mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-29 13:47:23 +00:00
Merge branch 'master' into Benny-54-quarantine-doc
This commit is contained in:
Benny Shilpa
GitHub
commit
06ba1ab7b7
@ -1,5 +1,6 @@
|
||||
# [Manage clients in Windows 10](index.md)
|
||||
## [Administrative Tools in Windows 10](administrative-tools-in-windows-10.md)
|
||||
### [Use Quick Assist to help users](quick-assist.md)
|
||||
## [Create mandatory user profiles](mandatory-user-profile.md)
|
||||
## [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md)
|
||||
## [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md)
|
||||
|
||||
BIN
windows/client-management/images/quick-assist-flow.png
Normal file
BIN
windows/client-management/images/quick-assist-flow.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 25 KiB |
@ -1227,76 +1227,6 @@ The following list shows the supported values:
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="experience-disablecloudoptimizedcontent"></a>**Experience/DisableCloudOptimizedContent**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting lets you turn off cloud optimized content in all Windows experiences.
|
||||
|
||||
If you enable this policy setting, Windows experiences that use the cloud optimized content client component will present the default fallback content.
|
||||
|
||||
If you disable or do not configure this policy setting, Windows experiences will be able to use cloud optimized content.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP English name: *Turn off cloud optimized content*
|
||||
- GP name: *DisableCloudOptimizedContent*
|
||||
- GP path: *Windows Components/Cloud Content*
|
||||
- GP ADMX file name: *CloudContent.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) – Disabled.
|
||||
- 1 – Enabled.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="experience-donotshowfeedbacknotifications"></a>**Experience/DoNotShowFeedbackNotifications**
|
||||
|
||||
@ -1428,7 +1358,7 @@ ADMX Info:
|
||||
<!--SupportedValues-->
|
||||
Supported values:
|
||||
|
||||
- 0 (default) - Allowed/turned on. The "browser" group syncs automatically between user’s devices and lets users to make changes.
|
||||
- 0 (default) - Allowed/turned on. The "browser" group synchronizes automatically between users' devices and lets users make changes.
|
||||
- 2 - Prevented/turned off. The "browser" group does not use the _Sync your Settings_ option.
|
||||
|
||||
|
||||
|
||||
BIN
windows/client-management/media/image1.png
Normal file
BIN
windows/client-management/media/image1.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 62 KiB |
121
windows/client-management/quick-assist.md
Normal file
121
windows/client-management/quick-assist.md
Normal file
@ -0,0 +1,121 @@
|
||||
---
|
||||
title: Use Quick Assist to help users
|
||||
description: How IT Pros can use Quick Assist to help users
|
||||
ms.prod: w10
|
||||
ms.sitesec: library
|
||||
ms.topic: article
|
||||
author: jaimeo
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
manager: laurawi
|
||||
---
|
||||
|
||||
# Use Quick Assist to help users
|
||||
|
||||
Quick Assist is a Windows 10 application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user’s device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices.
|
||||
|
||||
## Before you begin
|
||||
|
||||
All that's required to use Quick Assist is suitable network and internet connectivity. No particular roles, permissions, or policies are involved. Neither party needs to be in a domain. The helper must have a Microsoft account. The sharer doesn’t have to authenticate.
|
||||
|
||||
### Authentication
|
||||
|
||||
The helper can authenticate when they sign in by using a Microsoft Account (MSA) or Azure Active Directory. Local Active Directory authentication is not supported at this time.
|
||||
|
||||
### Network considerations
|
||||
|
||||
Quick Assist communicates over port 443 (https) and connects to the Remote Assistance Service at `https://remoteassistance.support.services.microsoft.com` by using the Remote Desktop Protocol (RDP). The traffic is encrypted with TLS 1.2.
|
||||
|
||||
Both the helper and sharer must be able to reach these endpoints over port 443:
|
||||
|
||||
| Domain/Name | Description |
|
||||
|-----------------------------------|-------------------------------------------------------|
|
||||
| \*.support.services.microsoft.com | Primary endpoint used for Quick Assist application |
|
||||
| \*.resources.lync.com | Required for the Skype framework used by Quick Assist |
|
||||
| \*.infra.lync.com | Required for the Skype framework used by Quick Assist |
|
||||
| \*.latest-swx.cdn.skype.com | Required for the Skype framework used by Quick Assist |
|
||||
| \*.login.microsoftonline.com | Required for logging in to the application (MSA) |
|
||||
| \*.channelwebsdks.azureedge.net | Used for chat services within Quick Assist |
|
||||
| \*.aria.microsoft.com | Used for accessibility features within the app |
|
||||
| \*.api.support.microsoft.com | API access for Quick Assist |
|
||||
| \*.vortex.data.microsoft.com | Used for diagnostic data |
|
||||
| \*.channelservices.microsoft.com | Required for chat services within Quick Assist |
|
||||
|
||||
## How it works
|
||||
|
||||
1. Both the helper and the sharer start Quick Assist.
|
||||
|
||||
2. The helper selects **Assist another person**. Quick Assist on the helper's side contacts the Remote Assistance Service to obtain a session code. An RCC chat session is established and the helper's Quick Assist instance joins it. The helper then provides the code to the sharer.
|
||||
|
||||
3. After the sharer enters the code in their Quick Assist app, Quick Assist uses that code to contact the Remote Assistance Service and join that specific session. The sharer's Quick Assist instance joins the RCC chat session.
|
||||
|
||||
4. The helper is prompted to select **View Only** or **Full Control**.
|
||||
|
||||
5. The sharer is prompted to confirm allowing the helper to share their desktop with the helper.
|
||||
|
||||
6. Quick Assist starts RDP control and connects to the RDP Relay service.
|
||||
|
||||
7. RDP shares the video to the helper over https (port 443) through the RDP relay service to the helper's RDP control. Input is shared from the helper to the sharer through the RDP relay service.
|
||||
|
||||
:::image type="content" source="images/quick-assist-flow.png" lightbox="images/quick-assist-flow.png" alt-text="Schematic flow of connections when a Quick Assist session is established":::
|
||||
|
||||
### Data and privacy
|
||||
|
||||
Microsoft logs a small amount of session data to monitor the health of the Quick Assist system. This data includes the following information:
|
||||
|
||||
- Start and end time of the session
|
||||
|
||||
- Errors arising from Quick Assist itself, such as unexpected disconnections
|
||||
|
||||
- Features used inside the app such as view only, annotation, and session pause
|
||||
|
||||
No logs are created on either the helper’s or sharer’s device. Microsoft cannot access a session or view any actions or keystrokes that occur in the session.
|
||||
|
||||
The sharer sees only an abbreviated version of the helper’s name (first name, last initial) and no other information about them. Microsoft does not store any data about either the sharer or the helper for longer than three days.
|
||||
|
||||
In some scenarios, the helper does require the sharer to respond to application permission prompts (User Account Control), but otherwise the helper has the same permissions as the sharer on the device.
|
||||
|
||||
## Working with Quick Assist
|
||||
|
||||
Either the support staff or a user can start a Quick Assist session.
|
||||
|
||||
|
||||
1. Support staff (“helper”) starts Quick Assist in any of a few ways:
|
||||
|
||||
- Type *Quick Assist* in the search box and press ENTER.
|
||||
- From the Start menu, select **Windows Accessories**, and then select **Quick Assist**.
|
||||
- Type CTRL+Windows+Q
|
||||
|
||||
2. In the **Give assistance** section, helper selects **Assist another person**. The helper might be asked to choose their account or sign in. Quick Assist generates a time-limited security code.
|
||||
|
||||
3. Helper shares the security code with the user over the phone or with a messaging system.
|
||||
|
||||
4. Quick Assist opens on the sharer’s device. The user enters the provided code in the **Code from assistant** box, and then selects **Share screen**.
|
||||
|
||||
5. The helper receives a dialog offering the opportunity to take full control of the device or just view its screen. After choosing, the helper selects **Continue**.
|
||||
|
||||
6. The sharer receives a dialog asking for permission to show their screen or allow access. The sharer gives permission by selecting the **Allow** button.
|
||||
|
||||
## If Quick Assist is missing
|
||||
|
||||
If for some reason a user doesn't have Quick Assist on their system or it's not working properly, they might need to uninstall and reinstall it.
