mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
fixing art links
This commit is contained in:
Liza Poggemeyer
parent
18c4edef72
commit
037f4ee4ba
@ -738,7 +738,7 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-cryptography.md#CryptographyAllowFipsAlgorithmPolicy" id="CryptographyAllowFipsAlgorithmPolicy">Cryptography/AllowFipsAlgorithmPolicy</a>
|
||||
<a href="./policy-csp-cryptography.md#cryptographyallowfipsalgorithmpolicy" id="CryptographyAllowFipsAlgorithmPolicy">Cryptography/AllowFipsAlgorithmPolicy</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-cryptography.md#cryptography-tlsciphersuites" id="cryptography-tlsciphersuites">Cryptography/TLSCipherSuites</a>
|
||||
@ -4378,7 +4378,7 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials)
|
||||
- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal)
|
||||
- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators)
|
||||
- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#CryptographyAllowFipsAlgorithmPolicy)
|
||||
- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptographyallowfipsalgorithmpolicy)
|
||||
- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g)
|
||||
- [Defender/AllowArchiveScanning](./policy-csp-defender.md#defender-allowarchivescanning)
|
||||
- [Defender/AllowBehaviorMonitoring](./policy-csp-defender.md#defender-allowbehaviormonitoring)
|
||||
@ -5243,7 +5243,7 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
|
||||
- [Camera/AllowCamera](#camera-allowcamera)
|
||||
- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui)
|
||||
- [Cryptography/AllowFipsAlgorithmPolicy](#CryptographyAllowFipsAlgorithmPolicy)
|
||||
- [Cryptography/AllowFipsAlgorithmPolicy](#cryptographyallowfipsalgorithmpolicy)
|
||||
- [Cryptography/TLSCipherSuites](#cryptography-tlsciphersuites)
|
||||
- [Defender/AllowArchiveScanning](#defender-allowarchivescanning)
|
||||
- [Defender/AllowBehaviorMonitoring](#defender-allowbehaviormonitoring)
|
||||
|
||||
@ -93,6 +93,7 @@ The following steps are required to enable this integration:
|
||||
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
|
||||
<span id="server-mma"/>
|
||||
|
||||
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender ATP
|
||||
|
||||
1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603).
|
||||
@ -107,6 +108,7 @@ The following steps are required to enable this integration:
|
||||
Once completed, you should see onboarded servers in the portal within an hour.
|
||||
|
||||
<span id="server-proxy"/>
|
||||
|
||||
### Configure server proxy and Internet connectivity settings
|
||||
|
||||
- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the <a href="https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway" data-raw-source="[OMS Gateway](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway)">OMS Gateway</a>.
|
||||
|
||||
@ -157,7 +157,7 @@ The service could not contact the external processing servers at that URL.</td>
|
||||
<td>17</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: <code>variable</code>.</td>
|
||||
<td>An error occurred with the Windows telemetry service.</td>
|
||||
<td><a href="troubleshoot-onboarding.md#ensure-the-diagnostics-service-is-enabled" data-raw-source="[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-the-diagnostics-service-is-enabled)">Ensure the diagnostic data service is enabled</a>.<br>
|
||||
<td><a href="troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy" data-raw-source="[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)">Ensure the diagnostic data service is enabled</a>.<br>
|
||||
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
See <a href="configure-endpoints.md" data-raw-source="[Onboard Windows 10 machines](configure-endpoints.md)">Onboard Windows 10 machines</a>.</td>
|
||||
</tr>
|
||||
@ -208,7 +208,7 @@ Ensure real-time antimalware protection is running properly.</td>
|
||||
<td>28</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: <code>variable</code>.</td>
|
||||
<td>An error occurred with the Windows telemetry service.</td>
|
||||
<td><a href="troubleshoot-onboarding.md#ensure-the-diagnostic-data-service-is-enabled" data-raw-source="[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-the-diagnostic-data-service-is-enabled)">Ensure the diagnostic data service is enabled</a>.<br>
|
