+This version of Surface Diagnostic Toolkit for Business adds support for the following: +- Advanced Setup option to unlock admin capabilities through the installer UI, without requiring command line configuration. +- Accessibility improvements. +- Surface brightness control settings included in logs. +- External monitor compatibility support link in report generator. diff --git a/store-for-business/microsoft-store-for-business-overview.md b/store-for-business/microsoft-store-for-business-overview.md index 0bf1fdc2d4..f6afc25250 100644 --- a/store-for-business/microsoft-store-for-business-overview.md +++ b/store-for-business/microsoft-store-for-business-overview.md @@ -28,8 +28,8 @@ Organizations or schools of any size can benefit from using Microsoft Store for - **Scales to fit the size of your business** - For smaller businesses, with Azure AD accounts or Office 365 accounts and Windows 10 devices, you can quickly have an end-to-end process for acquiring and distributing content using the Store for Business. For larger businesses, all the capabilities of the Store for Business are available to you, or you can integrate Microsoft Store for Business with management tools, for greater control over access to apps and app updates. You can use existing work or school accounts. - **Bulk app acquisition** - Acquire apps in volume from Microsoft Store for Business. - **Centralized management** – Microsoft Store provides centralized management for inventory, billing, permissions, and order history. You can use Microsoft Store to view, manage and distribute items purchased from: - - **Microsoft Store for Business** – Apps and subscriptions - - **Microsoft Store for Education** – Apps and subscriptions + - **Microsoft Store for Business** – Apps acquired from Microsoft Store for Business + - **Microsoft Store for Education** – Apps acquired from Microsoft Store for Education - **Office 365** – Subscriptions - **Volume licensing** - Apps purchased with volume licensing - **Private store** - Create a private store for your business that’s easily available from any Windows 10 device. Your private store is available from Microsoft Store on Windows 10, or with a browser on the Web. People in your organization can download apps from your organization's private store on Windows 10 devices. diff --git a/windows/application-management/app-v/appv-auto-provision-a-vm.md b/windows/application-management/app-v/appv-auto-provision-a-vm.md index 53a38b3f05..9cb9b8fade 100644 --- a/windows/application-management/app-v/appv-auto-provision-a-vm.md +++ b/windows/application-management/app-v/appv-auto-provision-a-vm.md @@ -95,12 +95,12 @@ If your apps require custom prerequisites, such as Microsoft SQL Server, we reco 2. Open PowerShell as an admin and run the **Connect-AppvSequencerVM** cmdlet, using the following parameters: ```ps1 - Connect-AppvSequencerVM -VMName "
Data type is integer. Supported operations are Add, Get, Replace, and Delete.
**EncryptionMethodByDriveType** -Allows you to set the default encrytion method for each of the different drive types. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".
+Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".
**Can there be more than 1 MDM server to enroll and manage devices in Windows 10?** -No. Only one MDM is allowed. - -**How do I set the maximum number of Azure Active Directory joined devices per user?** -1. Login to the portal as tenant admin: https://manage.windowsazure.com. -2. Click Active Directory on the left pane. -3. Choose your tenant. -4. Click **Configure**. -5. Set quota to unlimited. - -  - - -**What is dmwappushsvc?** - -Entry | Description ---------------- | -------------------- -What is dmwappushsvc? | It is a Windows service that ships in Windows 10 operating system as a part of the windows management platform. It is used internally by the operating system as a queue for categorizing and processing all WAP messages, which include Windows management messages, MMS, NabSync, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | -What data is handled by dmwappushsvc? | It is a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further: MMS, NabSync, SI/SL. | -How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. | - - - - - - diff --git a/windows/client-management/mdm/nodecache-csp.md b/windows/client-management/mdm/nodecache-csp.md index 28bcf637f6..d04fa8b63b 100644 --- a/windows/client-management/mdm/nodecache-csp.md +++ b/windows/client-management/mdm/nodecache-csp.md @@ -30,7 +30,7 @@ The following diagram shows the NodeCache configuration service provider in tree  **./Device/Vendor/MSFT and ./User/Vendor/MSFT** -Required. The root node for the NodeCache object. Supported operation is Get. This configuration service provider is used for enterprise device management only. This is a predefined MIME type to identify this managed object in OMA DM syntax. Starting in Windows 10, version 1607 the value is com.microsoft/\-
+
- + WindowsLogon/AllowAutomaticRestartSignOn + +
- + WindowsLogon/ConfigAutomaticRestartSignOn +
- WindowsLogon/DisableLockScreenAppNotifications
- WindowsLogon/DontDisplayNetworkSelectionUI +
- + WindowsLogon/EnableFirstLogonAnimation +
- WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers
- WindowsLogon/HideFastUserSwitching -
- - WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart - -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. + +## Accounts policies supported by Windows Holographic + +- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) + + + +## Accounts policies supported by Windows Holographic for Business + +- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index c936dbc5db..994c53f7ca 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -6,13 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 08/08/2018 +ms.date: 05/01/2019 --- # Policy CSP - ApplicationManagement > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -1038,16 +1038,31 @@ XSD: -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. + +## ApplicationManagement policies supported by Windows Holographic +- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) +- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) + + + +## ApplicationManagement policies supported by Windows Holographic for Business + +- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) +- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in the next major release of Windows 10. diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index b40a98a737..58790db16d 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -6,13 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/30/2018 +ms.date: 05/01/2019 --- # Policy CSP - Authentication > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -354,6 +354,9 @@ The following list shows the supported values: +> [!Warning] +> This policy is only in preview mode and therefore not meant or recommended for production purposes. + This policy is intended for use on Shared PCs to enable a quick first sign-in experience for a user. It works by automatically connecting new non-admin Azure Active Directory (Azure AD) accounts to the pre-configured candidate local accounts. Value type is integer. Supported values: @@ -412,9 +415,12 @@ Value type is integer. Supported values: +> [!Warning] +> This policy is only in preview mode and therefore not meant or recommended for production purposes. + "Web Sign-in" is a new way of signing into a Windows PC. It enables Windows logon support for non-ADFS federated providers (e.g. SAML). -> [!Note] +> [!Note] > Web Sign-in is only supported on Azure AD Joined PCs. Value type is integer. Supported values: @@ -491,15 +497,27 @@ Value type is string. -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. + +## Authentication policies supported by Windows Holographic + +- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) + + + +## Authentication policies supported by Windows Holographic for Business + +- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) +- [Authentication/PreferredAadTenantDomainName](#authentication-preferredaadtenantdomainname) + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 82eb7ed2c3..8abc1aaa7a 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 11/15/2018 +ms.date: 05/01/2019 --- # Policy CSP - Bluetooth @@ -339,17 +339,34 @@ The default value is an empty string. For more information, see [ServicesAllowed -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. + +## Bluetooth policies supported by Windows Holographic + +- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) +- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) +- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) + + + +## Bluetooth policies supported by Windows Holographic for Business + +- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) +- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) +- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. + ## ServicesAllowedList usage guide When the Bluetooth/ServicesAllowedList policy is provisioned, it will only allow pairing and connections of Windows PCs and phones to explicitly defined Bluetooth profiles and services. It is an allowed list, enabling admins to still allow custom Bluetooth profiles that are not defined by the Bluetooth Special Interests Group (SIG). diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 9b9cc1b64f..cf8010c0ce 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -6,13 +6,13 @@ ms.prod: w10 ms.technology: windows author: shortpatti ms.author: pashort -ms.date: 10/02/2018 +ms.date: 05/01/2019 --- # Policy CSP - Browser > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -3963,15 +3963,38 @@ Supported values: Most restricted value: 0 -
- -Footnote: - -- 1 - Supported versions, version 1607. -- 2 - Supported versions, version 1703. -- 3 - Supported versions, version 1709. -- 4 - Supported versions, version 1803. -- 5 - Supported versions, version 1809. + +## Browser policies supported by Windows Holographic + +- [Browser/AllowDoNotTrack](#browser-allowdonottrack) +- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) +- [Browser/AllowPopups](#browser-allowpopups) +- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](#browser-allowsmartscreen) +- [Browser/AllowCookies](#browser-allowcookies) + + + +## Browser policies supported by Windows Holographic for Business + +- [Browser/AllowAutofill](#browser-allowautofill) +- [Browser/AllowDoNotTrack](#browser-allowdonottrack) +- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) +- [Browser/AllowPopups](#browser-allowpopups) +- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](#browser-allowsmartscreen) +- [Browser/AllowCookies](#browser-allowcookies) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 0806fb596a..34d9585326 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/30/2018 +ms.date: 05/01/2019 --- # Policy CSP - Connectivity @@ -961,16 +961,32 @@ ADMX Info: -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. + +## Connectivity policies supported by Windows Holographic + +- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) +- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) + + + +## Connectivity policies supported by Windows Holographic for Business + +- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) +- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. + diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index f6626284ef..c51f4ad30a 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -67,7 +67,7 @@ Added in Windows 10, version 1803. This policy allows the IT admin to control wh > [!Note] > MDMWinsOverGP only applies to policies in Policy CSP. It does not apply to other MDM settings with equivalent GP settings that are defined on other configuration service providers. -This policy is used to ensure that MDM policy wins over GP when same setting is set by both GP and MDM channel. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. +This policy is used to ensure that MDM policy wins over GP when policy is configured on MDM channel. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. Note: This policy doesn’t support the Delete command and doesn’t support setting the value to 0 again after it was previously set to 1. Windows 10 version 1809 will support using the Delete command to set the value to 0 again, if it was previously set to 1. The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 95e6d74539..a6226c81d3 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -6,13 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/06/2018 +ms.date: 05/15/2019 --- # Policy CSP - DeliveryOptimization > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -36,6 +36,12 @@ ms.date: 07/06/2018
+ +**DeliveryOptimization/DODelayCacheServerFallbackBackground** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
 |
+  6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + + +Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for a background content download. + +> [!NOTE] +> The [DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) policy takes precedence over this policy to allow downloads from peers first. + + + + +ADMX Info: +- GP English name: *Delay Background download Cache Server fallback (in seconds)* +- GP name: *DelayCacheServerFallbackBackground* +- GP element: *DelayCacheServerFallbackBackground* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + + + +This policy is specified in seconds. +Supported values: 0 - one month (in seconds) + + + + + + + + + + +