|
||||
|
||||
### Uninstall Quick Assist
|
||||
|
||||
1. Start the Settings app, and then select **Apps**.
|
||||
2. Select **Optional features**.
|
||||
3. In the **Installed features** search bar, type *Quick Assist*.
|
||||
4. Select **Microsoft Quick Assist**, and then select **Uninstall**.
|
||||
|
||||
### Reinstall Quick Assist
|
||||
|
||||
1. Start the Settings app, and then select **Apps**.
|
||||
2. Select **Optional features**.
|
||||
3. Select **Add a feature**.
|
||||
4. In the new dialog that opens, in the **Add an optional feature** search bar, type *Quick Assist*.
|
||||
5. Select the check box for **Microsoft Quick Assist**, and then select **Install**.
|
||||
6. Restart the device.
|
||||
|
||||
## Next steps
|
||||
|
||||
If you have any problems, questions, or suggestions for Quick Assist, contact us by using the [Feedback Hub app](https://www.microsoft.com/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0&rtc=1#activetab=pivot:overviewtab).
|
||||
BIN
windows/media/phase-diagrams/deployment-phases.png
Normal file
BIN
windows/media/phase-diagrams/deployment-phases.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 5.6 KiB |
BIN
windows/media/phase-diagrams/migration-phases.png
Normal file
BIN
windows/media/phase-diagrams/migration-phases.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 5.6 KiB |
BIN
windows/media/phase-diagrams/onboard.png
Normal file
BIN
windows/media/phase-diagrams/onboard.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.9 KiB |
BIN
windows/media/phase-diagrams/prepare.png
Normal file
BIN
windows/media/phase-diagrams/prepare.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.7 KiB |
BIN
windows/media/phase-diagrams/setup.png
Normal file
BIN
windows/media/phase-diagrams/setup.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.5 KiB |
@ -3,9 +3,9 @@
|
||||
## [BitLocker](bitlocker\bitlocker-overview.md)
|
||||
### [Overview of BitLocker Device Encryption in Windows 10](bitlocker\bitlocker-device-encryption-overview-windows-10.md)
|
||||
### [BitLocker frequently asked questions (FAQ)](bitlocker\bitlocker-frequently-asked-questions.md)
|
||||
#### [Overview and requirements](bitlocker\bitlocker-overview-and-requirements-faq.md)
|
||||
#### [Overview and requirements](bitlocker\bitlocker-overview-and-requirements-faq.yml)
|
||||
#### [Upgrading](bitlocker\bitlocker-upgrading-faq.md)
|
||||
#### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.md)
|
||||
#### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.yml)
|
||||
#### [Key management](bitlocker\bitlocker-key-management-faq.md)
|
||||
#### [BitLocker To Go](bitlocker\bitlocker-to-go-faq.md)
|
||||
#### [Active Directory Domain Services](bitlocker\bitlocker-and-adds-faq.md)
|
||||
|
||||
@ -1,101 +0,0 @@
|
||||
---
|
||||
title: BitLocker deployment and administration FAQ (Windows 10)
|
||||
description: Browse frequently asked questions about BitLocker deployment and administration, such as, "Can BitLocker deployment be automated in an enterprise environment?"
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker frequently asked questions (FAQ)
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
## Can BitLocker deployment be automated in an enterprise environment?
|
||||
|
||||
Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](https://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/bitlocker/index?view=win10-ps).
|
||||
|
||||
## Can BitLocker encrypt more than just the operating system drive?
|
||||
|
||||
Yes.
|
||||
|
||||
## Is there a noticeable performance impact when BitLocker is enabled on a computer?
|
||||
|
||||
Generally it imposes a single-digit percentage performance overhead.
|
||||
|
||||
## How long will initial encryption take when BitLocker is turned on?
|
||||
|
||||
Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting large drives, you may want to set encryption to occur during times when you will not be using the drive.
|
||||
|
||||
You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted.
|
||||
|
||||
## What happens if the computer is turned off during encryption or decryption?
|
||||
|
||||
If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable.
|
||||
|
||||
## Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data?
|
||||
|
||||
No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive.
|
||||
|
||||
## How can I prevent users on a network from storing data on an unencrypted drive?
|
||||
|
||||
You can configure Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only.
|
||||
|
||||
## What is Used Disk Space Only encryption?
|
||||
|
||||
BitLocker in Windows 10 lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to be encrypted. For more information, see [Used Disk Space Only encryption](bitlocker-device-encryption-overview-windows-10.md#used-disk-space-only-encryption).
|
||||
|
||||
## What system changes would cause the integrity check on my operating system drive to fail?
|
||||
|
||||
The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive:
|
||||
|
||||
- Moving the BitLocker-protected drive into a new computer.
|
||||
- Installing a new motherboard with a new TPM.
|
||||
- Turning off, disabling, or clearing the TPM.
|
||||
- Changing any boot configuration settings.
|
||||
- Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data.
|
||||
|
||||
## What causes BitLocker to start into recovery mode when attempting to start the operating system drive?
|
||||
|
||||
Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode.
|
||||
For example:
|
||||
|
||||
- Changing the BIOS boot order to boot another drive in advance of the hard drive.
|
||||
- Adding or removing hardware, such as inserting a new card in the computer, including some PCMIA wireless cards.
|
||||
- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer.
|
||||
|
||||
In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password.
|
||||
The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed.
|
||||
|
||||
## What can prevent BitLocker from binding to PCR 7?
|
||||
|
||||
BitLocker can be prevented from binding to PCR 7 if a non-Windows OS booted prior to Windows, or if Secure Boot is not available to the device, either because it has been disabled or the hardware does not support it.
|
||||
|
||||
## Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive?
|
||||
|
||||
Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive. So if you want to prepare a backup operating system or data drive in case a disk fails, make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts.
|
||||
|
||||
## Can I access my BitLocker-protected drive if I insert the hard disk into a different computer?
|
||||
|
||||
Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key.
|
||||
|
||||
## Why is "Turn BitLocker on" not available when I right-click a drive?
|
||||
Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted.
|
||||
|
||||
## What type of disk configurations are supported by BitLocker?
|
||||
Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported.
|
||||
|
||||
|
||||
@ -0,0 +1,97 @@
|
||||
### YamlMime:FAQ
|
||||
metadata:
|
||||
title: BitLocker deployment and administration FAQ (Windows 10)
|
||||
description: Browse frequently asked questions about BitLocker deployment and administration, such as, "Can BitLocker deployment be automated in an enterprise environment?"
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
|
||||
title: BitLocker frequently asked questions (FAQ)
|
||||
summary: |
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
|
||||
sections:
|
||||
- name: Ignored
|
||||
questions:
|
||||
- question: Can BitLocker deployment be automated in an enterprise environment?
|
||||
answer: |
|
||||
Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](https://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/bitlocker/index?view=win10-ps).
|
||||
|
||||
- question: Can BitLocker encrypt more than just the operating system drive?
|
||||
answer: Yes.
|
||||
|
||||
- question: Is there a noticeable performance impact when BitLocker is enabled on a computer?
|
||||
answer: Generally it imposes a single-digit percentage performance overhead.
|
||||
|
||||
- question: How long will initial encryption take when BitLocker is turned on?
|
||||
answer: |
|
||||
Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting large drives, you may want to set encryption to occur during times when you will not be using the drive.
|
||||
|
||||
You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted.
|
||||
|
||||
- question: What happens if the computer is turned off during encryption or decryption?
|
||||
answer: If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable.
|
||||
|
||||
- question: Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data?
|
||||
answer: No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive.
|
||||
|
||||
- question: How can I prevent users on a network from storing data on an unencrypted drive?
|
||||
answer: |
|
||||
You can configure Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only.
|
||||
|
||||
- question: What is Used Disk Space Only encryption?
|
||||
answer: |
|
||||
BitLocker in Windows 10 lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to be encrypted. For more information, see [Used Disk Space Only encryption](bitlocker-device-encryption-overview-windows-10.md#used-disk-space-only-encryption).
|
||||
|
||||
- question: What system changes would cause the integrity check on my operating system drive to fail?
|
||||
answer: |
|
||||
The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive:
|
||||
|
||||
- Moving the BitLocker-protected drive into a new computer.
|
||||
- Installing a new motherboard with a new TPM.
|
||||
- Turning off, disabling, or clearing the TPM.
|
||||
- Changing any boot configuration settings.
|
||||
- Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data.
|
||||
|
||||
- question: What causes BitLocker to start into recovery mode when attempting to start the operating system drive?
|
||||
answer: |
|
||||
Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode.
|
||||
For example:
|
||||
|
||||
- Changing the BIOS boot order to boot another drive in advance of the hard drive.
|
||||
- Adding or removing hardware, such as inserting a new card in the computer, including some PCMIA wireless cards.
|
||||
- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer.
|
||||
|
||||
In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password.
|
||||
The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed.
