|
||||
cd c:\program files\windows defender
|
||||
```
|
||||
|
||||
3. Enter the following command and press **Enter**
|
||||
|
||||
```Dos
|
||||
```console
|
||||
mpcmdrun -getfiles
|
||||
```
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 11/16/2018
|
||||
ms.date: 03/26/2019
|
||||
---
|
||||
|
||||
# Customize exploit protection
|
||||
@ -106,7 +106,7 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi
|
||||
|
||||
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**.
|
||||
|
||||
3. Under the **System settings** section, find the mitigation you want to configure and select one of the following. Apps that aren't configured individually in the **Program settings** section will use the settings configured here:
|
||||
3. Under the **System settings** section, find the mitigation you want to configure and select one of the following. Apps that aren't configured individually in the **Program settings** section will use the settings configured here:
|
||||
- **On by default** - The mitigation is *enabled* for apps that don't have this mitigation set in the app-specific **Program settings** section
|
||||
- **Off by default** - The mitigation is *disabled* for apps that don't have this mitigation set in the app-specific **Program settings** section
|
||||
- **Use default** - The mitigation is either enabled or disabled, depending on the default configuration that is set up by Windows 10 installation; the default value (**On** or **Off**) is always specified next to the **Use default** label for each mitigation
|
||||
@ -114,32 +114,23 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi
|
||||
>[!NOTE]
|
||||
>You may see a User Account Control window when changing some settings. Enter administrator credentials to apply the setting.
|
||||
|
||||
Changing some settings may required a restart, which will be indicated in red text underneath the setting.
|
||||
Changing some settings may require a restart.
|
||||
|
||||
4. Repeat this for all the system-level mitigations you want to configure.
|
||||
|
||||
You can now [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) or continue on to configure app-specific mitigations.
|
||||
3. Go to the **Program settings** section and choose the app you want to apply mitigations to:
|
||||
|
||||
Exporting the configuration as an XML file allows you to copy the configuration from one machine onto other machines.
|
||||
|
||||
### Configure app-specific mitigations with the Windows Security app
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection settings** at the bottom of the screen.
|
||||
|
||||
3. Go to the **Program settings** section and choose the app you want to apply mitigations to:
|
||||
|
||||
1. If the app you want to configure is already listed, click it and then click **Edit**
|
||||
2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app:
|
||||
1. If the app you want to configure is already listed, click it and then click **Edit**
|
||||
2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app:
|
||||
- Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
|
||||
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
|
||||
|
||||
4. After selecting the app, you'll see a list of all the mitigations that can be applied. To enable the mitigation, click the check box and then change the slider to **On**. Select any additional options. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows.
|
||||
|
||||
5. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration.
|
||||
|
||||
You can now [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) or return to configure system-level mitigations.
|
||||
|
||||
|
||||
You can now [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) or continue on to configure app-specific mitigations.
|
||||
|
||||
Exporting the configuration as an XML file allows you to copy the configuration from one machine onto other machines.
|
||||
|
||||
@ -165,7 +156,7 @@ Get-ProcessMitigation -Name processName.exe
|
||||
>
|
||||
>For app-level settings, `NOTSET` indicates the system-level setting for the mitigation will be applied.
|
||||
>
|
||||
>The default setting for each system-level mitigation can be seen in the Windows Security, as described in the [Configure system-level mitigations with the Windows Security app section above](#configure-system-level-mitigations-with-the-windows-defender-security-center-app).
|
||||
>The default setting for each system-level mitigation can be seen in the Windows Security.
|
||||
|
||||
Use `Set` to configure each mitigation in the following format:
|
||||
|
||||
|
||||
@ -38,13 +38,13 @@ You can enable controlled folder access with the Security Center app, Group Poli
|
||||
>- System Center Endpoint Protection **Allow users to add exclusions and overrides**
|
||||
>For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged).
|
||||
|
||||
### Use the Windows Defender Security app to enable controlled folder access
|
||||
## Windows Security app to enable controlled folder access
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then click **Ransomware protection**.