+ + + +**DeliveryOptimization/DODelayCacheServerFallbackForeground** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + + +Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for foreground content download. + +> [!NOTE] +> The [DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) policy takes precedence over this policy to allow downloads from peers first. + + + + +ADMX Info: +- GP English name: *Delay Foreground download Cache Server fallback (in seconds)* +- GP name: *DelayCacheServerFallbackForeground* +- GP element: *DelayCacheServerFallbackForeground* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + + +This policy is specified in seconds. +Supported values: 0 - one month (in seconds) + + + + + + + + +
+ **DeliveryOptimization/DODownloadMode** @@ -985,7 +1129,7 @@ ADMX Info: > This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile. -Added in Windows 10, version 1703. Specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. The value 0 means "not-limited" which means the cloud service set default value will be used. Recommended values: 64 GB to 256 GB. +Added in Windows 10, version 1703. Specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. Recommended values: 64 GB to 256 GB. > [!NOTE] > If the DOMofidyCacheDrive policy is set, the disk size check will apply to the new working directory specified by this policy. @@ -1046,7 +1190,7 @@ ADMX Info: > This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile. -Added in Windows 10, version 1703. Specifies the minimum content file size in MB enabled to use Peer Caching. The value 0 means "unlimited" which means the cloud service set default value will be used. Recommended values: 1 MB to 100,000 MB. +Added in Windows 10, version 1703. Specifies the minimum content file size in MB enabled to use Peer Caching. Recommended values: 1 MB to 100,000 MB. The default value is 100 MB. @@ -1104,7 +1248,7 @@ ADMX Info: > This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile. -Added in Windows 10, version 1703. Specifies the minimum RAM size in GB required to use Peer Caching. The value 0 means "not-limited" which means the cloud service set default value will be used. For example if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. Recommended values: 1 GB to 4 GB. +Added in Windows 10, version 1703. Specifies the minimum RAM size in GB required to use Peer Caching. For example, if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. Recommended values: 1 GB to 4 GB. The default value is 4 GB. @@ -1558,19 +1702,138 @@ This policy allows an IT Admin to define the following: -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. + +## DeliveryOptimization policies supported by Windows Holographic + +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](#deliveryoptimization-docachehost) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) + + + +## DeliveryOptimization policies supported by Windows Holographic for Business + +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](#deliveryoptimization-docachehost) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) + + + +## DeliveryOptimization policies supported by IoT Core + +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](#deliveryoptimization-docachehost) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) + + + +## DeliveryOptimization policies supported by IoT Enterprise + +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](#deliveryoptimization-docachehost) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) + + + ## DeliveryOptimization policies supported by Microsoft Surface Hub @@ -1591,3 +1854,13 @@ Footnote: - [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 4d766ec5f7..1d4948e92a 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 08/08/2018 +ms.date: 05/01/2019 --- # Policy CSP - DeviceLock @@ -1205,14 +1205,43 @@ Most restricted value is 0. -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. + +## DeviceLock policies supported by Windows Holographic + +- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) +- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) +- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) +- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) +- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) + + + +## DeviceLock policies supported by Windows Holographic for Business + +- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) +- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) +- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) +- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) +- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index c267e4587c..4db9f3f778 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -6,13 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/30/2018 +ms.date: 05/14/2019 --- # Policy CSP - Experience > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -96,6 +96,9 @@ ms.date: 07/30/2018
-Footnote: + +**Experience/ShowLockOnUserTile** -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Shows or hides lock from the user tile menu. + +If you enable this policy setting, the lock option is shown in the User Tile menu. + +If you disable this policy setting, the lock option is never shown in the User Tile menu. + +If you do not configure this policy setting, the lock option is shown in the User Tile menu. Users can choose if they want to show the lock in the user tile menu from the Power Options control panel. + + + +ADMX Info: +- GP English name: *Show lock in the user tile menu* +- GP name: *ShowLockOption* +- GP path: *File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +Supported values: +- false - The lock option is not displayed in the User Tile menu. +- true (default) - The lock option is displayed in the User Tile menu. + + + + + + + + + + +## Experience policies supported by Windows Holographic +- [Experience/AllowCortana](#experience-allowcortana) + + + +## Experience policies supported by Windows Holographic for Business + +- [Experience/AllowCortana](#experience-allowcortana) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index b1594d5d38..dc9a2c4e0c 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -24,12 +24,6 @@ ms.date: 06/26/2018
- -**LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus** - - -
| Home | -Pro | -Business | -Enterprise | -Education | -Mobile | -Mobile Enterprise | -
|---|---|---|---|---|---|---|
|
- 3 |
- 3 |
- 3 |
- 3 |
- |
- |
-
- - - -This security setting determines whether the local Administrator account is enabled or disabled. - -If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. -Disabling the Administrator account can become a maintenance issue under certain circumstances. - -Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. - -Default: Disabled. - -Value type is integer. Supported operations are Add, Get, Replace, and Delete. - - - -GP Info: -- GP English name: *Accounts: Administrator account status* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - -Valid values: -- 0 - local Administrator account is disabled -- 1 - local Administrator account is enabled - - - - -
- - -**LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus** - - -
| Home | -Pro | -Business | -Enterprise | -Education | -Mobile | -Mobile Enterprise | -
|---|---|---|---|---|---|---|
|
- 3 |
- 3 |
- 3 |
- 3 |
- |
- |
-
- - - -This security setting determines if the Guest account is enabled or disabled. - -Default: Disabled. - -Note: If the Guest account is disabled and the security option Network Access: Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail. - -Value type is integer. Supported operations are Add, Get, Replace, and Delete. - - - -GP Info: -- GP English name: *Accounts: Guest account status* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - -Valid values: -- 0 - local Guest account is disabled -- 1 - local Guest account is enabled - - - - -
- **LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly** diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 51f9efc4a5..3b9db5c095 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -6,12 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 04/16/2018 +ms.date: 05/03/2019 --- # Policy CSP - Power - +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -31,6 +32,12 @@ ms.date: 04/16/2018
+ +**Power/EnergySaverBatteryThresholdOnBattery** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + + +Added in Windows 10, version 1903. This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must specify a percentage value that indicates the battery charge level. Energy Saver is automatically turned on at (and below) the specified battery charge level. + +If you disable or do not configure this policy setting, users control this setting. + + + + +ADMX Info: +- GP English name: *Energy Saver Battery Threshold (on battery)* +- GP name: *EsBattThresholdDC* +- GP element: *EnterEsBattThreshold* +- GP path: *System/Power Management/Energy Saver Settings* +- GP ADMX file name: *power.admx* + + + +Supported values: 0-100. The default is 70. + + + + + + + + + +
+ + +**Power/EnergySaverBatteryThresholdPluggedIn** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must provide a percentage value that indicates the battery charge level. Energy Saver is automatically turned on at (and below) the specified battery charge level. + +If you disable or do not configure this policy setting, users control this setting. + + + + +ADMX Info: +- GP English name: *Energy Saver Battery Threshold (plugged in)* +- GP name: *EsBattThresholdAC* +- GP element: *EnterEsBattThreshold* +- GP path: *System/Power Management/Energy Saver Settings* +- GP ADMX file name: *power.admx* + + + +Supported values: 0-100. The default is 70. + + + + + + + + + +
+ **Power/HibernateTimeoutOnBattery** @@ -558,6 +728,438 @@ ADMX Info:
+ +**Power/SelectLidCloseActionOnBattery** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + +ADMX Info: +- GP English name: *Select the lid switch action (on battery)* +- GP name: *DCSystemLidAction_2* +- GP element: *SelectDCSystemLidAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported lid close switch actions (on battery): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
+ + +**Power/SelectLidCloseActionPluggedIn** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + +ADMX Info: +- GP English name: *Select the lid switch action (plugged in)* +- GP name: *ACSystemLidAction_2* +- GP element: *SelectACSystemLidAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported lid close switch actions (plugged in): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
+ + +**Power/SelectPowerButtonActionOnBattery** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user presses the Power button. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + +ADMX Info: +- GP English name: *Select the Power button action (on battery)* +- GP name: *DCPowerButtonAction_2* +- GP element: *SelectDCPowerButtonAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported Power button actions (on battery): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
+ + +**Power/SelectPowerButtonActionPluggedIn** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user presses the Power button. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + +ADMX Info: +- GP English name: *Select the Power button action (plugged in)* +- GP name: *ACPowerButtonAction_2* +- GP element: *SelectACPowerButtonAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported Power button actions (plugged in): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
+ + +**Power/SelectSleepButtonActionOnBattery** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user presses the Sleep button. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + +ADMX Info: +- GP English name: *Select the Sleep button action (on battery)* +- GP name: *DCSleepButtonAction_2* +- GP element: *SelectDCSleepButtonAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported Sleep button actions (on battery): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
+ + +**Power/SelectSleepButtonActionPluggedIn** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user presses the Sleep button. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + +ADMX Info: +- GP English name: *Select the Sleep button action (plugged in)* +- GP name: *ACSleepButtonAction_2* +- GP element: *SelectACSleepButtonAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported Sleep button actions (plugged in): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
+ **Power/StandbyTimeoutOnBattery** @@ -683,14 +1285,291 @@ ADMX Info: +
-Footnote: + +**Power/TurnOffHybridSleepOnBattery** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. This policy setting allows you to turn off hybrid sleep. + +If you set this policy setting to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you set this policy setting to 1 or do not configure this policy setting, users control this setting. + + + + +ADMX Info: +- GP English name: *Turn off hybrid sleep (on battery)* +- GP name: *DCStandbyWithHiberfileEnable_2* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported values for Hybrid sleep (on battery): +- 0 - no hibernation file for sleep (default) +- 1 - hybrid sleep + + + + + + + + + + +
+ + +**Power/TurnOffHybridSleepPluggedIn** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. This policy setting allows you to turn off hybrid sleep. + +If you set this policy setting to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you set this policy setting to 1 or do not configure this policy setting, users control this setting. + + + + +ADMX Info: +- GP English name: *Turn off hybrid sleep (plugged in)* +- GP name: *ACStandbyWithHiberfileEnable_2* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported values for Hybrid sleep (plugged in): +- 0 - no hibernation file for sleep (default) +- 1 - hybrid sleep + + + + + + + + + + +