||||
<td><a href="troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy" data-raw-source="[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)">Ensure the diagnostic data service is enabled</a>.<br>
|
||||
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
See <a href="configure-endpoints.md" data-raw-source="[Onboard Windows 10 machines](configure-endpoints.md)">Onboard Windows 10 machines</a>.</td>
|
||||
</tr>
|
||||
@ -249,7 +249,7 @@ If the identifier does not persist, the same machine might appear twice in the p
|
||||
<td>34</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: <code>variable</code>.</td>
|
||||
<td>An error occurred with the Windows telemetry service.</td>
|
||||
<td><a href="troubleshoot-onboarding.md#ensure-the-diagnostic-data-service-is-enabled" data-raw-source="[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-the-diagnostic-data-service-is-enabled)">Ensure the diagnostic data service is enabled</a>.<br>
|
||||
<td><a href="troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy" data-raw-source="[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)">Ensure the diagnostic data service is enabled</a>.<br>
|
||||
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
See <a href="configure-endpoints.md" data-raw-source="[Onboard Windows 10 machines](configure-endpoints.md)">Onboard Windows 10 machines</a>.</td>
|
||||
</tr>
|
||||
|
||||
@ -160,7 +160,7 @@ This tab is only displayed when an investigation is complete and shows all pendi
|
||||
## Pending actions
|
||||
If there are pending actions on an Automated investigation, you'll see a pop up similar to the following image.
|
||||
|
||||
|
||||
|
||||
|
||||
When you click on the pending actions link, you'll be taken to the pending actions page. You can also navigate to the page from the navigation page by going to **Automated investigation** > **Pending actions**.
|
||||
|
||||
|
||||
@ -66,50 +66,50 @@ The following table provides information on the icons used all throughout the po
|
||||
|
||||
Icon | Description
|
||||
:---|:---
|
||||
| Microsoft Defender ATP logo
|
||||
| Alert – Indication of an activity correlated with advanced attacks.
|
||||
| Detection – Indication of a malware threat detection.
|
||||
| Active threat – Threats actively executing at the time of detection.
|
||||
| Remediated – Threat removed from the machine.
|
||||
| Not remediated – Threat not removed from the machine.
|
||||
| Indicates events that triggered an alert in the **Alert process tree**.
|
||||
| Machine icon
|
||||
| Windows Defender Antivirus events
|
||||
| Windows Defender Application Guard events
|
||||
| Windows Defender Device Guard events
|
||||
| Windows Defender Exploit Guard events
|
||||
| Windows Defender SmartScreen events
|
||||
| Windows Firewall events
|
||||
| Response action
|
||||
| Process events
|
||||
| Network events
|
||||
| File events
|
||||
| Registry events
|
||||
| Load DLL events
|
||||
| Other events
|
||||
| Access token modification
|
||||
| File creation
|
||||
| Signer
|
||||
| File path
|
||||
| Command line
|
||||
| Unsigned file
|
||||
| Process tree
|
||||
| Memory allocation
|
||||
| Process injection
|
||||
| Powershell command run
|
||||
 | Community center
|
||||
 | Notifications
|
||||
 | Automated investigation - no threats found
|
||||
 | Automated investigation - failed
|
||||
 | Automated investigation - partially investigated
|
||||
 | Automated investigation - terminated by system
|
||||
 | Automated investigation - pending
|
||||
 | Automated investigation - running
|
||||
 | Automated investigation - remediated
|
||||
 | Automated investigation - partially remediated
|
||||
 | Threat & Vulnerability Management - threat insights
|
||||
 | Threat & Vulnerability Management - possible active alert
|
||||
 | Threat & Vulnerability Management - recommendation insights
|
||||
| Microsoft Defender ATP logo
|
||||
| Alert – Indication of an activity correlated with advanced attacks.
|
||||
| Detection – Indication of a malware threat detection.
|
||||
| Active threat – Threats actively executing at the time of detection.
|
||||
| Remediated – Threat removed from the machine.
|
||||
| Not remediated – Threat not removed from the machine.
|
||||
| Indicates events that triggered an alert in the **Alert process tree**.