|
||||
|
||||
3. Set the switch for **Controlled folder access** to **On**.
|
||||
3. Set the switch for **Controlled folder access** to **On**.
|
||||
|
||||
|
||||
### Use Group Policy to enable Controlled folder access
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 02/14/2019
|
||||
ms.date: 03/26/2019
|
||||
---
|
||||
|
||||
# Enable exploit protection
|
||||
@ -24,23 +24,192 @@ ms.date: 02/14/2019
|
||||
|
||||
Many features from the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection.
|
||||
|
||||
## Enable and audit exploit protection
|
||||
You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Audit mode allows you to test how the mitigations would work (and review events) without impacting the normal use of the machine.
|
||||
|
||||
## Enable exploit protection
|
||||
|
||||
You enable and configure each exploit protection mitigation separately either by using the Windows Security app or PowerShell.
|
||||
They are configured by default in Windows 10.
|
||||
|
||||
You can set each mitigation to on, off, or to its default value.
|
||||
Some mitigations have additional options.
|
||||
|
||||
You can [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) and deploy it to other machines by using Group Policy.
|
||||
|
||||
### Windows Security app
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**.
|
||||
|
||||
3. Go to **Program settings** and choose the app you want to apply mitigations to:
|
||||
|
||||
1. If the app you want to configure is already listed, click it and then click **Edit**
|
||||
2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app:
|
||||
- Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
|
||||
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
|
||||
|
||||
4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows.
|
||||
|
||||
5. Repeat this for all the apps and mitigations you want to configure.
|
||||
|
||||
3. Under the **System settings** section, find the mitigation you want to configure and select one of the following. Apps that aren't configured individually in the **Program settings** section will use the settings configured here:
|
||||
- **On by default** - The mitigation is *enabled* for apps that don't have this mitigation set in the app-specific **Program settings** section
|
||||
- **Off by default** - The mitigation is *disabled* for apps that don't have this mitigation set in the app-specific **Program settings** section
|
||||
- **Use default** - The mitigation is either enabled or disabled, depending on the default configuration that is set up by Windows 10 installation; the default value (**On** or **Off**) is always specified next to the **Use default** label for each mitigation
|
||||
|
||||
5. Repeat this for all the system-level mitigations you want to configure. Click **Apply** when you're done setting up your configuration.
|
||||
|
||||
If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work:
|
||||
|
||||
Enabled in **Program settings** | Enabled in **System settings** | Behavior
|
||||
:-: | :-: | :-:
|
||||
[!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | As defined in **Program settings**
|
||||
[!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | As defined in **Program settings**
|
||||
[!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | As defined in **System settings**
|
||||
[!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | Default as defined in **Use default** option
|
||||
|
||||
**Example 1**
|
||||
|
||||
Mikael configures **Data Execution Prevention (DEP)** in the **System settings** section to be **Off by default**.
|
||||
|
||||
Mikael then adds the app *test.exe* to the **Program settings** section. In the options for that app, under **Data Execution Prevention (DEP)**, he enables the **Override system settings** option and sets the switch to **On**. There are no other apps listed in the **Program settings** section.
|
||||
|
||||
The result will be that DEP only will be enabled for *test.exe*. All other apps will not have DEP applied.
|
||||
|
||||
**Example 2**
|
||||
|
||||
Josie configures **Data Execution Prevention (DEP)** in the **System settings** section to be **Off by default**.
|
||||
|
||||
Josie then adds the app *test.exe* to the **Program settings** section. In the options for that app, under **Data Execution Prevention (DEP)**, she enables the **Override system settings** option and sets the switch to **On**.
|
||||
|
||||
Josie also adds the app *miles.exe* to the **Program settings** section and configures **Control flow guard (CFG)** to **On**. She doesn't enable the **Override system settings** option for DEP or any other mitigations for that app.
|
||||
|
||||
The result will be that DEP will be enabled for *test.exe*. DEP will not be enabled for any other app, including *miles.exe*.
|
||||
CFG will be enabled for *miles.exe*.