+ + +**Power/UnattendedSleepTimeoutOnBattery** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + + +ADMX Info: +- GP English name: *Specify the unattended sleep timeout (on battery)* +- GP name: *UnattendedSleepTimeOutDC* +- GP element: *EnterUnattendedSleepTimeOut* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + +Default value for unattended sleep timeout (on battery): +300 + + + + + + + + + +
+ + +**Power/UnattendedSleepTimeoutPluggedIn** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + + +ADMX Info: +- GP English name: *Specify the unattended sleep timeout (plugged in)* +- GP name: *UnattendedSleepTimeOutAC* +- GP element: *EnterUnattendedSleepTimeOut* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + +Default value for unattended sleep timeout (plugged in): +300 + + + + + + + + + + +
+ +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - - - +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index bccb2e581b..e59ee6fa01 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -6,13 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 08/14/2018 +ms.date: 05/01/2019 --- # Policy CSP - Privacy > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -4851,16 +4851,28 @@ ADMX Info: -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. + +## Privacy policies supported by Windows Holographic + +- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) + + + +## Privacy policies supported by Windows Holographic for Business + +- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in the next major release of Windows 10. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index f51a32f819..3106f2b945 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/30/2018 +ms.date: 05/01/2019 --- # Policy CSP - Search @@ -849,16 +849,27 @@ The following list shows the supported values: -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. + +## Search policies supported by Windows Holographic +- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) + + +## Search policies supported by Windows Holographic for Business + +- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index ec1d131e0d..e6bce4de0b 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -6,13 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 08/09/2018 +ms.date: 05/01/2019 --- # Policy CSP - Security > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -739,18 +739,28 @@ The following list shows the supported values: -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. + +## Security policies supported by Windows Holographic +- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) + + +## Security policies supported by Windows Holographic for Business + +- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in the next major release of Windows 10. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index fa1b94e71a..5ff09bf3e4 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 08/09/2018 +ms.date: 05/01/2019 --- # Policy CSP - Settings @@ -839,16 +839,29 @@ To validate on Desktop, do the following: -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. + +## Settings policies supported by Windows Holographic +- [Settings/AllowDateTime](#settings-allowdatetime) +- [Settings/AllowVPN](#settings-allowvpn) + + +## Settings policies supported by Windows Holographic for Business + +- [Settings/AllowDateTime](#settings-allowdatetime) +- [Settings/AllowVPN](#settings-allowvpn) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 43023aecdc..bd274c38df 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 08/09/2018 +ms.date: 05/01/2019 --- # Policy CSP - Speech @@ -82,14 +82,27 @@ The following list shows the supported values: -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. + +## Speech policies supported by Windows Holographic + +- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) + + + +## Speech policies supported by Windows Holographic for Business + +- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 16bfa23ec7..92fd30f9bb 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -6,13 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 08/24/2018 +ms.date: 05/09/2019 --- # Policy CSP - System > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -24,6 +24,9 @@ ms.date: 08/24/2018
+ +**System/AllowCommercialDataPipeline** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +> [!NOTE] +> This policy setting applies only to the Windows operating system and apps included with Windows, it does not apply to third-party apps or services running on Windows 10. + +This policy setting opts the device into the Windows enterprise data pipeline. + +If you enable this setting, data collected from the device is opted into the Windows enterprise data pipeline. + +If you disable or do not configure this setting, all data from the device is collected and processed in accordance with the policies for the Windows standard data pipeline. + +Configuring this setting does not change the telemetry collection level or the ability of the user to change the level. + + + +ADMX Info: +- GP English name: *Allow commercial data pipeline* +- GP name: *AllowCommercialDataPipeline* +- GP element: *AllowCommercialDataPipeline* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + + + +The following list shows the supported values: + +- 0 (default) - Do not use the Windows Commercial Data Pipeline +- 1 - Use the Windows Commercial Data Pipeline + + + + + + + + + + +
+ **System/AllowDeviceNameInDiagnosticData** @@ -1433,16 +1512,97 @@ ADMX Info: +
-Footnote: + +**System/TurnOffFileHistory** -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +This policy setting allows you to turn off File History. + +If you enable this policy setting, File History cannot be activated to create regular, automatic backups. + +If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups. + + + +ADMX Info: +- GP English name: *Turn off File History* +- GP name: *DisableFileHistory* +- GP path: *Windows Components/File History* +- GP ADMX file name: *FileHistory.admx* + + + +The following list shows the supported values: + +- false (default) - allow File History +- true - turn off File History + + + + + + + + + +## System policies supported by Windows Holographic + +- [System/AllowTelemetry](#system-allowtelemetry) +- [System/AllowLocation](#system-allowlocation) + + + +## System policies supported by Windows Holographic for Business + +- [System/AllowTelemetry](#system-allowtelemetry) +- [System/AllowLocation](#system-allowlocation) + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 2e24ad1c47..8e9d7a15c7 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -6,13 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 08/29/2018 +ms.date: 05/08/2019 --- # Policy CSP - Update > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -57,9 +57,24 @@ ms.date: 08/29/2018
+ > [!NOTE] >Â If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). @@ -933,6 +949,76 @@ The following list shows the supported values:
+ +**Update/AutomaticMaintenanceWakeUp** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +This policy setting allows you to configure if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance. + +> [!Note] +> If the OS power wake policy is explicitly disabled, then this setting has no effect. + +If you enable this policy setting, Automatic Maintenance attempts to set OS wake policy and make a wake request for the daily scheduled time, if required. + +If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel applies. + + + +ADMX Info: +- GP English name: *Automatic Maintenance WakeUp Policy* +- GP category English path: *Windows Components/Maintenance Scheduler* +- GP name: *WakeUpPolicy* +- GP path: *Windows Components/Maintenance Scheduler* +- GP ADMX file name: *msched.admx* + + + +Supported values: +- true - Enable +- false - Disable (Default) + + + + + + + + + +
+ **Update/BranchReadinessLevel** @@ -995,6 +1081,306 @@ The following list shows the supported values:
+ +**Update/ConfigureDeadlineForFeatureUpdates** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. Allows IT admins to specify the number of days a user has before feature updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. + + + + +Supports a numeric value from 2 - 30, which indicates the number of days a device will wait until performing an aggressive installation of a required feature update. + +Default value is 7. + + + +ADMX Info: +- GP English name: *Specify deadlines for automatic updates and restarts* +- GP category English path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP name: *ConfigureDeadlineForFeatureUpdates* +- GP element: *ConfigureDeadlineForFeatureUpdates* +- GP ADMX file name: *WindowsUpdate.admx* + + + + + + + + + + + +
+ + +**Update/ConfigureDeadlineForQualityUpdates** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. Allows IT admins to specify the number of days a user has before quality updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. + + + +ADMX Info: +- GP English name: *Specify deadlines for automatic updates and restarts* +- GP category English path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP name: *ConfigureDeadlineForQualityUpdates* +- GP element: *ConfigureDeadlineForQualityUpdates* +- GP ADMX file name: *WindowsUpdate.admx* + + + +Supports a numeric value from 2 - 30, which indicates the number of days a device will wait until performing an aggressive installation of a required quality update. + +Default value is 7. + + + + + + + + + +
+ + +**Update/ConfigureDeadlineGracePeriod** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. Allows the IT admin (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)) to specify a minimum number of days until restarts occur automatically. Setting the grace period may extend the effective deadline set by the deadline policies. + + + +ADMX Info: +- GP English name: *Specify deadlines for automatic updates and restarts* +- GP category English path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP name: *ConfigureDeadlineGracePeriod* +- GP element: *ConfigureDeadlineGracePeriod* +- GP ADMX file name: *WindowsUpdate.admx* + + + +Supports a numeric value from 0 - 7, which indicates the minimum number of days a device will wait until performing an aggressive installation of a required update once deadline has been reached. + +Default value is 2. + + + + + + + + + +
+ + +**Update/ConfigureDeadlineNoAutoReboot** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +Added in Windows 10, version 1903. If enabled (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)), devices will not automatically restart outside of active hours until the deadline is reached, even if applicable updates are already installed and pending a restart. + +When disabled, if the device has installed the required updates and is outside of active hours, it may attempt an automatic restart before the deadline. + + + +ADMX Info: +- GP English name: *Specify deadlines for automatic updates and restarts* +- GP category English path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP name: *ConfigureDeadlineNoAutoReboot* +- GP element: *ConfigureDeadlineNoAutoReboot* +- GP ADMX file name: *WindowsUpdate.admx* + + + +Supported values: +- 1 - Enabled +- 0 (default) - Disabled + + + + + + + + + +
+ + +**Update/ConfigureFeatureUpdateUninstallPeriod** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+
+ + + +Added in Windows 10, version 1803. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days. + + + + +
+ **Update/ConfigureFeatureUpdateUninstallPeriod** @@ -3571,15 +3957,65 @@ ADMX Info: -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. + + +## Update policies supported by Windows Holographic + +- [Update/AllowAutoUpdate](#update-allowautoupdate) +- [Update/AllowUpdateService](#update-allowupdateservice) +- [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot) +- [Update/RequireUpdateApproval](#update-requireupdateapproval) +- [Update/ScheduledInstallDay](#update-scheduledinstallday) +- [Update/ScheduledInstallTime](#update-scheduledinstalltime) +- [Update/UpdateServiceUrl](#update-updateserviceurl) +- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) + + + +## Update policies supported by Windows Holographic for Business + +- [Update/AllowAutoUpdate](#update-allowautoupdate) +- [Update/AllowUpdateService](#update-allowupdateservice) +- [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot) +- [Update/RequireUpdateApproval](#update-requireupdateapproval) +- [Update/ScheduledInstallDay](#update-scheduledinstallday) +- [Update/ScheduledInstallTime](#update-scheduledinstalltime) +- [Update/UpdateServiceUrl](#update-updateserviceurl) +- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) + + + +## Update policies supported by IoT Core + +- [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot) + + + +## Update policies supported by IoT Enterprise + +- [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot) + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 8d16e2c852..ff2649412f 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 05/01/2019 --- # Policy CSP - Wifi @@ -379,36 +379,49 @@ Supported operations are Add, Delete, Get, and Replace. -