|
||||
|
||||
- question: What can prevent BitLocker from binding to PCR 7?
|
||||
answer: BitLocker can be prevented from binding to PCR 7 if a non-Windows OS booted prior to Windows, or if Secure Boot is not available to the device, either because it has been disabled or the hardware does not support it.
|
||||
|
||||
- question: Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive?
|
||||
answer: Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive. So if you want to prepare a backup operating system or data drive in case a disk fails, make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts.
|
||||
|
||||
- question: Can I access my BitLocker-protected drive if I insert the hard disk into a different computer?
|
||||
answer: Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key.
|
||||
|
||||
- question: Why is "Turn BitLocker on" not available when I right-click a drive?
|
||||
answer: Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted.
|
||||
|
||||
- question: What type of disk configurations are supported by BitLocker?
|
||||
answer: Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported.
|
||||
|
||||
@ -25,9 +25,9 @@ ms.custom: bitlocker
|
||||
|
||||
This topic links to frequently asked questions about BitLocker. BitLocker is a data protection feature that encrypts drives on your computer to help prevent data theft or exposure. BitLocker-protected computers can also delete data more securely when they are decommissioned because it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive.
|
||||
|
||||
- [Overview and requirements](bitlocker-overview-and-requirements-faq.md)
|
||||
- [Overview and requirements](bitlocker-overview-and-requirements-faq.yml)
|
||||
- [Upgrading](bitlocker-upgrading-faq.md)
|
||||
- [Deployment and administration](bitlocker-deployment-and-administration-faq.md)
|
||||
- [Deployment and administration](bitlocker-deployment-and-administration-faq.yml)
|
||||
- [Key management](bitlocker-key-management-faq.md)
|
||||
- [BitLocker To Go](bitlocker-to-go-faq.md)
|
||||
- [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.md)
|
||||
|
||||
@ -1,82 +0,0 @@
|
||||
---
|
||||
title: BitLocker overview and requirements FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use BitLocker.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker Overview and Requirements FAQ
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
## How does BitLocker work?
|
||||
|
||||
**How BitLocker works with operating system drives**
|
||||
|
||||
You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data.
|
||||
|
||||
**How BitLocker works with fixed and removable data drives**
|
||||
|
||||
You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods.
|
||||
|
||||
## Does BitLocker support multifactor authentication?
|
||||
|
||||
Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection.
|
||||
|
||||
## What are the BitLocker hardware and software requirements?
|
||||
|
||||
For requirements, see [System requirements](bitlocker-overview.md#system-requirements).
|
||||
|
||||
> [!NOTE]
|
||||
> Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it cannot be protected by BitLocker.
|
||||
|
||||
## Why are two partitions required? Why does the system drive have to be so large?
|
||||
|
||||
Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive.
|
||||
|
||||
## Which Trusted Platform Modules (TPMs) does BitLocker support?
|
||||
|
||||
BitLocker supports TPM version 1.2 or higher. BitLocker support for TPM 2.0 requires Unified Extensible Firmware Interface (UEFI) for the device.
|
||||
|
||||
> [!NOTE]
|
||||
> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature.
|
||||
|
||||
> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI.
|
||||
|
||||
## How can I tell if a TPM is on my computer?
|
||||
|
||||
Beginning with Windows 10, version 1803, you can check TPM status in **Windows Defender Security Center** > **Device Security** > **Security processor details**. In previous versions of Windows, open the TPM MMC console (tpm.msc) and look under the **Status** heading.
|
||||
|
||||
## Can I use BitLocker on an operating system drive without a TPM?
|
||||
|
||||
Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide.
|
||||
To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements.
|
||||
|
||||
## How do I obtain BIOS support for the TPM on my computer?
|
||||
|
||||
Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements:
|
||||
|
||||
- It is compliant with the TCG standards for a client computer.
|
||||
- It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer.
|
||||
|
||||
## What credentials are required to use BitLocker?
|
||||
|
||||
To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives.
|
||||
|
||||
## What is the recommended boot order for computers that are going to be BitLocker-protected?
|
||||
|
||||
You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.
|
||||
@ -0,0 +1,82 @@
|
||||
### YamlMime:FAQ
|
||||
metadata:
|
||||
title: BitLocker overview and requirements FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use BitLocker.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
|
||||
title: BitLocker Overview and Requirements FAQ
|
||||
summary: |
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
|
||||
sections:
|
||||
- name: Ignored
|
||||
questions:
|
||||
- question: How does BitLocker work?
|
||||
answer: |
|
||||
**How BitLocker works with operating system drives**
|
||||
|
||||
You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data.
|
||||
|
||||
**How BitLocker works with fixed and removable data drives**
|
||||
|
||||
You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods.
|
||||
|
||||
- question: Does BitLocker support multifactor authentication?
|
||||
answer: Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection.
|
||||
|
||||
- question: What are the BitLocker hardware and software requirements?
|
||||
answer: |
|
||||
For requirements, see [System requirements](bitlocker-overview.md#system-requirements).
|
||||
|
||||
> [!NOTE]
|
||||
> Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it cannot be protected by BitLocker.
|
||||
|
||||
- question: Why are two partitions required? Why does the system drive have to be so large?
|
||||
answer: Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive.
|
||||
|
||||
- question: Which Trusted Platform Modules (TPMs) does BitLocker support?
|
||||
answer: |
|
||||
BitLocker supports TPM version 1.2 or higher. BitLocker support for TPM 2.0 requires Unified Extensible Firmware Interface (UEFI) for the device.
|
||||
|
||||
> [!NOTE]
|
||||
> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature.
|
||||
>
|
||||
> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI.
|
||||
|
||||
- question: How can I tell if a TPM is on my computer?
|
||||
answer: Beginning with Windows 10, version 1803, you can check TPM status in **Windows Defender Security Center** > **Device Security** > **Security processor details**. In previous versions of Windows, open the TPM MMC console (tpm.msc) and look under the **Status** heading.
|
||||
|
||||
- question: Can I use BitLocker on an operating system drive without a TPM?
|
||||
answer: |
|
||||
Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide.
|
||||
To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements.
|
||||
|
||||
- question: How do I obtain BIOS support for the TPM on my computer?
|
||||
answer: |
|
||||
Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements:
|
||||
|
||||
- It is compliant with the TCG standards for a client computer.
|
||||
- It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer.
|
||||
|
||||
- question: What credentials are required to use BitLocker?
|
||||
answer: To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives.
|
||||
|
||||
- question: What is the recommended boot order for computers that are going to be BitLocker-protected?
|
||||
answer: You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.
|
||||
|
||||
@ -11,9 +11,9 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.reviewer:
|
||||
ms.reviewer: pahuijbr
|
||||
manager: dansimp
|
||||
ms.date: 12/11/2020
|
||||
ms.date: 12/17/2020
|
||||
---
|
||||
|
||||
# Microsoft Defender Antivirus compatibility
|
||||
@ -47,13 +47,13 @@ The following table summarizes what happens with Microsoft Defender Antivirus wh
|
||||
| Windows Server 2016 or 2019 | Microsoft Defender Antivirus | Yes | Active mode |
|
||||
| Windows Server 2016 or 2019 | Microsoft Defender Antivirus | No | Active mode |
|
||||
|
||||
(<a id="fn1">1</a>) On Windows Server 2016 or 2019, Microsoft Defender Antivirus will not enter passive or disabled mode if you have also installed a third-party antivirus product. If you install a third-party antivirus product, you should [consider uninstalling Microsoft Defender Antivirus on Windows Server 2016 or 2019](microsoft-defender-antivirus-on-windows-server-2016.md#need-to-uninstall-microsoft-defender-antivirus) to prevent problems caused by having multiple antivirus products installed on a machine.
|
||||
(<a id="fn1">1</a>) On Windows Server 2016 or 2019, Microsoft Defender Antivirus does not enter passive or disabled mode automatically when you install non-Microsoft antivirus product. In those cases, [disable Microsoft Defender Antivirus, or set it to passive mode](microsoft-defender-antivirus-on-windows-server-2016.md#need-to-uninstall-microsoft-defender-antivirus) to prevent problems caused by having multiple antivirus products installed on a server.
|
||||
|
||||
If you are using Windows Server, version 1803 or Windows Server 2019, you can enable passive mode by setting this registry key:
|
||||
If you are using Windows Server, version 1803 or Windows Server 2019, you set Microsoft Defender Antivirus to passive mode by setting this registry key:
|
||||
- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`
|
||||
- Name: ForceDefenderPassiveMode
|
||||
- Type: REG_DWORD
|
||||
- Value: 1
|
||||
- Name: `ForceDefenderPassiveMode`
|
||||
- Type: `REG_DWORD`
|
||||
- Value: `1`
|
||||
|
||||
See [Microsoft Defender Antivirus on Windows Server 2016 and 2019](microsoft-defender-antivirus-on-windows-server-2016.md) for key differences and management options for Windows Server installations.