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**.
|
||||
|
||||
3. Go to **Program settings** and choose the app you want to apply mitigations to:
|
||||
|
||||
1. If the app you want to configure is already listed, click it and then click **Edit**
|
||||
2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app:
|
||||
- Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
|
||||
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
|
||||
|
||||
4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows.
|
||||
|
||||
5. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration.
|
||||
|
||||
|
||||
|
||||
### PowerShell
|
||||
|
||||
You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app:
|
||||
|
||||
```PowerShell
|
||||
Get-ProcessMitigation -Name processName.exe
|
||||
```
|
||||
|
||||
>[!IMPORTANT]
|
||||
>System-level mitigations that have not been configured will show a status of `NOTSET`.
|
||||
>
|
||||
>For system-level settings, `NOTSET` indicates the default setting for that mitigation has been applied.
|
||||
>
|
||||
>For app-level settings, `NOTSET` indicates the system-level setting for the mitigation will be applied.
|
||||
>
|
||||
>The default setting for each system-level mitigation can be seen in the Windows Security.
|
||||
|
||||
Use `Set` to configure each mitigation in the following format:
|
||||
|
||||
```PowerShell
|
||||
Set-ProcessMitigation -<scope> <app executable> -<action> <mitigation or options>,<mitigation or options>,<mitigation or options>
|
||||
```
|
||||
Where:
|
||||
|
||||
- \<Scope>:
|
||||
- `-Name` to indicate the mitigations should be applied to a specific app. Specify the app's executable after this flag.
|
||||
- `-System` to indicate the mitigation should be applied at the system level
|
||||
- \<Action>:
|
||||
- `-Enable` to enable the mitigation
|
||||
- `-Disable` to disable the mitigation
|
||||
- \<Mitigation>:
|
||||
- The mitigation's cmdlet along with any suboptions (surrounded with spaces). Each mitigation is separated with a comma.
|
||||
|
||||
For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called *testing.exe* in the folder *C:\Apps\LOB\tests*, and to prevent that executable from creating child processes, you'd use the following command:
|
||||
|
||||
```PowerShell
|
||||
Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation
|
||||
```
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Separate each mitigation option with commas.
|
||||
|
||||
If you wanted to apply DEP at the system level, you'd use the following command:
|
||||
|
||||
```PowerShell
|
||||
Set-Processmitigation -System -Enable DEP
|
||||
```
|
||||
|
||||
To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, this will force the mitigation to be disabled only for that app.
|
||||
|
||||
If you need to restore the mitigation back to the system default, you need to include the `-Remove` cmdlet as well, as in the following example:
|
||||
|
||||
```PowerShell
|
||||
Set-Processmitigation -Name test.exe -Remove -Disable DEP
|
||||
```
|
||||
|
||||
This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that can be used to configure each mitigation.
|
||||
|
||||
|
||||
Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet
|
||||
- | - | - | -
|
||||
Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available
|
||||
Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available
|
||||
Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available
|
||||
Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available
|
||||
Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available
|
||||
Validate heap integrity | System and app-level | TerminateOnHeapError | Audit not available
|
||||
Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode
|
||||
Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad
|
||||
Block remote images | App-level only | BlockRemoteImages | Audit not available
|
||||
Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly
|
||||
Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned
|
||||
Disable extension points | App-level only | ExtensionPoint | Audit not available
|
||||
Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall
|
||||
Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess
|
||||
Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter <a href="#r1" id="t1">\[1\]</a> | Audit not available
|
||||
Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available
|
||||
Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available
|
||||
Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available
|
||||
Validate handle usage | App-level only | StrictHandle | Audit not available
|
||||
Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available
|
||||
Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available
|
||||
|
||||
|
||||
|
||||
<a href="#t1" id="r1">\[1\]</a>: Use the following format to enable EAF modules for dlls for a process:
|
||||
|
||||
```PowerShell
|
||||
Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll
|
||||
```
|
||||
|
||||
|
||||
## Customize the notification
|
||||
|
||||
See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file.
|
||||
|
||||
|
||||
|
||||
|
||||
You enable and configure each exploit protection mitigation separately. Some mitigations apply to the entire operating system, while others can be targeted towards specific apps.
|
||||
|
||||
The mitigations available in exploit protection are enabled or configured to their default values automatically in Windows 10. However, you can customize the configuration to suit your organization and then deploy that configuration across your network.
|
||||
|
||||
You can also set mitigations to [audit mode](audit-windows-defender-exploit-guard.md). Audit mode allows you to test how the mitigations would work (and review events) without impacting the normal use of the machine.