- -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. ## Wifi policies that can be set using Exchange Active Sync (EAS) -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) +- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) +- [Wifi/AllowWiFi](#wifi-allowwifi) + +## Wifi policies supported by Windows Holographic + +- [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) + + + +## Wifi policies supported by Windows Holographic for Business + +- [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) + + ## Wifi policies supported by IoT Core -- [Wifi/AllowAutoConnectToWiFiSenseHotspots](#wifi-allowautoconnecttowifisensehotspots) -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) -- [Wifi/WLANScanMode](#wifi-wlanscanmode) +- [Wifi/AllowAutoConnectToWiFiSenseHotspots](#wifi-allowautoconnecttowifisensehotspots) +- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) +- [Wifi/AllowWiFi](#wifi-allowwifi) +- [Wifi/WLANScanMode](#wifi-wlanscanmode) ## Wifi policies supported by Microsoft Surface Hub -- [WiFi/AllowWiFiHotSpotReporting](#wifi-allowwifihotspotreporting) +- [WiFi/AllowWiFiHotSpotReporting](#wifi-allowwifihotspotreporting) +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index e75a0cf6de..e307f8f433 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -6,12 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/12/2018 +ms.date: 05/07/2019 --- # Policy CSP - WindowsLogon - +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -19,23 +20,182 @@ ms.date: 07/12/2018 ## WindowsLogon policies
-
+
- + WindowsLogon/AllowAutomaticRestartSignOn + +
- + WindowsLogon/ConfigAutomaticRestartSignOn +
- WindowsLogon/DisableLockScreenAppNotifications
- WindowsLogon/DontDisplayNetworkSelectionUI +
- + WindowsLogon/EnableFirstLogonAnimation +
- WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers
- WindowsLogon/HideFastUserSwitching -
- - WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart -
+ + +**WindowsLogon/AllowAutomaticRestartSignOn** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
| 6 |
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +This policy setting controls whether a device automatically signs in and locks the last interactive user after the system restarts or after a shutdown and cold boot. + +This occurs only if the last interactive user did not sign out before the restart or shutdown.​ + +If the device is joined to Active Directory or Azure Active Directory, this policy applies only to Windows Update restarts. Otherwise, this policy applies to both Windows Update restarts and user-initiated restarts and shutdowns.​ + +If you do not configure this policy setting, it is enabled by default. When the policy is enabled, the user is automatically signed in and the session is automatically locked with all lock screen apps configured for that user after the device boots.​ + +After enabling this policy, you can configure its settings through the [ConfigAutomaticRestartSignOn](#windowslogon-configautomaticrestartsignon) policy, which configures the mode of automatically signing in and locking the last interactive user after a restart or cold boot​. + +If you disable this policy setting, the device does not configure automatic sign in. The user’s lock screen apps are not restarted after the system restarts. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Sign-in and lock last interactive user automatically after a restart* +- GP name: *AutomaticRestartSignOn* +- GP path: *Windows Components/Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + + + + + + + + + + + +
+ + +**WindowsLogon/ConfigAutomaticRestartSignOn** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
| 6 |
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +This policy setting controls the configuration under which an automatic restart, sign on, and lock occurs after a restart or cold boot. If you chose “Disabled” in the [AllowAutomaticRestartSignOn](#windowslogon-allowautomaticrestartsignon) policy, then automatic sign on does not occur and this policy need not be configured. + +If you enable this policy setting, you can choose one of the following two options: + +- Enabled if BitLocker is on and not suspended: Specifies that automatic sign on and lock occurs only if BitLocker is active and not suspended during the reboot or shutdown. Personal data can be accessed on the device’s hard drive at this time if BitLocker is not on or suspended during an update. BitLocker suspension temporarily removes protection for system components and data but may be needed in certain circumstances to successfully update boot-critical components. +BitLocker is suspended during updates if: + - The device does not have TPM 2.0 and PCR7 + - The device does not use a TPM-only protector +- Always Enabled: Specifies that automatic sign on happens even if BitLocker is off or suspended during reboot or shutdown. When BitLocker is not enabled, personal data is accessible on the hard drive. Automatic restart and sign on should only be run under this condition if you are confident that the configured device is in a secure physical location. + +If you disable or do not configure this setting, automatic sign on defaults to the “Enabled if BitLocker is on and not suspended” behavior. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot* +- GP name: *ConfigAutomaticRestartSignOn* +- GP path: *Windows Components/Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + + + + + + + + + +
@@ -188,6 +348,78 @@ ADMX Info:
+ +**WindowsLogon/EnableFirstLogonAnimation** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 6 |
+ 6 |
+ 6 |
+ 6 |
+ + | + |
+ + + +This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users are offered the opt-in prompt for services during their first sign-in. + +If you enable this policy setting, Microsoft account users see the opt-in prompt for services, and users with other accounts see the sign-in animation. + +If you disable this policy setting, users do not see the animation and Microsoft account users do not see the opt-in prompt for services. + +If you do not configure this policy setting, the user who completes the initial Windows setup see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer do not see the animation. + +> [!NOTE] +> The first sign-in animation is not displayed on Server, so this policy has no effect. + + + + +ADMX Info: +- GP English name: *Show first sign-in animation* +- GP name: *EnableFirstLogonAnimation* +- GP path: *System/Logon* +- GP ADMX file name: *Logon.admx* + + + +Supported values: +- false - disabled +- true - enabled + + + + + + + + + +
+ **WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers** @@ -313,75 +545,15 @@ To validate on Desktop, do the following: -
- - -**WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart** - - -
| Home | -Pro | -Business | -Enterprise | -Education | -Mobile | -Mobile Enterprise | -
|---|---|---|---|---|---|---|
|
- |
- |
- |
- |
- |
- |
-
- - -This policy setting controls whether a device will automatically sign-in the last interactive user after Windows Update restarts the system. - -If you enable or do not configure this policy setting, the device securely saves the user's credentials (including the user name, domain and encrypted password) to configure automatic sign-in after a Windows Update restart. After the Windows Update restart, the user is automatically signed-in and the session is automatically locked with all the lock screen apps configured for that user. - -If you disable this policy setting, the device does not store the user's credentials for automatic sign-in after a Windows Update restart. The users' lock screen apps are not restarted after the system restarts. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Sign-in last interactive user automatically after a system-initiated restart* -- GP name: *AutomaticRestartSignOn* -- GP path: *Windows Components/Windows Logon Options* -- GP ADMX file name: *WinLogon.admx* - - - -
- -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - - - +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. \ No newline at end of file diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index 77dea602cf..f5d0d53a0f 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -30,7 +30,7 @@ The following diagram shows the Reboot configuration service provider management > [!Note]  > If this node is set to execute during a sync session, the device will reboot at the end of the sync session. -
The supported operations are Execute and Get. +
The supported operations are Execute and Get.
**Schedule**The supported operation is Get.
diff --git a/windows/client-management/mdm/reclaim-seat-from-user.md b/windows/client-management/mdm/reclaim-seat-from-user.md index e3351b8c80..95f47c5df9 100644 --- a/windows/client-management/mdm/reclaim-seat-from-user.md +++ b/windows/client-management/mdm/reclaim-seat-from-user.md @@ -29,7 +29,7 @@ The **Reclaim seat from user** operation returns reclaimed seats for a user in tPOST
DELETE
https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats/{username}
->Windows 10 Enterprise E3 in CSP requires Windows 10 Pro, version 1607 or later.
->Automatic, non-KMS activation requires Windows 10, version 1803 or later on a device with a firmware-embedded activation key.
+>* Windows 10 Enterprise Subscription Activation (EA or MPSA) requires Windows 10 Pro, version 1703 or later. +>* Windows 10 Enterprise E3 in CSP requires Windows 10 Pro, version 1607 or later. +>* Automatic, non-KMS activation requires Windows 10, version 1803 or later, on a device with a firmware-embedded activation key. ## Firmware-embedded activation key @@ -35,9 +38,9 @@ If the device has a firmware-embedded activation key, it will be displayed in th If you are an EA customer with an existing Office 365 tenant, use the following steps to enable Windows 10 Subscription licenses on your existing tenant: -1. Work with your reseller to place an order for one $0 SKU per user. There are two SKUs available, depending on their current Windows Enterprise SA license:
- a. **AAA-51069** - Win10UsrOLSActv Alng MonthlySub Addon E3
- b. **AAA-51068** - Win10UsrOLSActv Alng MonthlySub Addon E5
+1. Work with your reseller to place an order for one $0 SKU per user. There are two SKUs available, depending on their current Windows Enterprise SA license: +- **AAA-51069** - Win10UsrOLSActv Alng MonthlySub Addon E3 +- **AAA-51068** - Win10UsrOLSActv Alng MonthlySub Addon E5 2. After placing an order, the OLS admin on the agreement will receive a service activation email, indicating their subscription licenses have been provisioned on the tenant. 3. The admin can now assign subscription licenses to users. @@ -59,7 +62,7 @@ Also in this article: You probably have on-premises Active Directory Domain Services (AD DS) domains. Users will use their domain-based credentials to sign in to the AD DS domain. Before you start deploying Windows 10 Enterprise E3 or E5 licenses to users, you need to synchronize the identities in the on-premises ADDS domain with Azure AD. -You might ask why you need to synchronize these identities. The answer is so that users will have a *single identity* that they can use to access their on-premises apps and cloud services that use Azure AD (such as Windows 10 Enterprise E3 or E5). This means that users can use their existing credentials to sign in to Azure AD and access the cloud services that you provide and manage for them. +You might ask why you need to synchronize these identities. The answer is so that users will have a *single identity* that they can use to access their on-premises apps and cloud services that use Azure AD (such as Windows 10 Enterprise E3 or E5). This means that users can use their existing credentials to sign in to Azure AD and access the cloud services that you provide and manage for them. **Figure 1** illustrates the integration between the on-premises AD DS domain with Azure AD. [Microsoft Azure Active Directory Connect](https://www.microsoft.com/en-us/download/details.aspx?id=47594) (Azure AD Connect) is responsible for synchronization of identities between the on-premises AD DS domain and Azure AD. Azure AD Connect is a service that you can install on-premises or in a virtual machine in Azure. @@ -72,6 +75,9 @@ For more information about integrating on-premises AD DS domains with Azure AD, - [Integrating your on-premises identities with Azure Active Directory](https://azure.microsoft.com/documentation/articles/active-directory-aadconnect/) - [Azure AD + Domain Join + Windows 10](https://blogs.technet.microsoft.com/enterprisemobility/2016/02/17/azure-ad-domain-join-windows-10/) +>[!NOTE] +>If you are implementing Azure AD, and you already have an on-premises domain, you don't need to integrate with Azure AD, since your main authentication method is your internal AD. If you want to manage all your infrastructure in the cloud, you can safely configure your domain controller remotely to integrate your computers with Azure AD, but you won't be able to apply fine controls using GPO. Azure AD is best suited for the global administration of devices when you don't have any on-premises servers. + ## Preparing for deployment: reviewing requirements Devices must be running Windows 10 Pro, version 1703, and be Azure Active Directory joined, or hybrid domain joined with Azure AD Connect. Customers who are federated with Azure Active Directory are also eligible. For more information, see [Review requirements on devices](#review-requirements-on-devices), later in this topic. @@ -151,12 +157,12 @@ Now the device is Azure AD joined to the company’s subscription. ### Step 2: Pro edition activation >[!IMPORTANT] ->If the device is running Windows 10, version 1803 or later, this step is no longer necessary when there is a firmware-embedded activation key on the device. Starting with Windows 10, version 1803 the device will automatically activate Windows 10 Enterprise using the firmware-embedded activation key.
+>If your device is running Windows 10, version 1803 or later, this step is not needed. From Windows 10, version 1803, the device will automatically activate Windows 10 Enterprise using the firmware-embedded activation key. >If the device is running Windows 10, version 1703 or 1709, then Windows 10 Pro must be successfully activated in **Settings > Update & Security > Activation**, as illustrated in **Figure 7a**.