|
||||
| Machine icon
|
||||
| Windows Defender Antivirus events
|
||||
| Windows Defender Application Guard events
|
||||
| Windows Defender Device Guard events
|
||||
| Windows Defender Exploit Guard events
|
||||
| Windows Defender SmartScreen events
|
||||
| Windows Firewall events
|
||||
| Response action
|
||||
| Process events
|
||||
| Network events
|
||||
| File events
|
||||
| Registry events
|
||||
| Load DLL events
|
||||
| Other events
|
||||
| Access token modification
|
||||
| File creation
|
||||
| Signer
|
||||
| File path
|
||||
| Command line
|
||||
| Unsigned file
|
||||
| Process tree
|
||||
| Memory allocation
|
||||
| Process injection
|
||||
| Powershell command run
|
||||
 | Community center
|
||||
 | Notifications
|
||||
 | Automated investigation - no threats found
|
||||
 | Automated investigation - failed
|
||||
 | Automated investigation - partially investigated
|
||||
 | Automated investigation - terminated by system
|
||||
 | Automated investigation - pending
|
||||
 | Automated investigation - running
|
||||
 | Automated investigation - remediated
|
||||
 | Automated investigation - partially remediated
|
||||
 | Threat & Vulnerability Management - threat insights
|
||||
 | Threat & Vulnerability Management - possible active alert
|
||||
 | Threat & Vulnerability Management - recommendation insights
|
||||
|
||||
## Related topics
|
||||
- [Understand the Microsoft Defender Advanced Threat Protection portal](use.md)
|
||||
|
||||
@ -44,7 +44,7 @@ Potential reasons:
|
||||
For both cases you should contact Microsoft support at [General Microsoft Defender ATP Support](https://support.microsoft.com/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636419533611396913) or
|
||||
[Volume license support](https://www.microsoft.com/licensing/servicecenter/Help/Contact.aspx).
|
||||
|
||||
|
||||
|
||||
|
||||
## Your subscription has expired
|
||||
|
||||
@ -55,14 +55,14 @@ You can choose to renew or extend the license at any point in time. When accessi
|
||||
> [!NOTE]
|
||||
> For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
|
||||
|
||||
|
||||
|
||||
## You are not authorized to access the portal
|
||||
|
||||
If you receive a **You are not authorized to access the portal**, be aware that Microsoft Defender ATP is a security monitoring, incident investigation and response product, and as such, access to it is restricted and controlled by the user.
|
||||
For more information see, [**Assign user access to the portal**](https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection).
|
||||
|
||||
|
||||
|
||||
|
||||
## Data currently isn't available on some sections of the portal
|
||||
If the portal dashboard, and other sections show an error message such as "Data currently isn't available":
|
||||
|
||||
@ -35,7 +35,7 @@ Beginning with Windows 10 version 1607, new functionality was added to Windows 1
|
||||
This functionality is controlled by a new **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**.
|
||||
The Privacy setting is off by default, which hides the details.
|
||||
|
||||
|
||||
|
||||
|
||||
The **Interactive logon: Display user information when the session is locked** Group Policy setting controls the same functionality.
|
||||
|
||||
|
||||
@ -27,11 +27,11 @@ You can use Microsoft Intune to configure Windows Defender Application Control (
|
||||
|
||||
3. Type a name for the new profile, select **Windows 10 and later** as the **Platform** and **Endpoint protection** as the **Profile type**.
|
||||
|
||||
|
||||
|
||||
|
||||
4. Click **Configure** > **Windows Defender Application Control**, choose from the following settings and then click **OK**:
|
||||
|
||||
- **Application control code intergity policies**: Select **Audit only** to log events but not block any apps from running or select **Enforce** to allow only Windows components and Store apps to run.
|
||||
- **Trust apps with good reputation**: Select **Enable** to allow reputable apps as defined by the Intelligent Security Graph to run in addition to Windows components and Store apps.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -61,7 +61,7 @@ Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP]
|
||||
3. Double-click **Turn on Virtualization Based Security**.
|
||||
4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be disabled remotely or select **Enabled without UEFI lock**.
|
||||
|
||||
|
||||
|
||||
|
||||
5. Click **Ok** to close the editor.
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user