|
||||
|
||||
@ -77,7 +77,7 @@ The following table summarizes the functionality and features that are available
|
||||
|
||||
- In Active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files are scanned and threats remediated, and detection information are reported in your configuration tool (such as Configuration Manager or the Microsoft Defender Antivirus app on the machine itself).
|
||||
- In Passive mode, Microsoft Defender Antivirus is not used as the antivirus app, and threats are not remediated by Microsoft Defender Antivirus. Files are scanned and reports are provided for threat detections that are shared with the Microsoft Defender for Endpoint service. Therefore, you might encounter alerts in the Security Center console with Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in Passive mode.
|
||||
- When [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) is turned on and Microsoft Defender Antivirus is not used as the primary antivirus solution, it can still detect and remediate malicious items.
|
||||
- When [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) is turned on and Microsoft Defender Antivirus is not the primary antivirus solution, it can still detect and remediate malicious items.
|
||||
- When disabled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated.
|
||||
|
||||
## Keep the following points in mind
|
||||
|
||||
@ -10,12 +10,12 @@ ms.sitesec: library
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 12/16/2020
|
||||
ms.reviewer:
|
||||
ms.date: 12/17/2020
|
||||
ms.reviewer: pahuijbr
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Microsoft Defender Antivirus on Windows Server 2019 and Windows Server 2016
|
||||
# Microsoft Defender Antivirus on Windows Server 2016 and Windows Server 2019
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
@ -23,9 +23,9 @@ manager: dansimp
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
Microsoft Defender Antivirus is available on Windows Server 2019 and Windows Server 2016. In some instances, Microsoft Defender Antivirus is referred to as *Endpoint Protection*; however, the protection engine is the same.
|
||||
Microsoft Defender Antivirus is available on Windows Server 2016 and 2019. In some instances, Microsoft Defender Antivirus is referred to as *Endpoint Protection*; however, the protection engine is the same.
|
||||
|
||||
While the functionality, configuration, and management are largely the same for [Microsoft Defender Antivirus on Windows 10](microsoft-defender-antivirus-in-windows-10.md), there are a few key differences on Windows Server 2019 and Windows Server 2016:
|
||||
While the functionality, configuration, and management are largely the same for [Microsoft Defender Antivirus on Windows 10](microsoft-defender-antivirus-in-windows-10.md), there are a few key differences on Windows Server 2016 and 2019:
|
||||
|
||||
- In Windows Server, [automatic exclusions](configure-server-exclusions-microsoft-defender-antivirus.md) are applied based on your defined Server Role.
|
||||
- In Windows Server, Microsoft Defender Antivirus does not automatically disable itself if you are running another antivirus product.
|
||||
@ -34,9 +34,9 @@ While the functionality, configuration, and management are largely the same for
|
||||
|
||||
The process of setting up and running Microsoft Defender Antivirus on a server platform includes several steps:
|
||||
|
||||
1. [Enable the interface](#enable-the-user-interface-on-windows-server-2019-or-windows-server-2016)
|
||||
1. [Enable the interface](#enable-the-user-interface-on-windows-server-2016-or-2019)
|
||||
|
||||
2. [Install Microsoft Defender Antivirus](#install-microsoft-defender-antivirus-on-windows-server-2019-or-windows-server-2016)
|
||||
2. [Install Microsoft Defender Antivirus](#install-microsoft-defender-antivirus-on-windows-server-2016-or-2019)
|
||||
|
||||
2. [Verify Microsoft Defender Antivirus is running](#verify-microsoft-defender-antivirus-is-running)
|
||||
|
||||
@ -48,9 +48,9 @@ The process of setting up and running Microsoft Defender Antivirus on a server p
|
||||
|
||||
6. (Only if necessary) [Uninstall Microsoft Defender Antivirus](#need-to-uninstall-microsoft-defender-antivirus)
|
||||
|
||||
## Enable the user interface on Windows Server 2019 or Windows Server 2016
|
||||
## Enable the user interface on Windows Server 2016 or 2019
|
||||
|
||||
By default, Microsoft Defender Antivirus is installed and functional on Windows Server 2019 and Windows Server 2016. The user interface (GUI) is installed by default on some SKUs, but is not required because you can use PowerShell or other methods to manage Microsoft Defender Antivirus. And if the GUI is not installed on your server, you can add it by using the Add Roles and Features Wizard or by using PowerShell.
|
||||
By default, Microsoft Defender Antivirus is installed and functional on Windows Server 2016 and 2019. The user interface (GUI) is installed by default on some SKUs, but is not required because you can use PowerShell or other methods to manage Microsoft Defender Antivirus. And if the GUI is not installed on your server, you can add it by using the Add Roles and Features Wizard or by using PowerShell.
|
||||
|
||||
### Turn on the GUI using the Add Roles and Features Wizard
|
||||
|
||||
@ -72,7 +72,7 @@ The following PowerShell cmdlet will enable the interface:
|
||||
Install-WindowsFeature -Name Windows-Defender-GUI
|
||||
```
|
||||
|
||||
## Install Microsoft Defender Antivirus on Windows Server 2019 or Windows Server 2016
|
||||
## Install Microsoft Defender Antivirus on Windows Server 2016 or 2019
|
||||
|
||||
You can use either the **Add Roles and Features Wizard** or PowerShell to install Microsoft Defender Antivirus.
|
||||
|
||||
@ -173,17 +173,17 @@ See [Configure exclusions in Microsoft Defender Antivirus on Windows Server](con
|
||||
|
||||
## Need to uninstall Microsoft Defender Antivirus?
|
||||
|
||||
If you are using a third-party antivirus solution and you're running into issues with that solution and Microsoft Defender Antivirus, you can consider uninstalling Microsoft Defender Antivirus. Before you do that, review the following resources:
|
||||
If you are using a non-Microsoft antivirus product as your primary antivirus solution, you can either disable Microsoft Defender Antivirus, or set it to passive mode, as described in the following procedures.
|
||||
|
||||
- See the question *Should I run Microsoft security software at the same time as other security products?* in the [Windows Defender Security Intelligence Antivirus and antimalware software FAQ](https://www.microsoft.com/wdsi/help/antimalware-faq#multiple-products).
|
||||
### Set Microsoft Defender Antivirus to passive mode
|
||||
|
||||
- See [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md).
|
||||
If you are using Windows Server, version 1803 or Windows Server 2019, you can set Microsoft Defender Antivirus to passive mode by setting the following registry key:
|
||||
- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`
|
||||
- Name: `ForceDefenderPassiveMode`
|
||||
- Type: `REG_DWORD`
|
||||
- Value: `1`
|
||||
|
||||
- See [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-antivirus). This article describes 10 advantages to using Microsoft Defender Antivirus together with Defender for Endpoint.
|
||||
|
||||
If you determine you do want to uninstall Microsoft Defender Antivirus, follow the steps in the following sections.
|
||||
|
||||
### Uninstall Microsoft Defender Antivirus using the Remove Roles and Features wizard
|
||||
### Disable Microsoft Defender Antivirus using the Remove Roles and Features wizard
|
||||
|
||||
1. See [Install or Uninstall Roles, Role Services, or Features](https://docs.microsoft.com/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#remove-roles-role-services-and-features-by-using-the-remove-roles-and-features-wizard), and use the **Remove Roles and Features Wizard**.
|
||||
|
||||
@ -193,18 +193,18 @@ If you determine you do want to uninstall Microsoft Defender Antivirus, follow t
|
||||
|
||||
Microsoft Defender Antivirus will still run normally without the user interface, but the user interface cannot be enabled if you disable the core **Windows Defender** feature.
|
||||
|
||||
### Uninstall Microsoft Defender Antivirus using PowerShell
|
||||
### Disable Microsoft Defender Antivirus using PowerShell
|
||||
|
||||
>[!NOTE]
|
||||
>You can't uninstall the Windows Security app, but you can disable the interface with these instructions.