-**Figure 7a - Windows 10 Pro activation in Settings**
+**Figure 7a - Windows 10 Pro activation in Settings** Windows 10 Pro activation is required before Enterprise E3 or E5 can be enabled (Windows 10, versions 1703 and 1709 only). @@ -176,16 +182,16 @@ You can verify the Windows 10 Enterprise E3 or E5 subscription in **Settings &g
-**Figure 9 - Windows 10 Enterprise subscription in Settings**
+**Figure 9 - Windows 10 Enterprise subscription in Settings** If there are any problems with the Windows 10 Enterprise E3 or E5 license or the activation of the license, the **Activation** panel will display the appropriate error message or status. You can use this information to help you diagnose the licensing and activation process. >[!NOTE] ->If you use slmgr /dli or /dlv commands to retrieve the activation information for the Windows 10 E3 or E5 license, the license information displayed will be the following:
->Name: Windows(R), Professional edition
->Description: Windows(R) Operating System, RETAIL channel
->Partial Product Key: 3V66T
+>If you use slmgr /dli or /dlv commands to retrieve the activation information for the Windows 10 E3 or E5 license, the license information displayed will be the following: +>Name: Windows(R), Professional edition +>Description: Windows(R) Operating System, RETAIL channel +>Partial Product Key: 3V66T ## Virtual Desktop Access (VDA) @@ -211,23 +217,20 @@ Use the following figures to help you troubleshoot when users experience these c - [Figure 12](#win-10-not-activated-subscription-not-active) (below) illustrates a device on which Windows 10 Pro license is not activated and the Windows 10 Enterprise subscription is lapsed or removed. -
-**Figure 10 - Windows 10 Pro, version 1703 edition not activated in Settings**
+**Figure 10 - Windows 10 Pro, version 1703 edition not activated in Settings** -
-**Figure 11 - Windows 10 Enterprise subscription lapsed or removed in Settings**
+**Figure 11 - Windows 10 Enterprise subscription lapsed or removed in Settings** -
-**Figure 12 - Windows 10 Pro, version 1703 edition not activated and Windows 10 Enterprise subscription lapsed or removed in Settings**
+**Figure 12 - Windows 10 Pro, version 1703 edition not activated and Windows 10 Enterprise subscription lapsed or removed in Settings** ### Review requirements on devices diff --git a/windows/deployment/planning/windows-10-deployment-considerations.md b/windows/deployment/planning/windows-10-deployment-considerations.md index bb0ad7f659..99f0aa2457 100644 --- a/windows/deployment/planning/windows-10-deployment-considerations.md +++ b/windows/deployment/planning/windows-10-deployment-considerations.md @@ -111,7 +111,7 @@ In either of these scenarios, you can make a variety of configuration changes to ## Stay up to date -For computers already running Windows 10 on the Current Branch or Current Branch for Business, new upgrades will periodically be deployed, approximately two to three times per year. You can deploy these upgrades by using a variety of methods: +For computers already running Windows 10 on the Semi-Annual Channel, new upgrades will periodically be deployed, approximately two to three times per year. You can deploy these upgrades by using a variety of methods: - Windows Update or Windows Update for Business, for devices where you want to receive updates directly from the Internet. diff --git a/windows/deployment/update/update-compliance-delivery-optimization.md b/windows/deployment/update/update-compliance-delivery-optimization.md index 53c10d8b86..23981b631a 100644 --- a/windows/deployment/update/update-compliance-delivery-optimization.md +++ b/windows/deployment/update/update-compliance-delivery-optimization.md @@ -18,6 +18,13 @@ The Update Compliance solution of Windows Analytics provides you with informatio  +> [!IMPORTANT] +> There are currently two known issues affecting the Delivery Optimization status displayed in these blades: +>- Devices running Windows 10, version 1803 or older versions are not sending the correct configuration profile. As a result, the information in the Device Configuration blade might not accurately reflect the settings in your environment. +>- Some devices running Windows 10, version 1809 report the Delivery Optimization DownloadMode configuration value as the sequential value in the list of possible configurations rather than the actual configured value. For example, a device that is configured as HTTP + Group (2), will be shown as HTTP + Internet (3) in Update Compliance. +> +>Look for fixes for both of these issues in a forthcoming update. + ## Delivery Optimization Status The Delivery Optimization Status section includes three blades: diff --git a/windows/deployment/update/waas-delivery-optimization-reference.md b/windows/deployment/update/waas-delivery-optimization-reference.md index 582639b74e..7fbacf8aee 100644 --- a/windows/deployment/update/waas-delivery-optimization-reference.md +++ b/windows/deployment/update/waas-delivery-optimization-reference.md @@ -5,9 +5,9 @@ keywords: oms, operations management suite, wdav, updates, downloads, log analyt ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: JaimeO +author: greg-lindsay ms.localizationpriority: medium -ms.author: jaimeo +ms.author: greglin ms.collection: M365-modern-desktop ms.topic: article --- @@ -37,7 +37,7 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | --- | --- | --- | | [Download mode](#download-mode) | DODownloadMode | 1511 | | [Group ID](#group-id) | DOGroupID | 1511 | -| [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-allowed-to-use-peer-caching) | DOMinRAMAllowedToPeer | 1703 | +| [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-inclusive-allowed-to-use-peer-caching) | DOMinRAMAllowedToPeer | 1703 | | [Minimum disk size allowed to use Peer Caching](#minimum-disk-size-allowed-to-use-peer-caching) | DOMinDiskSizeAllowedToPeer | 1703 | | [Max Cache Age](#max-cache-age) | DOMaxCacheAge | 1511 | | [Max Cache Size](#max-cache-size) | DOMaxCacheSize | 1511 | @@ -70,7 +70,7 @@ Delivery Optimization uses locally cached updates. In cases where devices have a - The system drive is the default location for the Delivery Optimization cache. [Modify Cache Drive](#modify-cache-drive) allows administrators to change that location. >[!NOTE] ->It is possible to configure preferred cache devices. For more information, see [Set “preferred” cache devices for Delivery Optimization](#set-preferred-cache-devices). +>It is possible to configure preferred cache devices. For more information, see [Group ID](#group-id). All cached files have to be above a set minimum size. This size is automatically set by the Delivery Optimization cloud services, but when local storage is sufficient and the network isn't strained or congested, administrators might choose to change it to obtain increased performance. You can set the minimum size of files to cache by adjusting [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size). @@ -79,7 +79,7 @@ Additional options available that control the impact Delivery Optimization has o - [Max Upload Bandwidth](#max-upload-bandwidth) controls the Delivery Optimization upload bandwidth usage. - [Monthly Upload Data Cap](#monthly-upload-data-cap) controls the amount of data a client can upload to peers each month. - [Minimum Background QoS](#minimum-background-qos) lets administrators guarantee a minimum download speed for Windows updates. This is achieved by adjusting the amount of data downloaded directly from Windows Update or WSUS servers, rather than other peers in the network. -- [Maximum Foreground Download Bandwidth](#maximum-foreground-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. +- [Maximum Foreground Download Bandwidth](#maximum-foreground-download-bandwidth) specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. - [Maximum Background Download Bandwidth](#maximum-background-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. - [Set Business Hours to Limit Background Download Bandwidth](#set-business-hours-to-limit-background-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. - [Set Business Hours to Limit Foreground Download Bandwidth](#set-business-hours-to-limit-foreground-download-bandwidth) specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. @@ -89,7 +89,7 @@ Additional options available that control the impact Delivery Optimization has o - [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use P2P. Administrators can further customize scenarios where Delivery Optimization will be used with the following settings: -- [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-allowed-to-use-peer-caching) sets the minimum RAM required for peer caching to be enabled. +- [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-inclusive-allowed-to-use-peer-caching) sets the minimum RAM required for peer caching to be enabled. - [Minimum disk size allowed to use Peer Caching](#minimum-disk-size-allowed-to-use-peer-caching) sets the minimum disk size required for peer caching to be enabled. - [Enable Peer Caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) allows clients connected through VPN to use peer caching. - [Allow uploads while the device is on battery while under set Battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) controls the minimum battery level required for uploads to occur. You must enable this policy to allow upload while on battery. diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 1c13688e4e..765547a61f 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -5,7 +5,7 @@ keywords: oms, operations management suite, wdav, updates, downloads, log analyt ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: JaimeO +author: jaimeo ms.localizationpriority: medium ms.author: jaimeo ms.collection: M365-modern-desktop @@ -110,8 +110,46 @@ For the payloads (optional): **Does Delivery Optimization use multicast?**: No. It relies on the cloud service for peer discovery, resulting in a list of peers and their IP addresses. Client devices then connect to their peers to obtain download files over TCP/IP. -[//]: # (**What data does Delivery Optimization send to the service?**) -[//]: # (??????????????? I'm not sure we can avoid sharing this, per GDPR guidelines) +## Troubleshooting + +This section summarizes common problems and some solutions to try. + +### If you don't see any bytes from peers + +If you don’t see any bytes coming from peers the cause might be one of the following issues: + +- Clients aren’t able to reach the Delivery Optimization cloud services. +- The cloud service doesn’t see other peers on the network. +- Clients aren’t able to connect to peers that are offered back from the cloud service. + + +### Clients aren't able to reach the Delivery Optimization cloud services. + +If you suspect this is the problem, try these steps: + +1. Start a download of an app that is larger than 50 MB from the Store (for example "Candy Crush Saga"). +2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and observe the DownloadMode setting. For peering to work, DownloadMode should be 1, 2, or 3. +3. If **DownloadMode** is 99 it could indicate your device is unable to reach the Delivery Optimization cloud services. Ensure that the Delivery Optimization hostnames are allowed access: most importantly **\*.do.dsp.mp.microsoft.com**. + + + +### The cloud service doesn't see other peers on the network. + +If you suspect this is the problem, try these steps: + +1. Download the same app on two different devices on the same network, waiting 10 – 15 minutes between downloads. +2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and ensure that **DownloadMode** is 1 or 2 on both devices. +3. Run `Get-DeliveryOptimizationPerfSnap` from an elevated Powershell window on the second device. The **NumberOfPeers** field should be non-zero. +4. If the number of peers is zero and you have **DownloadMode** = 1, ensure that both devices are using the same public IP address to reach the internet. To do this, open a browser Windows and search for “what is my IP”. You can **DownloadMode 2** (Group) and a custom GroupID (Guid) to fix this if the devices aren’t reporting the same public IP address. + + +### Clients aren't able to connect to peers offered by the cloud service + +If you suspect this is the problem, try a Telnet test between two devices on the network to ensure they can connect using port 7680. To do this, follow these steps: + +1. Install Telnet by running **dism /online /Enable-Feature /FeatureName:TelnetClient** from an elevated command prompt. +2. Run the test. For example, if you are on device with IP 192.168.8.12 and you are trying to test the connection to 192.168.9.17 run **telnet 192.168.9.17 7680** (the syntax is *telnet [destination IP] [port]*. You will either see a connection error or a blinking cursor like this /_. The blinking cursor means success. + diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index be96b68e59..19a38e1f89 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -85,13 +85,13 @@ Starting with Windows 10, version 1709, the Windows Update for Business settings | Manage Windows Insider Preview builds | System/AllowBuildPreview | Update/ManagePreviewBuilds | | Manage when updates are received | Select when Feature Updates are received | Select when Preview Builds and Feature Updates are received (Update/BranchReadinessLevel) | -## Managing Windows Update for Business with Software Center Configuration Manager +## Managing Windows Update for Business with System Center Configuration Manager -Starting with Windows 10, version 1709, you can assign a collection of devices to have dual scan enabled and manage that collection with Windows Update for Business policies. Starting with Windows 10, version 1809, you can set a collection of devices to receive the Windows Insider Preview Feature Updates from Windows Update from within Software Center Configuration Manager. +Starting with Windows 10, version 1709, you can assign a collection of devices to have dual scan enabled and manage that collection with Windows Update for Business policies. Starting with Windows 10, version 1809, you can set a collection of devices to receive the Windows Insider Preview Feature Updates from Windows Update from within System Center Configuration Manager. | Action | Windows 10 versions between 1709 and 1809 | Windows 10 versions after 1809 | | --- | --- | --- | -| Manage Windows Update for Business in Configuration Manager | Manage Feature or Quality Updates with Windows Update for Business via Dual Scan | Manage Insider pre-release builds with Windows Update for Business within Software Center Configuration Manager | +| Manage Windows Update for Business in Configuration Manager | Manage Feature or Quality Updates with Windows Update for Business via Dual Scan | Manage Insider pre-release builds with Windows Update for Business within System Center Configuration Manager | ## Managing Windows Update for Business with Windows Settings options Windows Settings includes options to control certain Windows Update for Business features: diff --git a/windows/deployment/update/waas-quick-start.md b/windows/deployment/update/waas-quick-start.md index 9ef541fce2..af88e40987 100644 --- a/windows/deployment/update/waas-quick-start.md +++ b/windows/deployment/update/waas-quick-start.md @@ -69,8 +69,8 @@ Click the following Microsoft Mechanics video for an overview of the updated rel ## Learn more -[Adopting Windows as a service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) - +- [Adopting Windows as a service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) +- [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) ## Related topics diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md index 13c1dce96d..ee8f3c4fde 100644 --- a/windows/deployment/update/waas-restart.md +++ b/windows/deployment/update/waas-restart.md @@ -42,6 +42,9 @@ When **Configure Automatic Updates** is enabled in Group Policy, you can enable - **Turn off auto-restart for updates during active hours** prevents automatic restart during active hours. - **No auto-restart with logged on users for scheduled automatic updates installations** prevents automatic restart when a user is signed in. If a user schedules the restart in the update notification, the device will restart at the time the user specifies even if a user is signed in at the time. This policy only applies when **Configure Automatic Updates** is set to option **4-Auto download and schedule the install**. +> [!NOTE] +> When using Remote Desktop Protocol connections, only active RDP sessions are considered as logged on users. Devices that do not have locally logged on users, or active RDP sessions, will be restarted. + You can also use Registry, to prevent automatic restarts when a user is signed in. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4** and enable **NoAutoRebootWithLoggedOnUsers**. As with Group Policy, if a user schedules the restart in the update notification, it will override this setting. For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart). @@ -159,8 +162,9 @@ In the Group Policy editor, you will see a number of policy settings that pertai >[!NOTE] >You can only choose one path for restart behavior. -> >If you set conflicting restart policies, the actual restart behavior may not be what you expected. +>When using RDP, only active RDP sessions are considered as logged on users. + ## Registry keys used to manage restart The following tables list registry values that correspond to the Group Policy settings for controlling restarts after updates in Windows 10. diff --git a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md index ea9214c57b..9942044960 100644 --- a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md +++ b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md @@ -86,7 +86,7 @@ If you have devices that appear in other solutions, but not Device Health (the D 3. Verify that the Commercial ID is present in the device's registry. For details see [https://gpsearch.azurewebsites.net/#13551](https://gpsearch.azurewebsites.net/#13551). 4. Confirm that devices have opted in to provide diagnostic data by checking in the registry that **AllowTelemetry** is set to 2 (Enhanced) or 3 (Full) in **HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection** (or **HKLM\Software\Policies\Microsoft\Windows\DataCollection**, which takes precedence if set). 5. Verify that devices can reach the endpoints specified in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). Also check settings for SSL inspection and proxy authentication; see [Configuring endpoint access with SSL inspection](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#configuring-endpoint-access-with-ssl-inspection) for more information. -6. Remove the Device Health (appears as DeviceHealthProd on some pages) from your Log Analytics workspace +6. Add the Device Health solution back to your Log Analytics workspace. 7. Wait 48 hours for activity to appear in the reports. 8. If you need additional troubleshooting, contact Microsoft Support. diff --git a/windows/deployment/upgrade/upgrade-readiness-data-sharing.md b/windows/deployment/upgrade/upgrade-readiness-data-sharing.md index 9753f76d40..b7b51ae981 100644 --- a/windows/deployment/upgrade/upgrade-readiness-data-sharing.md +++ b/windows/deployment/upgrade/upgrade-readiness-data-sharing.md @@ -12,16 +12,7 @@ ms.collection: M365-analytics # Upgrade Readiness data sharing -To enable data sharing with the Upgrade Readiness solution, the following endpoints must be accessible: - - -| **Endpoint** | **Function** | -|---------------------------------------------------------|-----------| -| `https://v10.vortex-win.data.microsoft.com/collect/v1`
`https://Vortex-win.data.microsoft.com/health/keepalive` | Connected User Experiences and Telemetry component endpoint. User computers send data to Microsoft through this endpoint. | -| `https://settings.data.microsoft.com/qos` | Enables the compatibility update KB to send data to Microsoft. | -| `https://go.microsoft.com/fwlink/?LinkID=544713`
`https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc` | This service provides driver information about whether there will be a driver available post-upgrade for the hardware on the system. | - -Whitelist these endpoints on your network. This might require working with your organizations's network security group. +To enable data sharing with the Upgrade Readiness solution, double-check the endpoints list in [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md#enable-data-sharing) to be sure they are whitelisted. ## Connectivity to the Internet @@ -38,10 +29,10 @@ In order to use the direct connection scenario, set the parameter **ClientProxy= This is the first and most simple proxy scenario. The WinHTTP stack was designed for use in services and does not support proxy autodetection, PAC scripts or authentication. In order to set the WinHTTP proxy system-wide on your computers, you need to -•Use the command netsh winhttp set proxy \
->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. +> This is a 300 level topic (moderately advanced). +> See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. When Windows Setup fails, the result and extend code are recorded as an informational event in the Application log by Windows Error Reporting as event 1001. The event name is **WinSetupDiag02**. You can use Event Viewer to review this event, or you can use Windows PowerShell. To use Windows PowerShell, type the following commands from an elevated Windows PowerShell prompt: -``` +>[!IMPORTANT] +>}The following source will be available only if you have updated from a previous version of Windows 10 to a new version. If you installed the current version and have not updated, the source named **WinSetupDiag02** will be unavailable. + +```Powershell $events = Get-WinEvent -FilterHashtable @{LogName="Application";ID="1001";Data="WinSetupDiag02"} $event = [xml]$events[0].ToXml() $event.Event.EventData.Data @@ -40,19 +43,20 @@ To use Event Viewer: Note: For legacy operating systems, the Event Name was WinSetupDiag01. Ten parameters are listed in the event: -
-
| P1: The Setup Scenario (1=Media,5=WindowsUpdate,7=Media Creation Tool) |
| P2: Setup Mode (x=default,1=Downlevel,5=Rollback) |
| P3: New OS Architecture (x=default,0=X86,9=AMD64) |
| P4: Install Result (x=default,0=Success,1=Failure,2=Cancel,3=Blocked) |
| P5: Result Error Code (Ex: 0xc1900101) |
| P6: Extend Error Code (Ex: 0x20017) |
| P7: Source OS build (Ex: 9600) |
| P8: Source OS branch (not typically available) |
| P9: New OS build (Ex: 16299} |
| P10: New OS branch (Ex: rs3_release} |
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
[Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +[Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md index d5eff8daa4..b2bade848b 100644 --- a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md +++ b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md @@ -28,6 +28,9 @@ Windows Easy Transfer is a software wizard for transferring files and settings With Windows Easy Transfer, files and settings can be transferred using a network share, a USB flash drive (UFD), or the Easy Transfer cable. However, you cannot use a regular universal serial bus (USB) cable to transfer files and settings with Windows Easy Transfer. An Easy Transfer cable can be purchased on the Web, from your computer manufacturer, or at an electronics store. +> [!NOTE] +> Windows Easy Transfer [is not available in Windows 10](https://support.microsoft.com/help/4026265/windows-windows-easy-transfer-is-not-available-in-windows-10). + ### Migrate with the User State Migration Tool You can use USMT to automate migration during large deployments of the Windows operating system. USMT uses configurable migration rule (.xml) files to control exactly which user accounts, user files, operating system settings, and application settings are migrated and how they are migrated. You can use USMT for both *side-by-side* migrations, where one piece of hardware is being replaced, or *wipe-and-load* (or *refresh*) migrations, when only the operating system is being upgraded. diff --git a/windows/deployment/usmt/usmt-scanstate-syntax.md b/windows/deployment/usmt/usmt-scanstate-syntax.md index 3090160049..15e9ea1b2d 100644 --- a/windows/deployment/usmt/usmt-scanstate-syntax.md +++ b/windows/deployment/usmt/usmt-scanstate-syntax.md @@ -455,9 +455,9 @@ By default, all users are migrated. The only way to specify which users to inclu
USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /all option, you cannot also use the /ui, /ue or /uel options.
/ui:<DomainName>\<UserName>
+/ui:<DomainName>\<UserName>
or
-/ui:<ComputerName>\<LocalUserName>
/ui:<ComputerName>\<LocalUserName>
(User include)
Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue or /uel options. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk (*) wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.
@@ -469,10 +469,10 @@ By default, all users are migrated. The only way to specify which users to inclu
For example:
-
-
To include only User2 from the Fabrikam domain, type:
-/ue:*\* /ui:fabrikam\user2
-To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30Â days, type:
-
+/uel:30 /ui:fabrikam\*To include only User2 from the Fabrikam domain, type:
+
+/ue:*\* /ui:fabrikam\user2To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30Â days, type:
+/uel:30 /ui:fabrikam\*In this example, a user account from the Contoso domain that was last modified 2Â months ago will not be migrated.
For more examples, see the descriptions of the /ue and /ui options in this table.
/uel:2002/1/15 migrates users who have logged on or been modified January 15, 2002 or afterwards.
For example:
-scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0
scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0
/ue:<DomainName>\<UserName>
+/ue:<DomainName>\<UserName>
-or-
-/ue:<ComputerName>\<LocalUserName>
/ue:<ComputerName>\<LocalUserName>
(User exclude)
Excludes the specified users from the migration. You can specify multiple /ue options. You cannot use this option with the /all option. <DomainName> and <UserName> can contain the asterisk (*) wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.
For example:
-scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1
scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1
Exclude all domain users.
/ue:Domain\*
/ue:Domain\*
Exclude all local users.
/ue:%computername%\*
/ue:%computername%\*
Exclude users in all domains named User1, User2, and so on.
/ue:*\user*
/ue:*\user*
Include only User2 from the Fabrikam domain and exclude all other users.
/ue:*\* /ui:fabrikam\user2
/ue:*\* /ui:fabrikam\user2
Include only the local user named User1 and exclude all other users.
/ue:*\* /ui:user1
/ue:*\* /ui:user1
Include only the domain users from Contoso, except Contoso\User1.
This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:
-
-
On the ScanState command line, type:
/ue:*\* /ui:contoso\*
+On the ScanState command line, type:
/ue:*\* /ui:contoso\*On the LoadState command line, type:
/ue:contoso\user1
Include only local (non-domain) users.
/ue:*\* /ui:%computername%\*
/ue:*\* /ui:%computername%\*
-
 **Download a free 90-day evaluation** Try the latest features. Test your apps, hardware, and deployment strategies. Start evaluation |  **Get started with virtual labs** Try setup, deployment, and management scenarios in a virtual environment, with no additional software or setup required. See Windows 10 labs |  **Conduct a proof of concept** Download a lab environment with MDT, Configuration Manager, Windows 10, and more. Get deployment kit |
-
 | What's new in Windows 10, version 1809 What's new in Windows 10, version 1803 What's new in Windows 10, version 1709 Windows 10 release information Windows 10 update history Windows 10 roadmap |
-
| Windows 10 FAQ for IT Pros Windows 10 forums Windows 10 TechCommunity Which edition is right for your organization? Infrastructure requirements What's Windows as a service? Windows 10 Mobile deployment and management guide |  |
-
 **Application compatibility** Get best practices and tools to help you address compatibility issues prior to deployment. Find apps that are ready for Windows 10. Identify and prioritize apps with Upgrade Readiness Test, validate, and implement with the Web Application Compatibility Lab Kit |  **Upgrade options** Learn about the options available for upgrading Windows 7, Windows 8, or Windows 8.1 PCs and devices to Windows 10. Manage Windows upgrades with Upgrade Readiness Windows 10 upgrade paths Windows 10 edition upgrades |  **Windows as a service** Windows as a service provides ongoing new capabilities and updates while maintaining a high level of hardware and software compatibility. Explore |
-
 **In-place upgrade** The simplest way to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 is to do an in-place upgrade. Upgrade to Windows 10 with Configuration Manager Upgrade to Windows 10 with MDT |  **Traditional deployment** Some organizations may still need to opt for an image-based deployment of Windows 10. Deploy Windows 10 with Configuration Manager Deploy Windows 10 with MDT |
 **Dynamic provisioning** With Windows 10 you can create provisioning packages that let you quickly configure a device without having to install a new image. Provisioning packages for Windows 10 Build and apply a provisioning package Customize Windows 10 start and the taskbar |  **Other deployment scenarios** Get guidance on how to deploy Windows 10 for students, faculty, and guest users - and how to deploy line-of-business apps. Windows deployment for education environments Set up a shared or guest PC with Windows 10 Sideload apps in Windows 10 |
-
 **Manage Windows 10 updates** Get best practices and tools to help you manage clients and apps. Manage clients in Windows 10 Manage apps and features in Windows 10 |  **Security** Intelligent security, powered by the cloud. Out-of-the-box protection, advanced security features, and intelligent management to respond to advanced threats. Windows 10 enterprise security Threat protection Identity protection Information protection |
 **Sign up for the Windows IT Pro Insider** Find out about new resources and get expert tips and tricks on deployment, management, security, and more. Learn more |  **Follow us on Twitter** Keep up with the latest desktop and device trends, Windows news, and events for IT pros. Visit Twitter |  **Join the Windows Insider Program for Business** Get early access to new builds and provide feedback on the latest features and functionalities. Get started |
Disable this policy to turn off Cortana. | -| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results.