|
||||
|
||||
>[!WARNING]
|
||||
>Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using audit mode before deploying in production.
|
||||
|
||||
You can also convert an existing EMET configuration file (in XML format) and import it into exploit protection. This is useful if you have been using EMET and have a customized series of policies and mitigations that you want to keep using.
|
||||
|
||||
See the following topics for instructions on configuring exploit protection mitigations and importing, exporting, and converting configurations:
|
||||
|
||||
1. [Configure the mitigations you want to enable or audit](customize-exploit-protection.md)
|
||||
2. [Export the configuration to an XML file that you can use to deploy the configuration to multiple machines](import-export-exploit-protection-emet-xml.md).
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -48,6 +217,3 @@ See the following topics for instructions on configuring exploit protection miti
|
||||
- [Evaluate exploit protection](evaluate-exploit-protection.md)
|
||||
- [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
|
||||
- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 02/14/2019
|
||||
ms.date: 03/27/2019
|
||||
---
|
||||
|
||||
# Enable network protection
|
||||
@ -20,17 +20,20 @@ ms.date: 02/14/2019
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[Network protection](network-protection-exploit-guard.md) helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
|
||||
[Network protection](network-protection-exploit-guard.md) helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
|
||||
You can [audit network protection](evaluate-network-protection.md) in a test environment to see which apps would be blocked before you enable it.
|
||||
You can enable network protection by using any of the these methods:
|
||||
|
||||
This topic describes how to enable network protection with Group Policy, PowerShell cmdlets, and configuration service providers (CSPs) for mobile device management (MDM).
|
||||
- MDM
|
||||
- Group Policy
|
||||
- PowerShell cmdlets
|
||||
|
||||
## Enable and audit network protection
|
||||
|
||||
You can enable network protection in either audit or block mode with Group Policy, PowerShell, or MDM settings with CSP.
|
||||
## MDM
|
||||
|
||||
For background information on how audit mode works, and when you might want to use it, see the [audit Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md).
|
||||
Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable and configure network protection.
|
||||
|
||||
### Use Group Policy to enable or audit network protection
|
||||
## Group Policy
|
||||
|
||||
1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
@ -47,7 +50,8 @@ For background information on how audit mode works, and when you might want to u
|
||||
>[!IMPORTANT]
|
||||
>To fully enable network protection, you must set the Group Policy option to **Enabled** and also select **Block** in the options drop-down menu.
|
||||
|
||||
### Use PowerShell to enable or audit network protection
|
||||
|
||||
## PowerShell
|
||||
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
|
||||
2. Enter the following cmdlet:
|
||||
@ -65,11 +69,6 @@ Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
Use `Disabled` insead of `AuditMode` or `Enabled` to turn the feature off.
|
||||
|
||||
|
||||
### Use MDM CSPs to enable or audit network protection
|
||||
|
||||
Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable and configure network protection.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Protect your network](network-protection-exploit-guard.md)
|
||||
|
||||
@ -24,6 +24,18 @@ Some applications, including device drivers, may be incompatible with HVCI.
|
||||
This can cause devices or software to malfunction and in rare cases may result in a blue screen. Such issues may occur after HVCI has been turned on or during the enablement process itself.
|
||||
If this happens, see [Troubleshooting](#troubleshooting) for remediation steps.
|
||||
|
||||
>[!NOTE]
|
||||
>HVCI works with modern 7th gen CPUs or higher and its equivalent on AMD. CPU new feature is required *Mode based execution control (MBE) Virtualization*.
|
||||
|
||||
>[!TIP]
|
||||
> "The Secure Kernel relies on the Mode-Based Execution Control (MBEC) feature, if present in hardware, which enhances the SLAT with a user/kernel executable bit, or the hypervisor’s software emulation of this feature, called Restricted User Mode (RUM).". Mark Russinovich and Alex Ionescu. Windows Internals 7th Edition book
|
||||
|
||||
## HVCI Features
|
||||
|
||||
* HVCI protects modification of the Code Flow Guard (CFG) bitmap.
|
||||
* HVCI also ensure your other Truslets, like Credential Guard have a valid certificate.