|
||||
|
||||
The following PowerShell cmdlet uninstalls Microsoft Defender Antivirus on Windows Server 2019 or Windows Server 2016:
|
||||
The following PowerShell cmdlet uninstalls Microsoft Defender Antivirus on Windows Server 2016 or 2019:
|
||||
|
||||
```PowerShell
|
||||
Uninstall-WindowsFeature -Name Windows-Defender
|
||||
```
|
||||
|
||||
### Turn off the GUI using PowerShell
|
||||
### Turn off the Microsoft Defender Antivirus user interface using PowerShell
|
||||
|
||||
To turn off the Microsoft Defender Antivirus GUI, use the following PowerShell cmdlet:
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ ms.topic: conceptual
|
||||
|
||||
- [Defender for Endpoint](microsoft-defender-atp-android.md)
|
||||
|
||||
This topic describes deploying Defender for Endpoint for Android on Intune
|
||||
Learn how to deploy Defender for Endpoint for Android on Intune
|
||||
Company Portal enrolled devices. For more information about Intune device enrollment, see [Enroll your
|
||||
device](https://docs.microsoft.com/mem/intune/user-help/enroll-device-android-company-portal).
|
||||
|
||||
@ -44,13 +44,13 @@ device](https://docs.microsoft.com/mem/intune/user-help/enroll-device-android-co
|
||||
**Deploy Defender for Endpoint for Android on Intune Company Portal - Device
|
||||
Administrator enrolled devices**
|
||||
|
||||
This topic describes how to deploy Defender for Endpoint for Android on Intune Company Portal - Device Administrator enrolled devices.
|
||||
Learn how to deploy Defender for Endpoint for Android on Intune Company Portal - Device Administrator enrolled devices.
|
||||
|
||||
### Add as Android store app
|
||||
|
||||
1. In [Microsoft Endpoint Manager admin
|
||||
center](https://go.microsoft.com/fwlink/?linkid=2109431) , go to **Apps** \>
|
||||
**Android Apps** \> **Add \> Android store app** and click **Select**.
|
||||
**Android Apps** \> **Add \> Android store app** and choose **Select**.
|
||||
|
||||
|
||||
|
||||
@ -60,13 +60,13 @@ center](https://go.microsoft.com/fwlink/?linkid=2109431) , go to **Apps** \>
|
||||
- **Name**
|
||||
- **Description**
|
||||
- **Publisher** as Microsoft.
|
||||
- **Appstore URL** as https://play.google.com/store/apps/details?id=com.microsoft.scmx (Defender for Endpoint app Google Play Store URL)
|
||||
- **App store URL** as https://play.google.com/store/apps/details?id=com.microsoft.scmx (Defender for Endpoint app Google Play Store URL)
|
||||
|
||||
Other fields are optional. Select **Next**.
|
||||
|
||||
|
||||
|
||||
3. In the *Assignments* section, go to the **Required** section and select **Add group.** You can then choose the user group(s) that you would like to target Defender for Endpoint for Android app. Click **Select** and then **Next**.
|
||||
3. In the *Assignments* section, go to the **Required** section and select **Add group.** You can then choose the user group(s) that you would like to target Defender for Endpoint for Android app. Choose **Select** and then **Next**.
|
||||
|
||||
>[!NOTE]
|
||||
>The selected user group should consist of Intune enrolled users.
|
||||
@ -111,7 +111,7 @@ Defender for Endpoint for Android supports Android Enterprise enrolled devices.
|
||||
For more information on the enrollment options supported by Intune, see
|
||||
[Enrollment Options](https://docs.microsoft.com/mem/intune/enrollment/android-enroll).
|
||||
|
||||
**Currently, Personally-owned devices with work profile and Corporate-owned fully managed user device enrollments are supported for deployment.**
|
||||
**Currently, Personally owned devices with work profile and Corporate-owned fully managed user device enrollments are supported for deployment.**
|
||||
|
||||
|
||||
|
||||
@ -141,7 +141,7 @@ select **Approve**.
|
||||
> 
|
||||
|
||||
|
||||
4. You should now be presented with the permissions that Defender for Endpoint
|
||||
4. You'll be presented with the permissions that Defender for Endpoint
|
||||
obtains for it to work. Review them and then select **Approve**.
|
||||
|
||||
|
||||
@ -218,7 +218,7 @@ Defender ATP should be visible in the apps list.
|
||||
|
||||
1. In the **Review + Create** page that comes up next, review all the information and then select **Create**. <br>
|
||||
|
||||
The app configuration policy for Defender for Endpoint auto-granting the storage permission is now assigned to the selected user group.
|
||||
The app configuration policy for Defender for Endpoint autogranting the storage permission is now assigned to the selected user group.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
@ -244,11 +244,11 @@ above. Then select **Review + Save** and then **Save** again to commence
|
||||
assignment.
|
||||
|
||||
### Auto Setup of Always-on VPN
|
||||
Defender for Endpoint supports Device configuration policies for managed devices via Intune. This capability can be leveraged to **Auto setup of Always-on VPN** on Android Enterprise enrolled devices, so the end user does not need to setup VPN service while onboarding.
|
||||
1. On **Devices** Page go to **Configuration Profiles** > **Create Profile** > **Platform** > **Android Enterprise**
|
||||
Defender for Endpoint supports Device configuration policies for managed devices via Intune. This capability can be leveraged to **Auto setup of Always-on VPN** on Android Enterprise enrolled devices, so the end user does not need to set up VPN service while onboarding.
|
||||
1. On **Devices**, select **Configuration Profiles** > **Create Profile** > **Platform** > **Android Enterprise**
|
||||
Select **Device restrictions** under one of the following, based on your device enrollment type
|
||||
- **Fully Managed, Dedicated, and Corporate-Owned Work Profile**
|
||||
- **Personally-Owned Work Profile**
|
||||
- **Personally owned Work Profile**
|
||||
|
||||
Select **Create**.
|
||||
|
||||
@ -292,7 +292,7 @@ displayed here.
|
||||
> 
|
||||
|
||||
|
||||
2. On the device, you can validate the onboarding status by going to the **work profile**. Confirm that Defender for Endpoint is available and that you are enrolled to the **Personally-owned devices with work profile**. If you are enrolled to a **Corporate-owned, fully managed user device**, you will have a single profile on the device where you can confirm that Defender for Endpoint is available.
|
||||
2. On the device, you can validate the onboarding status by going to the **work profile**. Confirm that Defender for Endpoint is available and that you are enrolled to the **Personally owned devices with work profile**. If you are enrolled to a **Corporate-owned, fully managed user device**, you will have a single profile on the device where you can confirm that Defender for Endpoint is available.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -34,9 +34,10 @@ This guide helps you work across stakeholders to prepare your environment and th
|
||||
|
||||
Each section corresponds to a separate article in this solution.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|Phase | Description |
|
||||
|:-------|:-----|
|
||||
|
||||
Binary file not shown.
Binary file not shown.
|
After Width: | Height: | Size: 5.6 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 5.6 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 1.9 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 1.7 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 1.5 KiB |
@ -2,7 +2,7 @@
|
||||
title: Create indicators based on certificates
|
||||
ms.reviewer:
|
||||
description: Create indicators based on certificates that define the detection, prevention, and exclusion of entities.
|
||||
keywords: ioc, certificate, certificates, manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain
|
||||
keywords: ioc, certificate, certificates, manage, allowed, blocked, block, clean, malicious, file hash, ip address, urls, domain
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -39,11 +39,11 @@ You can create indicators for certificates. Some common use cases include:
|
||||
|
||||
It's important to understand the following requirements prior to creating indicators for certificates:
|
||||
|
||||
- This feature is available if your organization uses Windows Defender Antivirus and Cloud-based protection is enabled. For more information, see [Manage cloud-based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md).
|
||||
- This feature is available if your organization uses Windows Defender Antivirus and Cloud-based protection is enabled. For more information, see [Manage cloud-based protection](../microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md).
|
||||
- The Antimalware client version must be 4.18.1901.x or later.
|
||||
- Supported on machines on Windows 10, version 1703 or later, Windows server 2016 and 2019.
|
||||
- The virus and threat protection definitions must be up to date.
|
||||
- This feature currently supports entering .CER or .PEM (Base64 ASCII) encoding based certificates.
|
||||
- This feature currently supports entering .CER or .PEM file extensions.
|
||||
|
||||
>[!IMPORTANT]
|
||||
> - A valid leaf certificate is a signing certificate that has a valid certification path and must be chained to the Root Certificate Authority (CA) trusted by Microsoft. Alternatively, a custom (self-signed) certificate can be used as long as it's trusted by the client (Root CA certificate is installed under the Local Machine 'Trusted Root Certification Authorities').
|
||||
|
||||
@ -293,6 +293,7 @@ Each command is tracked with full details such as:
|
||||
|
||||
- Live response sessions are limited to 10 live response sessions at a time.
|
||||
- Large-scale command execution is not supported.