Disable this policy to block access to location information for Cortana. | -| Do not allow web search | Choose whether to search the web from Windows Desktop Search.
Enable this policy to remove the option to search the Internet from Cortana. | -| Don't search the web or display web results in Search| Choose whether to search the web from Cortana.
Enable this policy to stop web queries and results from showing in Search. | -| Set what information is shared in Search | Control what information is shared with Bing in Search.
If you enable this policy and set it to **Anonymous info**, usage information will be shared but not search history, Microsoft Account information, or specific location. | +| Allow Cortana | Choose whether to let Cortana install and run on the device.
**Disable** this policy to turn off Cortana. | +| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results.
**Disable** this policy to block access to location information for Cortana. | +| Do not allow web search | Choose whether to search the web from Windows Desktop Search.
**Enable** this policy to remove the option to search the Internet from Cortana. | +| Don't search the web or display web results in Search| Choose whether to search the web from Cortana.
**Enable** this policy to stop web queries and results from showing in Search. | +| Set what information is shared in Search | Control what information is shared with Bing in Search.
If you **enable** this policy and set it to **Anonymous info**, usage information will be shared but not search history, Microsoft Account information, or specific location. | You can also apply the Group Policies using the following registry keys: | Policy | Registry Path | |------------------------------------------------------|---------------------------------------------------------------------------------------| -| Allow Cortana | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: AllowCortana
Value: 0| -| Allow search and Cortana to use location | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: AllowSearchToUseLocation
Value: 0 | -| Do not allow web search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: DisableWebSearch
Value: 1 | -| Don't search the web or display web results in Search| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: ConnectedSearchUseWeb
Value: 0 | -| Set what information is shared in Search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: ConnectedSearchPrivacy
Value: 3 | +| Allow Cortana | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: AllowCortana
Value: 0| +| Allow search and Cortana to use location | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: AllowSearchToUseLocation
Value: 0 | +| Do not allow web search | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: DisableWebSearch
Value: 1 | +| Don't search the web or display web results in Search| HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: ConnectedSearchUseWeb
Value: 0 | +| Set what information is shared in Search | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: ConnectedSearchPrivacy
Value: 3 | >[!IMPORTANT] ->These steps are not required for devices running Windows 10, version 1607 or Windows Server 2016. +> Using the Group Policy editor these steps are required for all supported versions of Windows 10, however they are not required for devices running Windows 10, version 1607 or Windows Server 2016. -1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. +1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security** > **Windows Defender Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. 2. Right-click **Outbound Rules**, and then click **New Rule**. The **New Outbound Rule Wizard** starts. @@ -363,12 +362,15 @@ You can also apply the Group Policies using the following registry keys: 9. Configure the **Protocols and Ports** page with the following info, and then click **OK**. - - For **Protocol type**, choose **TCP**. + - For **Protocol type**, choose **TCP**. - - For **Local port**, choose **All Ports**. + - For **Local port**, choose **All Ports**. - - For **Remote port**, choose **All ports**. + - For **Remote port**, choose **All ports**. +-or- + +- Create a new REG_SZ registry setting named **{0DE40C8E-C126-4A27-9371-A27DAB1039F7}** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\FirewallRules** and set it to a value of **v2.25|Action=Block|Active=TRUE|Dir=Out|Protocol=6|App=%windir%\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\searchUI.exe|Name=Block outbound Cortana|** If your organization tests network traffic, do not use a network proxy as Windows Firewall does not block proxy traffic. Instead, use a network traffic analyzer. Based on your needs, there are many network traffic analyzers available at no cost. @@ -389,29 +391,26 @@ You can prevent Windows from setting the time automatically. -or- -- Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters\\Type** with a value of **NoSync**. +- Create a REG_SZ registry setting in **HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters\\Type** with a value of **NoSync**. After that, configure the following: -- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Enable Windows NTP Server** > **Windows Time Service** > **Configure Windows NTP Client** +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Windows Time Service** > **Time Providers** > **Enable Windows NTP Client** - > [!NOTE] - > This is only available on Windows 10, version 1703 and later. If you're using Windows 10, version 1607, the Group Policy setting is **Computer Configuration** > **Administrative Templates** > **System** > **Windows Time Service** > **Time Providers** > **Enable Windows NTP Client** + -or- - -or - - -- Create a new REG\_DWORD registry setting named **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient** and set it to 0 (zero). +- Create a new REG_DWORD registry setting named **Enabled** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient** and set it to **0 (zero)**. ### 4. Device metadata retrieval To prevent Windows from retrieving device metadata from the Internet: -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**. +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**. -or - -- Create a new REG\_DWORD registry setting named **PreventDeviceMetadataFromNetwork** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata** and set it to 1 (one). +- Create a new REG_DWORD registry setting named **PreventDeviceMetadataFromNetwork** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata** and set it to 1 (one). -or - @@ -421,13 +420,15 @@ To prevent Windows from retrieving device metadata from the Internet: To turn off Find My Device: -- Turn off the feature in the UI +- Turn **Off** the feature in the UI by going to **Settings -> Update & Security -> Find My Device**, click the Change button, and set the value to **Off** -or- -- Disable the Group Policy: **Computer Configuration** > **Administrative Template** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device** +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Template** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device** -You can also create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FindMyDevice\\AllowFindMyDevice** to 0 (zero). + -or- + +- You can also create a new REG_DWORD registry setting **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FindMyDevice\\AllowFindMyDevice** to **0 (zero)**. ### 6. Font streaming @@ -435,15 +436,19 @@ Fonts that are included in Windows but that are not stored on the local device c If you're running Windows 10, version 1607, Windows Server 2016, or later: -- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **Fonts** > **Enable Font Providers**. +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **Fonts** > **Enable Font Providers**. -- Create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\System\\EnableFontProviders** to 0 (zero). + -or- + +- Create a new REG_DWORD registry setting **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\EnableFontProviders** to **0 (zero)**. + + -or- - In Windows 10, version 1703, you can apply the System/AllowFontProviders MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: - - **false**. Font streaming is disabled. + - **False**. Font streaming is Disabled. - - **true**. Font streaming is enabled. + - **True**. Font streaming is Enabled. > [!NOTE] > After you apply this policy, you must restart the device for it to take effect. @@ -451,8 +456,7 @@ If you're running Windows 10, version 1607, Windows Server 2016, or later: ### 7. Insider Preview builds -The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. -This setting stops communication with the Windows Insider Preview service that checks for new builds. +The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. This setting stops communication with the Windows Insider Preview service that checks for new builds. Windows Insider Preview builds only apply to Windows 10 and are not available for Windows Server 2016. @@ -461,7 +465,7 @@ Windows Insider Preview builds only apply to Windows 10 and are not available fo To turn off Insider Preview builds for a released version of Windows 10: -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. To turn off Insider Preview builds for Windows 10: @@ -472,11 +476,11 @@ To turn off Insider Preview builds for Windows 10: -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. +- **Enable** the Group Policy **Toggle user control over Insider builds** under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** - -or - + -or- -- Create a new REG\_DWORD registry setting named **AllowBuildPreview** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\PreviewBuilds** with a vlue of 0 (zero) +- Create a new REG_DWORD registry setting named **AllowBuildPreview** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\PreviewBuilds** with a **value of 0 (zero)** -or- @@ -488,63 +492,70 @@ To turn off Insider Preview builds for Windows 10: - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. - -or- - -- Create a provisioning package: **Runtime settings** > **Policies** > **System** > **AllowBuildPreview**, where: - - - **0**. Users cannot make their devices available for downloading and installing preview software. - - - **1**. Users can make their devices available for downloading and installing preview software. - - - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. ### 8. Internet Explorer - -Use Group Policy to manage settings for Internet Explorer. You can find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. +> [!NOTE] +> The following Group Policies and Registry Keys are for user interactive scenarios rather then the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings: | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites.
Default: Enabled
You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.| -| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the Address Bar.
Default: Enabled| -| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the Address Bar.
Default: Disabled You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| -| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
Default: Disabled| -| Prevent managing SmartScreen filter | Choose whether employees can manage the SmartScreen Filter in Internet Explorer.
Default: Disabled | +| Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites.
**Set Value to: Disabled**
You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.| +| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the Address Bar.
**Set Value to: Disabled**| +| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the Address Bar.
**Set Value to: Enabled** You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| +| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
**Set Value to: Enabled**| +| Prevent managing SmartScreen filter | Choose whether employees can manage the SmartScreen Filter in Internet Explorer.
**Set Value to: Enabled** and then set **Select SmartScreen filtering mode** to **Off**.| -Alternatively, you could use the registry to set the Group Policies. -| Policy | Registry path | +| Registry Key | Registry path | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Turn on Suggested Sites| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Suggested Sites
REG_DWORD: Enabled
Value: 0| -| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer
REG_DWORD: AllowServicePoweredQSA
Value: 0| -| Turn off the auto-complete feature for web addresses | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\AutoComplete
REG_SZ: AutoSuggest
Value: **No** | -| Turn off browser geolocation | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation
REG_DWORD: PolicyDisableGeolocation
Value: 1 | -| Prevent managing SmartScreen filter | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter
REG_DWORD: EnabledV9
Value: 0 | +| Turn on Suggested Sites| HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Suggested Sites
REG_DWORD: Enabled
**Set Value to: 0**| +| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer
REG_DWORD: AllowServicePoweredQSA
**Set Value to: 0**| +| Turn off the auto-complete feature for web addresses |HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\CurrentVersion\\Explorer\\AutoComplete
REG_SZ: AutoSuggest
Set Value to: **no** | +| Turn off browser geolocation | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation
REG_DWORD: PolicyDisableGeolocation
**Set Value to: 1** | +| Prevent managing SmartScreen filter | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter
REG_DWORD: EnabledV9
**Set Value to: 0** | There are more Group Policy objects that are used by Internet Explorer: | Path | Policy | Description | | - | - | - | -| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Compatibility View** > **Turn off Compatibility View** | Choose whether employees can configure Compatibility View. | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
Default: Disabled | -| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
Default: Enabled | -| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices.