|
||||
* Modern device drivers must also have an EV (Extended Validation) certificate and should support HVCI.
|
||||
|
||||
## How to turn on HVCI in Windows 10
|
||||
|
||||
To enable HVCI on Windows 10 devices with supporting hardware throughout an enterprise, use any of these options:
|
||||
@ -279,6 +291,6 @@ Set-VMSecurity -VMName <VMName> -VirtualizationBasedSecurityOptOut $true
|
||||
### Requirements for running HVCI in Hyper-V virtual machines
|
||||
- The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607.
|
||||
- The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10.
|
||||
- HVCI and [nested virtualization](https://docs.microsoft.com/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) cannot be enabled at the same time.
|
||||
- HVCI and [virtualization](https://docs.microsoft.com/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time
|
||||
- Virtual Fibre Channel adapters are not compatible with HVCI. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of virtualization-based security using `Set-VMSecurity`.
|
||||
- The AllowFullSCSICommandSet option for pass-through disks is not compatible with HVCI. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of virtualization-based security using `Set-VMSecurity`.
|
||||
|
||||
@ -45,7 +45,14 @@ Set-MpPreference -EnableControlledFolderAccess AuditMode
|
||||
>If you want to fully audit how controlled folder access will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s).
|
||||
You can also use Group Policy, Intune, MDM, or System Center Configuration Manager to configure and deploy the setting, as described in the main [controlled folder access topic](controlled-folders-exploit-guard.md).
|
||||
|
||||
For further details on how audit mode works, and when you might want to use it, see the [audit Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md).
|
||||
## Review controlled folder access events in Windows Event Viewer
|
||||
|
||||
The following controlled folder access events appear in Windows Event Viewer.
|
||||
|
||||
Event ID | Description
|
||||
5007 | Event when settings are changed
|
||||
1124 | Audited controlled folder access event
|
||||
1123 | Blocked controlled folder access event
|
||||
|
||||
## Customize protected folders and apps
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 11/16/2018
|
||||
ms.date: 03/26/2019
|
||||
---
|
||||
|
||||
# Evaluate exploit protection
|
||||
@ -20,26 +20,89 @@ ms.date: 11/16/2018
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Exploit protection applies helps protect devices from malware that use exploits to spread and infect. It consists of a number of mitigations that can be applied at either the operating system level, or at the individual app level.
|
||||
[Exploit protection](exploit-protection-exploit-guard.md) helps protect devices from malware that uses exploits to spread and infect other devices.
|
||||
It consists of a number of mitigations that can be applied to either the operating system or an individual app.
|
||||
Many of the features that were part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) are included in exploit protection.
|
||||
|
||||
Many of the features that are part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) are included in exploit protection.
|
||||
|
||||
This topic helps you evaluate exploit protection. For more information about what exploit protection does and how to configure it for real-world deployment, see [Exploit protection](exploit-protection-exploit-guard.md).
|
||||
This topic helps you enable exploit protection in audit mode and review related events in Event Viewer.
|
||||
You can enable audit mode for certain app-level mitigations to see how they will work in a test environment.
|
||||
This lets you see a record of what *would* have happened if you had enabled the mitigation in production.
|
||||
You can make sure it doesn't affect your line-of-business apps, and see which suspicious or malicious events occur.
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how exploit protection works.
|
||||
|
||||
## Use audit mode to measure impact
|
||||
## Enable exploit protection in audit mode
|
||||
|
||||
You can enable exploit protection in audit mode. You can enable audit mode for individual mitigations.
|
||||
You can set mitigations in audit mode for specific programs either by using the Windows Security app or PowerShell.
|
||||
|
||||
This lets you see a record of what *would* have happened if you had enabled the mitigation.
|
||||
### Windows Security app
|
||||
|
||||
You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious or malicious events generally occur over a certain period.
