mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 06:13:41 +00:00
Merge remote-tracking branch 'refs/remotes/origin/master' into jdh1shell
This commit is contained in:
Jeanie Decker
@ -61,7 +61,7 @@ Here are the provisioned Windows apps in Windows 10 versions 1703, 1709, 1803 an
|
||||
| Microsoft.OneConnect | [Paid Wi-Fi & Cellular](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | No |
|
||||
| Microsoft.People | [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | x | x | x | x | No |
|
||||
| Microsoft.Print3D | [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | | x | x | x | No |
|
||||
| Microsoft.SkreenSketch | [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | | | | x | No |
|
||||
| Microsoft.ScreenSketch | [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | | | | x | No |
|
||||
| Microsoft.SkypeApp | [Skype](ms-windows-store://pdp/?PFN=Microsoft.SkypeApp_kzf8qxf38zg5c) | x | x | x | x | No |
|
||||
| Microsoft.StorePurchaseApp | [Store Purchase App](ms-windows-store://pdp/?PFN=Microsoft.StorePurchaseApp_8wekyb3d8bbwe) | x | x | x | x | No |
|
||||
| Microsoft.VP9VideoExtensions | | | | | x | No |
|
||||
@ -181,4 +181,4 @@ Here are the typical installed Windows apps in Windows 10 versions 1709, 1803, a
|
||||
| | Microsoft.VCLibs.140.00 | x | x | x | Yes |
|
||||
| | Microsoft.VCLibs.120.00.Universal | x | | | Yes |
|
||||
| | Microsoft.VCLibs.140.00.UWPDesktop | | x | | Yes |
|
||||
---
|
||||
---
|
||||
|
||||
@ -13,7 +13,7 @@ ms.date: 06/26/2017
|
||||
# WindowsSecurityAuditing CSP
|
||||
|
||||
|
||||
The WindowsSecurityAuditing configuration service provider (CSP) is used to enable logging of security audit events. This CSP was added in Windows 10, version 1511.
|
||||
The WindowsSecurityAuditing configuration service provider (CSP) is used to enable logging of security audit events. This CSP was added in Windows 10, version 1511 for Mobile and Mobile Enterprise. Make sure to consult the [Configuration service provider reference](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference) to see if this CSP and others are supported on your Windows installation.
|
||||
|
||||
The following diagram shows the WindowsSecurityAuditing configuration service provider in tree format.
|
||||
|
||||
|
||||
@ -55,7 +55,7 @@ Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.</td>
|
||||
|
||||
## Log entry structure
|
||||
|
||||
A setupact.log or setuperr.log (files are located at C:\Windows) entry includes the following elements:
|
||||
A setupact.log or setuperr.log entry (files are located at C:\Windows) includes the following elements:
|
||||
|
||||
<ol>
|
||||
<LI><B>The date and time</B> - 2016-09-08 09:20:05.
|
||||
|
||||
@ -59,7 +59,7 @@ The remainder of the provisioning includes Windows Hello for Business requesting
|
||||
> Read [Azure AD Connect sync: Scheduler](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler) to view and adjust the **synchronization cycle** for your organization.
|
||||
|
||||
> [!NOTE]
|
||||
> Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889) provides synchronous certificate enrollment during hybrid certificate trust provisioning. With this update, users no longer need to wait for Azure AD Connect to sync their public key on-premises. Users enroll their certificate during provisioning and can use the certificate for sign-in immediately after completeling the provisioning.
|
||||
> Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889) provides synchronous certificate enrollment during hybrid certificate trust provisioning. With this update, users no longer need to wait for Azure AD Connect to sync their public key on-premises. Users enroll their certificate during provisioning and can use the certificate for sign-in immediately after completeling the provisioning. The update needs to be installed on the federation servers.
|
||||
|
||||
After a successful key registration, Windows creates a certificate request using the same key pair to request a certificate. Windows send the certificate request to the AD FS server for certificate enrollment.
|
||||
|
||||
|
||||
@ -44,7 +44,7 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Use
|
||||
|
||||
### Default values
|
||||
|
||||
By default this setting is Administrators on domain controllers and on stand-alone servers.
|
||||
By default, this setting is Administrators and NT SERVICE\WdiServiceHost on domain controllers and on stand-alone servers.
|
||||
|
||||
The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page.
|
||||
|
||||
|
||||
@ -6,7 +6,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
ms.date: 08/31/2018
|
||||
ms.date: 04/09/2019
|
||||
---
|
||||
|
||||
# Microsoft recommended block rules
|
||||
@ -76,7 +76,13 @@ These modules cannot be blocked by name or version, and therefore must be blocke
|
||||
|
||||
For October 2017, we are announcing an update to system.management.automation.dll in which we are revoking older versions by hash values, instead of version rules.