|
||||
- Live response session inactive timeout value is 5 minutes.
|
||||
- A user can only initiate one session at a time.
|
||||
- A device can only be in one session at a time.
|
||||
- The following file size limits apply:
|
||||
|
||||
@ -35,11 +35,14 @@ If you are planning to switch from McAfee Endpoint Security (McAfee) to [Microso
|
||||
|
||||
When you switch from McAfee to Microsoft Defender for Endpoint, you follow a process that can be divided into three phases, as described in the following table:
|
||||
|
||||
|
||||
|
||||
|
||||
|Phase |Description |
|
||||
|--|--|
|
||||
|[](mcafee-to-microsoft-defender-prepare.md)<br/>[Prepare for your migration](mcafee-to-microsoft-defender-prepare.md) |During [the **Prepare** phase](mcafee-to-microsoft-defender-prepare.md), you update your organization's devices, get Microsoft Defender for Endpoint, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender for Endpoint. |
|
||||
|[](mcafee-to-microsoft-defender-setup.md)<br/>[Set up Microsoft Defender for Endpoint](mcafee-to-microsoft-defender-setup.md) |During [the **Setup** phase](mcafee-to-microsoft-defender-setup.md), you enable Microsoft Defender Antivirus and make sure it's in passive mode, and you configure settings & exclusions for Microsoft Defender Antivirus, Microsoft Defender for Endpoint, and McAfee. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.|
|
||||
|[](mcafee-to-microsoft-defender-onboard.md)<br/>[Onboard to Microsoft Defender for Endpoint](mcafee-to-microsoft-defender-onboard.md) |During [the **Onboard** phase](mcafee-to-microsoft-defender-onboard.md), you onboard your devices to Microsoft Defender for Endpoint and verify that those devices are communicating with Microsoft Defender for Endpoint. Last, you uninstall McAfee and make sure that protection through Microsoft Defender Antivirus & Microsoft Defender for Endpoint is in active mode. |
|
||||
|[Prepare for your migration](mcafee-to-microsoft-defender-prepare.md) |During [the **Prepare** phase](mcafee-to-microsoft-defender-prepare.md), you update your organization's devices, get Microsoft Defender for Endpoint, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender for Endpoint. |
|
||||
|[Set up Microsoft Defender for Endpoint](mcafee-to-microsoft-defender-setup.md) |During [the **Setup** phase](mcafee-to-microsoft-defender-setup.md), you enable Microsoft Defender Antivirus and make sure it's in passive mode, and you configure settings & exclusions for Microsoft Defender Antivirus, Microsoft Defender for Endpoint, and McAfee. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.|
|
||||
|[Onboard to Microsoft Defender for Endpoint](mcafee-to-microsoft-defender-onboard.md) |During [the **Onboard** phase](mcafee-to-microsoft-defender-onboard.md), you onboard your devices to Microsoft Defender for Endpoint and verify that those devices are communicating with Microsoft Defender for Endpoint. Last, you uninstall McAfee and make sure that protection through Microsoft Defender Antivirus & Microsoft Defender for Endpoint is in active mode. |
|
||||
|
||||
## What's included in Microsoft Defender for Endpoint?
|
||||
|
||||
|
||||
@ -28,12 +28,10 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
|[](mcafee-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](mcafee-to-microsoft-defender-prepare.md) |[](mcafee-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](mcafee-to-microsoft-defender-setup.md) |<br/>Phase 3: Onboard |
|
||||
|[](mcafee-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](mcafee-to-microsoft-defender-prepare.md) |[](mcafee-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](mcafee-to-microsoft-defender-setup.md) |<br/>Phase 3: Onboard |
|
||||
|--|--|--|
|
||||
|| |*You are here!* |
|
||||
|
||||
|
||||
**Welcome to Phase 3 of [migrating from McAfee Endpoint Security (McAfee) to Microsoft Defender Advanced Threat Protection (Microsoft Defender for Endpoint)](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This migration phase includes the following steps:
|
||||
|
||||
1. [Onboard devices to Microsoft Defender for Endpoint](#onboard-devices-to-microsoft-defender-for-endpoint).
|
||||
|
||||
@ -29,7 +29,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
|<br/>Phase 1: Prepare |[](mcafee-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](mcafee-to-microsoft-defender-setup.md) |[](mcafee-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](mcafee-to-microsoft-defender-onboard.md) |
|
||||
|<br/>Phase 1: Prepare |[](mcafee-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](mcafee-to-microsoft-defender-setup.md) |[](mcafee-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](mcafee-to-microsoft-defender-onboard.md) |
|
||||
|--|--|--|
|
||||
|*You are here!*| | |
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
|[](mcafee-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](mcafee-to-microsoft-defender-prepare.md) |<br/>Phase 2: Set up |[](mcafee-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](mcafee-to-microsoft-defender-onboard.md) |
|
||||
|[](mcafee-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](mcafee-to-microsoft-defender-prepare.md) |<br/>Phase 2: Set up |[](mcafee-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](mcafee-to-microsoft-defender-onboard.md) |
|
||||
|--|--|--|
|
||||
||*You are here!* | |
|
||||
|
||||
|
||||
@ -29,28 +29,9 @@ ms.topic: article
|
||||
|
||||
Deploying Defender for Endpoint is a three-phase process:
|
||||
|
||||
<br>
|
||||
<table border="0" width="100%" align="center">
|
||||
<tr style="text-align:center;">
|
||||
<td align="center" style="width:25%; border:0;" >
|
||||
<a href= "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment">
|
||||
<img src="images/prepare.png" alt="Prepare to deploy Defender for Endpoint" title="Prepare" />
|
||||
<br/>Phase 1: Prepare </a><br>
|
||||
</td>
|
||||
<td align="center">
|
||||
<a href="https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment">
|
||||
<img src="images/setup.png" alt="Setup the Defender for Endpoint service" title="Setup" />
|
||||
<br/>Phase 2: Set up </a><br>
|
||||
</td>
|
||||
<td align="center" bgcolor="#d5f5e3">
|
||||
<a href="https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboarding">
|
||||
<img src="images/onboard.png" alt="Onboard diagram" title="Onboard to the Defender for Endpoint service" />
|
||||
<br/>Phase 3: Onboard </a><br>
|
||||
</td>
|
||||
|
||||
|
||||
</tr>
|
||||
</table>
|
||||
| [](prepare-deployment.md)<br>[Phase 1: Prepare](prepare-deployment.md) | [](production-deployment.md)<br>[Phase 2: Setup](production-deployment.md) | <br>Phase 3: Onboard |
|
||||
| ----- | ----- | ----- |
|
||||
| | |*You are here!*|
|
||||
|
||||
You are currently in the onboarding phase.
|
||||
|
||||
|
||||
@ -33,37 +33,10 @@ ms.topic: article
|
||||
|
||||
Deploying Defender for Endpoint is a three-phase process:
|
||||
|
||||
<br>
|
||||
<table border="0" width="100%" align="center">
|
||||
<tr style="text-align:center;">
|
||||
<td align="center" style="width:25%; border:0;" bgcolor="#d5f5e3">
|
||||
<a href= "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment">
|
||||
<img src="images/prepare.png" alt="Plan to deploy Microsoft Defender for Endpoint" title="Plan" />
|
||||
<br/>Phase 1: Prepare </a><br>
|
||||
</td>
|
||||
<td align="center" >
|
||||
<a href="https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment">
|
||||
<img src="images/setup.png" alt="Onboard to the Defender for Endpoint service" title="Setup the Defender for Endpoint service" />
|
||||
<br/>Phase 2: Set up </a><br>
|
||||
</td>
|
||||
<td align="center">
|
||||
<a href="https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboarding">
|
||||
<img src="images/onboard.png" alt="Configure capabilities" title="Configure capabilities" />
|
||||
<br/>Phase 3: Onboard</a><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="width:25%; border:0;">
|
||||
|
||||
</td>
|
||||
<td valign="top" style="width:25%; border:0;">
|
||||
|
||||
</td>
|
||||
<td valign="top" style="width:25%; border:0;">
|
||||
| <br>Phase 1: Prepare | [](production-deployment.md)<br>[Phase 2: Setup](production-deployment.md) | [](onboarding.md)<br>[Phase 3: Onboard](onboarding.md) |
|
||||
| ----- | ----- | ----- |
|
||||
|*You are here!* | ||
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
You are currently in the preparation phase.