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
See the [**PowerShell reference** section in customize exploit protection](customize-exploit-protection.md#powershell-reference) for a list of which mitigations can be audited and instructions on enabling the mode.
|
||||
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**.
|
||||
|
||||
3. Go to **Program settings** and choose the app you want to apply mitigations to:
|
||||
|
||||
For further details on how audit mode works, and when you might want to use it, see [audit Windows Defender Exploit Guard](audit-windows-defender-exploit-guard.md).
|
||||
1. If the app you want to configure is already listed, click it and then click **Edit**
|
||||
2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app:
|
||||
- Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
|
||||
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
|
||||
|
||||
4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows.
|
||||
|
||||
5. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration.
|
||||
|
||||
### PowerShell
|
||||
|
||||
To set app-level mitigations to audit mode, use `Set-ProcessMitigation` with the **Audit mode** cmdlet.
|
||||
|
||||
Configure each mitigation in the following format:
|
||||
|
||||
|
||||
```PowerShell
|
||||
Set-ProcessMitigation -<scope> <app executable> -<action> <mitigation or options>,<mitigation or options>,<mitigation or options>
|
||||
```
|
||||
|
||||
Where:
|
||||
|
||||
- \<Scope>:
|
||||
- `-Name` to indicate the mitigations should be applied to a specific app. Specify the app's executable after this flag.
|
||||
- \<Action>:
|
||||
- `-Enable` to enable the mitigation
|
||||
- `-Disable` to disable the mitigation
|
||||
- \<Mitigation>:
|
||||
- The mitigation's cmdlet as defined in the following table. Each mitigation is separated with a comma.
|
||||
|
||||
| Mitigation | Audit mode cmdlet |
|
||||
| - | - |
|
||||
|Arbitrary code guard (ACG) | AuditDynamicCode |
|
||||
|Block low integrity images | AuditImageLoad |
|
||||
|Block untrusted fonts | AuditFont, FontAuditOnly |
|
||||
|Code integrity guard | AuditMicrosoftSigned, AuditStoreSigned |
|
||||
|Disable Win32k system calls | AuditSystemCall |
|
||||
|Do not allow child processes | AuditChildProcess |
|
||||
|
||||
For example, to enable Arbitrary Code Guard (ACG) in audit mode for an app named *testing.exe*, run the following command:
|
||||
|
||||
```PowerShell
|
||||
Set-ProcesMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode
|
||||
```
|
||||
|
||||
You can disable audit mode by replacing `-Enable` with `-Disable`.
|
||||
|
||||
## Review exploit protection audit events
|
||||
|
||||
To review which apps would have been blocked, open Event Viewer and filter for the following events in the Security-Mitigations log.
|
||||
|
||||
Feature | Provider/source | Event ID | Description
|
||||
:-|:-|:-:|:-
|
||||
Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 1 | ACG audit
|
||||
Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 3 | Do not allow child processes audit
|
||||
Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 5 | Block low integrity images audit
|
||||
Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 7 | Block remote images audit
|
||||
Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 9 | Disable win32k system calls audit
|
||||
Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 11 | Code integrity guard audit
|
||||
|
||||
## Related topics
|
||||
- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md)
|
||||
|
||||
@ -12,7 +12,7 @@ ms.date: 04/16/2018
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 08/08/2018
|
||||
ms.date: 03/26/2019
|
||||
---
|
||||
|
||||
# View attack surface reduction events
|
||||
@ -27,7 +27,7 @@ Reviewing the events is also handy when you are evaluating the features, as you
|
||||
|
||||
This topic lists all the events, their associated feature or setting, and describes how to create custom views to filter to specific events.
|
||||
|
||||
You can also get detailed reporting into events and blocks as part of Windows Security, which you gain access to if you have an E5 subscription and use [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md).
|
||||
You can also get detailed reporting into events and blocks as part of Windows Security, which you access if you have an E5 subscription and use [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md).
|
||||
|
||||
## Use custom views to review attack surface reduction capabilities
|
||||
|
||||
@ -35,7 +35,7 @@ You can create custom views in the Windows Event Viewer to only see events for s
|
||||
|
||||
The easiest way to do this is to import a custom view as an XML file. You can copy the XML directly from this page.
|
||||
|
||||
You can also manually navigate to the event area that corresponds to the feature, see the [list of attack surface reduction events](#list-of-attack-surface-reduction-events) section at the end of this topic for more details.
|
||||
You can also manually navigate to the event area that corresponds to the feature.