|
||||
|
||||
Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet:
|
||||
Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet. Beginning with the March 2019 quality update, each version of Windows requires blocking a specific version of the following files:
|
||||
|
||||
- msxml3.dll
|
||||
- msxml6.dll
|
||||
- jscript9.dll
|
||||
|
||||
Pick the correct version of each .dll for the Windows release you plan to support, and remove the other versions.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
@ -137,7 +143,35 @@ Microsoft recommends that you block the following Microsoft-signed applications
|
||||
<Deny ID="ID_DENY_WMIC" FriendlyName="wmic.exe" FileName="wmic.exe" MinimumFileVersion="65535.65535.65535.65535"/>
|
||||
<Deny ID="ID_DENY_MWFC" FriendlyName="Microsoft.Workflow.Compiler.exe" FileName="Microsoft.Workflow.Compiler.exe" MinimumFileVersion="65535.65535.65535.65535" />
|
||||
<Deny ID="ID_DENY_WFC" FriendlyName="WFC.exe" FileName="wfc.exe" MinimumFileVersion="65535.65535.65535.65535" />
|
||||
<Deny ID="ID_DENY_KILL" FriendlyName="kill.exe" FileName="kill.exe" MinimumFileVersion="65535.65535.65535.65535" />
|
||||
<Deny ID="ID_DENY_KILL" FriendlyName="kill.exe" FileName="kill.exe" MinimumFileVersion="65535.65535.65535.65535" />
|
||||
<! -- msxml3.dll pick correct version based on release you are supporting -->
|
||||
<! -- msxml6.dll pick correct version based on release you are supporting -->
|
||||
<! -- jscript9.dll pick correct version based on release you are supporting -->
|
||||
<! -- RS1 Windows 1607
|
||||
<Deny ID="ID_DENY_MSXML3" FriendlyName="msxml3.dll" FileName="msxml3.dll" MinimumFileVersion ="8.110.14393.2550"/>
|
||||
<Deny ID="ID_DENY_MSXML6" FriendlyName="msxml6.dll" FileName="msxml6.dll" MinimumFileVersion ="6.30.14393.2550"/>
|
||||
<Deny ID="ID_DENY_JSCRIPT9" FriendlyName="jscript9.dll" FileName="jscript9.dll" MinimumFileVersion ="11.0.14393.2607"/>
|
||||
-->
|
||||
<! -- RS2 Windows 1703
|
||||
<Deny ID="ID_DENY_MSXML3" FriendlyName="msxml3.dll" FileName="msxml3.dll" MinimumFileVersion ="8.110.15063.1386"/>
|
||||
<Deny ID="ID_DENY_MSXML6" FriendlyName="msxml6.dll" FileName="msxml6.dll" MinimumFileVersion ="6.30.15063.1386"/>
|
||||
<Deny ID="ID_DENY_JSCRIPT9" FriendlyName="jscript9.dll" FileName="jscript9.dll" MinimumFileVersion ="11.0.15063.1445"/>
|
||||
-->
|
||||
<! -- RS3 Windows 1709
|
||||
<Deny ID="ID_DENY_MSXML3" FriendlyName="msxml3.dll" FileName="msxml3.dll" MinimumFileVersion ="8.110.16299.725"/>
|
||||
<Deny ID="ID_DENY_MSXML6" FriendlyName="msxml6.dll" FileName="msxml6.dll" MinimumFileVersion ="6.30.16299.725"/>
|
||||
<Deny ID="ID_DENY_JSCRIPT9" FriendlyName="jscript9.dll" FileName="jscript9.dll" MinimumFileVersion ="11.0.16299.785"/>
|
||||
-->
|
||||
<! -- RS4 Windows 1803
|
||||
<Deny ID="ID_DENY_MSXML3" FriendlyName="msxml3.dll" FileName="msxml3.dll" MinimumFileVersion ="8.110.17134.344"/>
|
||||
<Deny ID="ID_DENY_MSXML6" FriendlyName="msxml6.dll" FileName="msxml6.dll" MinimumFileVersion ="6.30.17134.344"/>
|
||||
<Deny ID="ID_DENY_JSCRIPT9" FriendlyName="jscript9.dll" FileName="jscript9.dll" MinimumFileVersion ="11.0.17134.406"/>
|
||||
-->
|
||||
<! -- RS5 Windows 1809
|
||||
<Deny ID="ID_DENY_MSXML3" FriendlyName="msxml3.dll" FileName="msxml3.dll" MinimumFileVersion ="8.110.17763.54"/>
|
||||
<Deny ID="ID_DENY_MSXML6" FriendlyName="msxml6.dll" FileName="msxml6.dll" MinimumFileVersion ="6.30.17763.54"/>
|
||||
<Deny ID="ID_DENY_JSCRIPT9" FriendlyName="jscript9.dll" FileName="jscript9.dll" MinimumFileVersion ="11.0.17763.133"/>
|
||||
-->
|
||||
<Deny ID="ID_DENY_D_1" FriendlyName="Powershell 1" Hash="02BE82F63EE962BCD4B8303E60F806F6613759C6"/>
|
||||
<Deny ID="ID_DENY_D_2" FriendlyName="Powershell 2" Hash="13765D9A16CC46B2113766822627F026A68431DF"/>
|
||||
<Deny ID="ID_DENY_D_3" FriendlyName="Powershell 3" Hash="148972F670E18790D62D753E01ED8D22B351A57E45544D88ACE380FEDAF24A40"/>
|
||||
@ -842,8 +876,11 @@ Microsoft recommends that you block the following Microsoft-signed applications
|
||||
<FileRuleRef RuleID="ID_DENY_KILL"/>
|
||||
<FileRuleRef RuleID="ID_DENY_WMIC"/>
|
||||
<FileRuleRef RuleID="ID_DENY_MWFC" />
|
||||
<FileRuleRef RuleID="ID_DENY_WFC" />
|
||||
<FileRuleRef RuleID="ID_DENY_D_1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_WFC" />
|
||||
<FileRuleRef RuleID="ID_DENY_MSXML3" />
|
||||
<FileRuleRef RuleID="ID_DENY_MSXML6" />
|
||||
<FileRuleRef RuleID="ID_DENY_JSCRIPT9" />
|
||||
<FileRuleRef RuleID="ID_DENY_D_1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_D_2"/>
|
||||
<FileRuleRef RuleID="ID_DENY_D_3"/>
|
||||
<FileRuleRef RuleID="ID_DENY_D_4"/>
|
||||
|
||||
Reference in New Issue
Block a user