|
||||
|
||||
|
||||
@ -31,28 +31,9 @@ ms.topic: article
|
||||
|
||||
Deploying Defender for Endpoint is a three-phase process:
|
||||
|
||||
<br>
|
||||
<table border="0" width="100%" align="center">
|
||||
<tr style="text-align:center;">
|
||||
<td align="center" style="width:25%; border:0;" >
|
||||
<a href= "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment">
|
||||
<img src="images/prepare.png" alt="Prepare to deploy Microsoft Defender for Endpoint" title="Prepare" />
|
||||
<br/>Phase 1: Prepare </a><br>
|
||||
</td>
|
||||
<td align="center"bgcolor="#d5f5e3">
|
||||
<a href="https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment">
|
||||
<img src="images/setup.png" alt="Onboard to the Microsoft Defender for Endpoint service" title="Setup" />
|
||||
<br/>Phase 2: Set up </a><br>
|
||||
</td>
|
||||
<td align="center">
|
||||
<a href="https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboarding">
|
||||
<img src="images/onboard.png" alt="Onboard image" title="Onboard" />
|
||||
<br/>Phase 3: Onboard </a><br>
|
||||
</td>
|
||||
|
||||
|
||||
</tr>
|
||||
</table>
|
||||
| [](prepare-deployment.md)<br>[Phase 1: Prepare](prepare-deployment.md) | <br>Phase 2: Setup | [](onboarding.md)<br>[Phase 3: Onboard](onboarding.md) |
|
||||
| ----- | ----- | ----- |
|
||||
| | *You are here!*||
|
||||
|
||||
You are currently in the set-up phase.
|
||||
|
||||
|
||||
@ -35,11 +35,13 @@ If you are planning to switch from a non-Microsoft endpoint protection solution
|
||||
|
||||
When you switch to Microsoft Defender for Endpoint, you follow a process that can be divided into three phases, as described in the following table:
|
||||
|
||||
|
||||
|
||||
|Phase |Description |
|
||||
|--|--|
|
||||
|[](switch-to-microsoft-defender-prepare.md)<br/>[Prepare for your migration](switch-to-microsoft-defender-prepare.md) |During [the **Prepare** phase](switch-to-microsoft-defender-prepare.md), you update your organization's devices, get Microsoft Defender for Endpoint, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender for Endpoint. |
|
||||
|[](switch-to-microsoft-defender-setup.md)<br/>[Set up Microsoft Defender for Endpoint](switch-to-microsoft-defender-setup.md) |During [the **Setup** phase](switch-to-microsoft-defender-setup.md), you enable Microsoft Defender Antivirus and make sure it's in passive mode, and you configure settings & exclusions for Microsoft Defender Antivirus, Microsoft Defender for Endpoint, and your existing endpoint protection solution. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.|
|
||||
|[](switch-to-microsoft-defender-onboard.md)<br/>[Onboard to Microsoft Defender for Endpoint](switch-to-microsoft-defender-onboard.md) |During [the **Onboard** phase](switch-to-microsoft-defender-onboard.md), you onboard your devices to Microsoft Defender for Endpoint and verify that those devices are communicating with Microsoft Defender for Endpoint. Last, you uninstall your existing endpoint protection solution and make sure that protection through Microsoft Defender Antivirus & Microsoft Defender for Endpoint is in active mode. |
|
||||
|[Prepare for your migration](switch-to-microsoft-defender-prepare.md) |During [the **Prepare** phase](switch-to-microsoft-defender-prepare.md), you update your organization's devices, get Microsoft Defender for Endpoint, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender for Endpoint. |
|
||||
|[Set up Microsoft Defender for Endpoint](switch-to-microsoft-defender-setup.md) |During [the **Setup** phase](switch-to-microsoft-defender-setup.md), you enable Microsoft Defender Antivirus and make sure it's in passive mode, and you configure settings & exclusions for Microsoft Defender Antivirus, Microsoft Defender for Endpoint, and your existing endpoint protection solution. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.|
|
||||
|[Onboard to Microsoft Defender for Endpoint](switch-to-microsoft-defender-onboard.md) |During [the **Onboard** phase](switch-to-microsoft-defender-onboard.md), you onboard your devices to Microsoft Defender for Endpoint and verify that those devices are communicating with Microsoft Defender for Endpoint. Last, you uninstall your existing endpoint protection solution and make sure that protection through Microsoft Defender Antivirus & Microsoft Defender for Endpoint is in active mode. |
|
||||
|
||||
## What's included in Microsoft Defender for Endpoint?
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
|
||||
# Switch to Microsoft Defender for Endpoint - Phase 3: Onboard
|
||||
|
||||
|[](switch-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](switch-to-microsoft-defender-prepare.md) |[](switch-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](switch-to-microsoft-defender-setup.md) |<br/>Phase 3: Onboard |
|
||||
|[](switch-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](switch-to-microsoft-defender-prepare.md) |[](switch-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](switch-to-microsoft-defender-setup.md) |<br/>Phase 3: Onboard |
|
||||
|--|--|--|
|
||||
|| |*You are here!* |
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
|
||||
# Switch to Microsoft Defender for Endpoint - Phase 1: Prepare
|
||||
|
||||
|<br/>Phase 1: Prepare |[](switch-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](switch-to-microsoft-defender-setup.md) |[](switch-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](switch-to-microsoft-defender-onboard.md) |
|
||||
|<br/>Phase 1: Prepare |[](switch-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](switch-to-microsoft-defender-setup.md) |[](switch-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](switch-to-microsoft-defender-onboard.md) |
|
||||
|--|--|--|
|
||||
|*You are here!*| | |
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
|
||||
# Switch to Microsoft Defender for Endpoint - Phase 2: Setup
|
||||
|
||||
|[](switch-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](switch-to-microsoft-defender-prepare.md) |<br/>Phase 2: Set up |[](switch-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](switch-to-microsoft-defender-onboard.md) |
|
||||
|[](switch-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](switch-to-microsoft-defender-prepare.md) |<br/>Phase 2: Set up |[](switch-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](switch-to-microsoft-defender-onboard.md) |
|
||||
|--|--|--|
|
||||
||*You are here!* | |
|
||||
|
||||
@ -87,11 +87,11 @@ The [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/d
|
||||
|
||||
`Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender` <br/>
|
||||
|
||||
> [!NOTE]
|
||||
> When using the DISM command within a task sequence running PS, the following path to cmd.exe is required.
|
||||
> Example:<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features`<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`<br/>
|
||||
> [!NOTE]
|
||||
> When using the DISM command within a task sequence running PS, the following path to cmd.exe is required.
|
||||
> Example:<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features`<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`<br/>
|
||||
|
||||
3. To verify Microsoft Defender Antivirus is running, use the following PowerShell cmdlet: <br/>
|
||||
|
||||
@ -227,12 +227,13 @@ To use CMPivot to get your file hash, follow these steps:
|
||||
|
||||
6. In the query box, type the following query:<br/>
|
||||
|
||||
```kusto
|
||||
File(c:\\windows\\notepad.exe)
|
||||
| project Hash
|
||||
```
|
||||
> [!NOTE]
|
||||
> In the query above, replace *notepad.exe* with the your third-party security product process name.
|
||||
```kusto
|
||||
File(c:\\windows\\notepad.exe)
|
||||
| project Hash
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> In the query above, replace *notepad.exe* with the your third-party security product process name.
|
||||
|
||||
## Set up your device groups, device collections, and organizational units
|
||||
|
||||
|
||||
@ -35,11 +35,13 @@ If you are planning to switch from Symantec Endpoint Protection (Symantec) to [M
|
||||
|
||||
When you switch from Symantec to Microsoft Defender for Endpoint, you follow a process that can be divided into three phases, as described in the following table:
|
||||
|
||||
|
||||
|
||||
|Phase |Description |
|
||||
|--|--|
|
||||
|[](symantec-to-microsoft-defender-atp-prepare.md)<br/>[Prepare for your migration](symantec-to-microsoft-defender-atp-prepare.md) |During the **Prepare** phase, you get Microsoft Defender for Endpoint, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender for Endpoint. |
|
||||
|[](symantec-to-microsoft-defender-atp-setup.md)<br/>[Set up Microsoft Defender for Endpoint](symantec-to-microsoft-defender-atp-setup.md) |During the **Setup** phase, you configure settings and exclusions for Microsoft Defender Antivirus, Microsoft Defender for Endpoint, and Symantec Endpoint Protection. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.|
|
||||
|[](symantec-to-microsoft-defender-atp-onboard.md)<br/>[Onboard to Microsoft Defender for Endpoint](symantec-to-microsoft-defender-atp-onboard.md) |During the **Onboard** phase, you onboard your devices to Microsoft Defender for Endpoint and verify that those devices are communicating with Microsoft Defender for Endpoint. Last, you uninstall Symantec and make sure protection through Microsoft Defender for Endpoint is in active mode. |
|
||||
|[Prepare for your migration](symantec-to-microsoft-defender-atp-prepare.md) |During the **Prepare** phase, you get Microsoft Defender for Endpoint, plan your roles and permissions, and grant access to the Microsoft Defender Security Center. You also configure your device proxy and internet settings to enable communication between your organization's devices and Microsoft Defender for Endpoint. |
|
||||
|[Set up Microsoft Defender for Endpoint](symantec-to-microsoft-defender-atp-setup.md) |During the **Setup** phase, you configure settings and exclusions for Microsoft Defender Antivirus, Microsoft Defender for Endpoint, and Symantec Endpoint Protection. You also create device groups, collections, and organizational units. Finally, you configure your antimalware policies and real-time protection settings.|
|
||||
|[Onboard to Microsoft Defender for Endpoint](symantec-to-microsoft-defender-atp-onboard.md) |During the **Onboard** phase, you onboard your devices to Microsoft Defender for Endpoint and verify that those devices are communicating with Microsoft Defender for Endpoint. Last, you uninstall Symantec and make sure protection through Microsoft Defender for Endpoint is in active mode. |