|
||||
|
||||
### Import an existing XML custom view
|
||||
|
||||
@ -43,11 +43,11 @@ You can also manually navigate to the event area that corresponds to the feature
|
||||
- Controlled folder access events custom view: *cfa-events.xml*
|
||||
- Exploit protection events custom view: *ep-events.xml*
|
||||
- Attack surface reduction events custom view: *asr-events.xml*
|
||||
- Network protection events custom view: *np-events.xml*
|
||||
- Network/ protection events custom view: *np-events.xml*
|
||||
|
||||
1. Type **event viewer** in the Start menu and open the Windows **Event Viewer**.
|
||||
1. Type **event viewer** in the Start menu and open **Event Viewer**.
|
||||
|
||||
3. On the left panel, under **Actions**, click **Import Custom View...**
|
||||
3. Click **Action** > **Import Custom View...**
|
||||
|
||||
|
||||
|
||||
@ -55,7 +55,7 @@ You can also manually navigate to the event area that corresponds to the feature
|
||||
|
||||
4. Click **Open**.
|
||||
|
||||
5. This will create a custom view that filters to only show the [events related to that feature](#list-of-all-windows-defender-exploit-guard-events).
|
||||
5. This will create a custom view that filters to only show the events related to that feature.
|
||||
|
||||
|
||||
### Copy the XML directly
|
||||
@ -73,7 +73,7 @@ You can also manually navigate to the event area that corresponds to the feature
|
||||
|
||||
4. Click **OK**. Specify a name for your filter.
|
||||
|
||||
5. This will create a custom view that filters to only show the [events related to that feature](#list-of-all-windows-defender-exploit-guard-events).
|
||||
5. This will create a custom view that filters to only show the events related to that feature.
|
||||
|
||||
### XML for attack surface reduction rule events
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 11/29/2018
|
||||
ms.date: 03/26/2018
|
||||
---
|
||||
|
||||
# Protect devices from exploits
|
||||
@ -20,47 +20,33 @@ ms.date: 11/29/2018
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Exploit protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps.
|
||||
Exploit protection automatically applies a number of exploit mitigation techniques to operating system processes and apps.
|
||||
|
||||
It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). Exploit protection is supported on Windows 10, version 1709 and later and Windows Server 2016, version 1803 or later.
|
||||
It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). Exploit protection is supported beginning with Windows 10, version 1709 and Windows Server 2016, version 1803.
|
||||
|
||||
>[!TIP]
|
||||
>You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
Exploit protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - which gives you detailed reporting into exploit protection events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
You [configure these settings using the Windows Security app or PowerShell](customize-exploit-protection.md) on an individual machine, and then [export the configuration as an XML file that you can deploy to other machines](import-export-exploit-protection-emet-xml.md). You can use Group Policy to distribute the XML file to multiple devices at once.
|
||||
You can [enable exploit protection](enable-exploit-protection.md) on an individual machine, and then use [Group Policy](import-export-exploit-protection-emet-xml.md) to distribute the XML file to multiple devices at once.
|
||||
|
||||
When a mitigation is encountered on the machine, a notification will be displayed from the Action Center. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors.
|
||||
When a mitigation is encountered on the machine, a notification will be displayed from the Action Center. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors.
|
||||
|
||||
You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how exploit protection would impact your organization if it were enabled.
|
||||
You can also use [audit mode](evaluate-exploit-protection.md) to evaluate how exploit protection would impact your organization if it were enabled.
|
||||
|
||||
Many of the features in the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) have been included in Exploit protection, and you can convert and import existing EMET configuration profiles into Exploit protection. See [Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard](emet-exploit-protection-exploit-guard.md) for more information on how Exploit protection supersedes EMET and what the benefits are when considering moving to exploit protection on Windows 10.
|
||||
Many of the features in the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) have been included in Exploit protection, and you can convert and import existing EMET configuration profiles into Exploit protection. See [Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard](emet-exploit-protection-exploit-guard.md) for more information on how Exploit protection supersedes EMET and what the benefits are when considering moving to exploit protection on Windows 10.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>If you are currently using EMET you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with exploit protection in Windows 10. You can [convert an existing EMET configuration file into exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
|
||||
>[!IMPORTANT]
|
||||
>If you are currently using EMET you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with exploit protection in Windows 10. You can [convert an existing EMET configuration file into exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
|
||||
|
||||
>[!WARNING]
|
||||
>Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using [audit mode](audit-windows-defender-exploit-guard.md) before deploying the configuration across a production environment or the rest of your network.