|
||||
|
||||
## What's included in Microsoft Defender for Endpoint?
|
||||
|
||||
|
||||
@ -28,7 +28,7 @@ ms.reviewer: depicker, yongrhee, chriggs
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
|[](symantec-to-microsoft-defender-atp-prepare.md)<br/>[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |[](symantec-to-microsoft-defender-atp-setup.md)<br/>[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |<br/>Phase 3: Onboard |
|
||||
|[](symantec-to-microsoft-defender-atp-prepare.md)<br/>[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |[](symantec-to-microsoft-defender-atp-setup.md)<br/>[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |<br/>Phase 3: Onboard |
|
||||
|--|--|--|
|
||||
|| |*You are here!* |
|
||||
|
||||
|
||||
@ -28,7 +28,7 @@ ms.reviewer: depicker, yongrhee, chriggs
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
|<br/>Phase 1: Prepare |[](symantec-to-microsoft-defender-atp-setup.md)<br/>[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |[](symantec-to-microsoft-defender-atp-onboard.md)<br/>[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) |
|
||||
|<br/>Phase 1: Prepare |[](symantec-to-microsoft-defender-atp-setup.md)<br/>[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |[](symantec-to-microsoft-defender-atp-onboard.md)<br/>[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) |
|
||||
|--|--|--|
|
||||
|*You are here!*| | |
|
||||
|
||||
|
||||
@ -28,7 +28,7 @@ ms.reviewer: depicker, yongrhee, chriggs
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
|[](symantec-to-microsoft-defender-atp-prepare.md)<br/>[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |<br/>Phase 2: Set up |[](symantec-to-microsoft-defender-atp-onboard.md)<br/>[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) |
|
||||
|[](symantec-to-microsoft-defender-atp-prepare.md)<br/>[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |<br/>Phase 2: Set up |[](symantec-to-microsoft-defender-atp-onboard.md)<br/>[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) |
|
||||
|--|--|--|
|
||||
||*You are here!* | |
|
||||
|
||||
@ -64,15 +64,16 @@ Now that you're moving from Symantec to Microsoft Defender for Endpoint, you'll
|
||||
|
||||
1. As a local administrator on the endpoint or device, open Windows PowerShell.
|
||||
|
||||
2. Run the following PowerShell cmdlets: <br/>
|
||||
`Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features` <br/>
|
||||
`Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender` <br/>
|
||||
2. Run the following PowerShell cmdlets:
|
||||
|
||||
> [!NOTE]
|
||||
> When using the DISM command within a task sequence running PS, the following path to cmd.exe is required.
|
||||
> Example:<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features`<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`<br/>
|
||||
`Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features` <br/>
|
||||
`Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`
|
||||
|
||||
> [!NOTE]
|
||||
> When using the DISM command within a task sequence running PS, the following path to cmd.exe is required.
|
||||
> Example:<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features`<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`<br/>
|
||||
|
||||
3. To verify Microsoft Defender Antivirus is running, use the following PowerShell cmdlet: <br/>
|
||||
`Get-Service -Name windefend`
|
||||
@ -174,10 +175,12 @@ To add exclusions to Microsoft Defender for Endpoint, you create [indicators](ht
|
||||
3. On the **File hashes** tab, choose **Add indicator**.
|
||||
|
||||
3. On the **Indicator** tab, specify the following settings:
|
||||
|
||||
- File hash (Need help? See [Find a file hash using CMPivot](#find-a-file-hash-using-cmpivot) in this article.)
|
||||
- Under **Expires on (UTC)**, choose **Never**.
|
||||
|
||||
4. On the **Action** tab, specify the following settings:
|
||||
|
||||
- **Response Action**: **Allow**
|
||||
- Title and description
|
||||
|
||||
@ -203,12 +206,14 @@ To use CMPivot to get your file hash, follow these steps:
|
||||
|
||||
6. In the query box, type the following query:<br/>
|
||||
|
||||
```kusto
|
||||
File(c:\\windows\\notepad.exe)
|
||||
| project Hash
|
||||
```
|
||||
> [!NOTE]
|
||||
> In the query above, replace *notepad.exe* with the your third-party security product process name.
|
||||
```kusto
|
||||
File(c:\\windows\\notepad.exe)
|
||||
| project Hash
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> In the query above, replace *notepad.exe* with the your third-party security product process name.
|
||||
|
||||
|
||||
## Set up your device groups, device collections, and organizational units
|
||||
|
||||
|
||||
@ -167,6 +167,9 @@
|
||||
### [Troubleshooting UWP app connectivity issues in Windows Firewall](troubleshooting-uwp-firewall.md)
|
||||
### [Filter origin audit log improvements)](filter-origin-documentation.md)
|
||||
### [Quarantine behavior](quarantine.md)
|
||||
### [Firewall settings lost on upgrade](firewall-settings-lost-on-upgrade.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,41 @@
|
||||
---
|
||||
title: Troubleshooting Windows Firewall settings after a Windows upgrade
|
||||
description: Firewall settings lost on upgrade
|
||||
ms.reviewer:
|
||||
ms.author: v-bshilpa
|
||||
ms.prod: w10
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: Benny-54
|
||||
manager: dansimp
|
||||
ms.collection:
|
||||
- m365-security-compliance
|
||||
- m365-initiative-windows-security
|
||||
ms.topic: troubleshooting
|
||||
---
|
||||
|
||||
# Troubleshooting Windows Firewall settings after a Windows upgrade
|
||||
|
||||
Use this article to troubleshoot firewall settings that are turned off after upgrading to a new version of Windows.
|
||||
|
||||
## Rule groups
|
||||
|
||||
To help you organize your list, individual built-in firewall rules are categorized within a group. For example, the following rules form part of the Remote Desktop group.
|
||||
|
||||
- Remote Desktop – Shadow (TCP-In)
|
||||
- Remote Desktop – User Mode (TCP-In)
|
||||
- Remote Desktop – User-Mode (UDP-In)
|
||||
|
||||
Other group examples include **core networking**, **file and print sharing**, and **network discovery**. Grouping allows admins to manage sets of similar rules by filtering on categories in the firewall interface (wf.msc). Do this by right-clicking on either **Inbound** or **Outbound Rules** and selecting **Filter by Group**. Optionally, you can use PowerShell using the `Get-NetFirewallRule` cmdlet with the `-Group` switch.
|
||||
|
||||
```Powershell
|
||||
Get-NetFirewallRule -Group <groupName>
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> Microsoft recommends to enable or disable an entire group instead of individual rules.
|
||||
|
||||
Microsoft recommends that you enable/disable all of the rules within a group instead of one or two individual rules. This is because groups are not only used to organize rules and allow batch rule modification by type, but they also represent a 'unit' by which rule state is maintained across a Windows upgrade. Rule groups, as opposed to individual rules, are the unit by which the update process determines what should be enabled/disabled when the upgrade is complete.
|
||||
|
||||
For example, the Remote Desktop group consists of three rules. To ensure that the rule set is properly migrated during an upgrade, all three rules must be enabled. If only one rule is enabled, the upgrade process will see that two of three rules are disabled and subsequently disable the entire group to maintain a clean, out-of-the-box configuration. This scenario has the unintended consequence of breaking Remote Desktop Protocol (RDP) connectivity to the host.
|
||||
Loading…
x
Reference in New Issue
Block a user