|
||||
|
||||
## Review exploit protection events in Windows Event Viewer
|
||||
## Review exploit protection events in Windows Event Viewer
|
||||
|
||||
You can review the Windows event log to see events that are created when exploit protection blocks (or audits) an app:
|
||||
|
||||
1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *ep-events.xml* to an easily accessible location on the machine.
|
||||
|
||||
2. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
|
||||
|
||||
3. On the left panel, under **Actions**, click **Import custom view...**
|
||||
|
||||
|
||||
|
||||
4. Navigate to where you extracted *ep-events.xml* and select it. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
|
||||
|
||||
5. Click **OK**.
|
||||
|
||||
6. This will create a custom view that filters to only show the following events related to Exploit protection:
|
||||
|
||||
Provider/source | Event ID | Description
|
||||
-|:-:|-
|
||||
Security-Mitigations | 1 | ACG audit
|
||||
@ -97,22 +83,8 @@ Win32K | 260 | Untrusted Font
|
||||
>
|
||||
>You can [convert an existing EMET configuration file into exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
|
||||
|
||||
This topic describes the differences between the Enhance Mitigation Experience Toolkit (EMET) and exploit protection in Windows Defender ATP.
|
||||
|
||||
Exploit protection in Windows Defender ATP is our successor to EMET and provides stronger protection, more customization, an easier user interface, and better configuration and management options.
|
||||
|
||||
EMET is a standalone product for earlier versions of Windows and provides some mitigation against older, known exploit techniques.
|
||||
|
||||
After July 31, 2018, it will not be supported.
|
||||
|
||||
For more information about the individual features and mitigations available in Windows Defender ATP, as well as how to enable, configure, and deploy them to better protect your network, see the following topics:
|
||||
|
||||
- [Protect devices from exploits](exploit-protection-exploit-guard.md)
|
||||
- [Configure and audit Exploit protection mitigations](customize-exploit-protection.md)
|
||||
|
||||
## Feature comparison
|
||||
|
||||
The table in this section illustrates the differences between EMET and Windows Defender Exploit Guard.
|
||||
This section compares exploit protection in Windows Defender ATP with the Enhance Mitigation Experience Toolkit (EMET) for reference.
|
||||
The table in this section illustrates the differences between EMET and Windows Defender Exploit Guard.
|
||||
|
||||
| Windows Defender Exploit Guard | EMET
|
||||
-|:-:|:-:
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 08/09/2018
|
||||
ms.date: 03/27/2019
|
||||
---
|
||||
|
||||
# Troubleshoot network protection
|
||||
@ -43,7 +43,7 @@ Network protection will only work on devices with the following conditions:
|
||||
> - Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
|
||||
> - [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled.
|
||||
> - [Cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) is enabled.
|
||||
> - Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in the [Enable network protection topic](enable-network-protection.md#use-group-policy-to-enable-or-audit-network-protection).
|
||||
> - Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**).
|
||||
|
||||
If these pre-requisites have all been met, proceed to the next step to test the rule in audit mode.
|
||||
|
||||
@ -60,7 +60,7 @@ If you encounter problems when running the evaluation scenario, check that the d
|
||||
|
||||
You can also use audit mode and then attempt to visit the site or IP (IPv4) address you do or don't want to block. Audit mode lets network protection report to the Windows event log as if it actually blocked the site or connection to an IP address, but will still allow the file to run.
|
||||
|
||||
1. Enable audit mode for network protection. Use Group Policy to set the rule to **Audit mode** as described in the [Enable network protection topic](enable-network-protection.md#use-group-policy-to-enable-or-audit-network-protection).
|
||||
1. Enable audit mode for network protection. Use Group Policy to set the rule to **Audit mode** as described in the [Enable network protection topic](enable-network-protection.md#group-policy).
|
||||
2. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block).
|
||||
3. [Review the network protection event logs](network-protection-exploit-guard.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**.
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user