Default: Enabled | -| **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Allow Online Tips** | Allow Online Tips | Enables or disables the retrieval of online tips and help for the Settings app.
Set to : Disabled | +| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Compatibility View** > **Turn off Compatibility View** | Choose whether employees can configure Compatibility View. | Choose whether an employee can fix website display problems that he or she may encounter while browsing.
**Set to: Enabled** | +| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
**Set to: Enabled** | +| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices.
**Set to: Enabled** | +| **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Allow Online Tips** | Allow Online Tips | Enables or disables the retrieval of online tips and help for the Settings app.
**Set to: Disabled** | -You can also use registry entries to set these Group Policies. +You can also use Registry keys to set these policies. -| Policy | Registry path | +| Registry Key | Registry path | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Choose whether employees can configure Compatibility View. | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation
REG_DWORD: MSCompatibilityMode
Value: 0| -| Turn off the flip ahead with page prediction feature | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\FlipAhead
REG_DWORD: Enabled
Value: 0| -| Turn off background synchronization for feeds and Web Slices | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds
REG_DWORD: BackgroundSyncStatus
Value: 0| -| Turn off Online Tips | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer
REG_DWORD: AllowOnlineTips
Value: 0| +| Choose whether employees can configure Compatibility View. | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\BrowserEmulation
REG_DWORD: DisableSiteListEditing
**Set Value to 1**| +| Turn off the flip ahead with page prediction feature | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\FlipAhead
REG_DWORD: Enabled
**Set Value to 0**| +| Turn off background synchronization for feeds and Web Slices | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds
REG_DWORD: BackgroundSyncStatus
**Set Value to 0**| +| Allow Online Tips | HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer
REG_DWORD: AllowOnlineTips
**Set Value to 0**| + +To turn off the home page, **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Disable changing home page settings**, and set it to **about:blank**. + + -or - + +- Create a new REG_SZ registry setting named **Start Page** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main** with a **about:blank** + + -and - + +- Create a new REG_DWORD registry setting named **HomePage** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel** with a **1 (one)** +To configure the First Run Wizard, **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Prevent running First Run wizard**, and set it to **Go directly to home page**. -To turn off the home page, enable the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Disable changing home page settings**, and set it to **about:blank**. + -or - -To configure the First Run Wizard, enable the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Prevent running First Run wizard**, and set it to **Go directly to home page**. +- Create a new REG_DWORD registry setting named **DisableFirstRunCustomize** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main** with a **1 (one)** + + +To configure the behavior for a new tab, **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Specify default behavior for a new tab**, and set it to **about:blank**. + + -or - + +- Create a new REG_DWORD registry setting named **NewTabPageShow** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\TabbedBrowsing** with a **0 (zero)** -To configure the behavior for a new tab, enable the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Specify default behavior for a new tab**, and set it to **about:blank**. ### 8.1 ActiveX control blocking @@ -552,11 +563,11 @@ ActiveX control blocking periodically downloads a new list of out-of-date Active You can turn this off by: -- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Features** > **Add-on Management** > **Turn off Automatic download of the ActiveX VersionList** +- **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Features** > **Add-on Management** > **Turn off Automatic download of the ActiveX VersionList** -or - -- Changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero). +- Changing the REG_DWORD registry setting **HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to **0 (zero)**. For more info, see [Out-of-date ActiveX control blocking](https://technet.microsoft.com/library/dn761713.aspx). @@ -564,7 +575,7 @@ For more info, see [Out-of-date ActiveX control blocking](https://technet.micros You can turn off License Manager related traffic by setting the following registry entry: -- Add a REG\_DWORD value named **Start** to **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\LicenseManager** and set the value to 4 +- Add a REG_DWORD value named **Start** to **HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LicenseManager** and set the **value to 4** - The value 4 is to disable the service. Here are the available options to set the registry: @@ -582,11 +593,11 @@ You can turn off License Manager related traffic by setting the following regist To turn off Live Tiles: -- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage** -or- -- Create a REG\_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a value of 1 (one). +- Create a REG_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a **value of 1 (one)** In Windows 10 Mobile, you must also unpin all tiles that are pinned to Start. @@ -606,28 +617,26 @@ To turn off mail synchronization for Microsoft Accounts that are configured on a To turn off the Windows Mail app: -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Mail** > **Turn off Windows Mail application** - - -or- - -- Create a REG\_DWORD registry setting named **ManualLaunchAllowed** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Mail** with a value of 0 (zero). +- Create a REG_DWORD registry setting named **ManualLaunchAllowed** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Mail** with a **value of 0 (zero)**. ### 12. Microsoft Account To prevent communication to the Microsoft Account cloud authentication service. Many apps and system components that depend on Microsoft Account authentication may lose functionality. Some of them could be in unexpected ways. For example, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). -- Apply the Group Policy: **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options** > **Accounts: Block Microsoft Accounts** and set it to **Users can't add Microsoft accounts**. +- **Enable** the Group Policy: **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options** > **Accounts: Block Microsoft Accounts** and set it to **Users can't add Microsoft accounts**. -or- -- Create a REG\_DWORD registry setting named **NoConnectedUser** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System** with a value of 3. +- Create a REG_DWORD registry setting named **NoConnectedUser** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System** with a **value of 3**. To disable the Microsoft Account Sign-In Assistant: - Apply the Accounts/AllowMicrosoftAccountSignInAssistant MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on. -- Change the Start REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\wlidsvc** to a value of **4**. + -or- + +- Change the **Start** REG_DWORD registry setting in **HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\wlidsvc** to a value of **4**. ### 13. Microsoft Edge @@ -640,30 +649,33 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Allow configuration updates for the Books Library | Choose whether configuration updates are done for the Books Library.
Default: Enabled | -| Configure Autofill | Choose whether employees can use autofill on websites.
Default: Enabled | -| Configure Do Not Track | Choose whether employees can send Do Not Track headers.
Default: Disabled | -| Configure Password Manager | Choose whether employees can save passwords locally on their devices.
Default: Enabled | -| Configure search suggestions in Address Bar | Choose whether the Address Bar shows search suggestions.
Default: Enabled | -| Configure Windows Defender SmartScreen (Windows 10, version 1703) | Choose whether Windows Defender SmartScreen is turned on or off.
Default: Enabled | -| Allow web content on New Tab page | Choose whether a new tab page appears.
Default: Enabled | -| Configure Start pages | Choose the Start page for domain-joined devices.
Set this to **\
Set to: Enable | +| Allow Address bar drop-down list suggestions | Choose whether to show the address bar drop-down list
**Set to Disabled** | +| Allow configuration updates for the Books Library | Choose whether configuration updates are done for the Books Library.
**Set to Disabled** | +| Configure Autofill | Choose whether employees can use autofill on websites.
**Set to Disabled** | +| Configure Do Not Track | Choose whether employees can send Do Not Track headers.
**Set to Enabled** | +| Configure Password Manager | Choose whether employees can save passwords locally on their devices.
**Set to Disabled** | +| Configure search suggestions in Address Bar | Choose whether the Address Bar shows search suggestions.
**Set to Disabled** | +| Configure Windows Defender SmartScreen (Windows 10, version 1703) | Choose whether Windows Defender SmartScreen is turned on or off.
**Set to Disabled** | +| Allow web content on New Tab page | Choose whether a new tab page appears.
**Set to Disabled** | +| Configure Start pages | Choose the Start page for domain-joined devices.
**Enabled** and **Set this to <
**Set to: Enable** | +| Allow Microsoft Compatibility List | Choose whether to use the Microsoft Compatibility List in Microsoft Edge.
**Set to: Disabled** | -Alternatively, you can configure the Microsoft Group Policies using the following registry entries: +Alternatively, you can configure the these Registry keys as described: -| Policy | Registry path | +| Registry Key | Registry path | | - | - | -| Allow Address Bar drop-down list suggestions | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
REG_DWORD name: ShowOneBox
Value: 0| -| Allow configuration updates for the Books Library | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary
REG_DWORD name: AllowConfigurationUpdateForBooksLibrary
Value: 1| -| Configure Autofill | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_SZ name: Use FormSuggest
Value : **no** | -| Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_DWORD name: DoNotTrack
REG_DWORD: 1 | -| Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_SZ name: FormSuggest Passwords
REG_SZ: **no** | -| Configure search suggestions in Address Bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
REG_DWORD name: ShowSearchSuggestionsGlobal
Value: 0| -| Configure Windows Defender SmartScreen Filter (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
REG_DWORD name: EnabledV9
Value: 0 | -| Allow web content on New Tab page | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
REG_DWORD name: AllowWebContentOnNewTabPage
Value: 0 | -| Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
REG_DWORD name: ProvisionedHomePages
Value: 0| -| Prevent the First Run webpage from opening on Microsoft Edge | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_DWORD name: PreventFirstRunPage
Value: 1| +| Allow Address Bar drop-down list suggestions | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
REG_DWORD name: ShowOneBox
Set to **0**| +| Allow configuration updates for the Books Library | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary
REG_DWORD name: AllowConfigurationUpdateForBooksLibrary
Set to **0**| +| Configure Autofill | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_SZ name: Use FormSuggest
Value : **No** | +| Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_DWORD name: DoNotTrack
REG_DWORD: **1** | +| Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_SZ name: FormSuggest Passwords
REG_SZ: **No** | +| Configure search suggestions in Address Bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
REG_DWORD name: ShowSearchSuggestionsGlobal
Value: **0**| +| Configure Windows Defender SmartScreen Filter (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
REG_DWORD name: EnabledV9
Value: **0** | +| Allow web content on New Tab page | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
REG_DWORD name: AllowWebContentOnNewTabPage
Value: **0** | +| Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Internet Settings
REG_SZ name: ProvisionedHomePages
Value: **<
REG_DWORD name: PreventFirstRunPage
Value: **1**| +| Choose whether employees can configure Compatibility View. | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation
REG_DWORD: MSCompatibilityMode
Value: **0**| ### 13.2 Microsoft Edge MDM policies @@ -672,13 +684,13 @@ The following Microsoft Edge MDM policies are available in the [Policy CSP](http | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Browser/AllowAutoFill | Choose whether employees can use autofill on websites.
Default: Allowed | -| Browser/AllowDoNotTrack | Choose whether employees can send Do Not Track headers.
Default: Not allowed | -| Browser/AllowMicrosoftCompatbilityList | Specify the Microsoft compatibility list in Microsoft Edge.
Default: Enabled | -| Browser/AllowPasswordManager | Choose whether employees can save passwords locally on their devices.
Default: Allowed | -| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the Address Bar shows search suggestions..
Default: Allowed | -| Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
Default: Allowed | -| Browser/FirstRunURL | Choose the home page for Microsoft Edge on Windows Mobile 10.
Default: blank | +| Browser/AllowAutoFill | Choose whether employees can use autofill on websites.
**Set to: Not Allowed** | +| Browser/AllowDoNotTrack | Choose whether employees can send Do Not Track headers.
**Set to: Allowed** | +| Browser/AllowMicrosoftCompatbilityList | Specify the Microsoft compatibility list in Microsoft Edge.
**Set to: Not Allowed** | +| Browser/AllowPasswordManager | Choose whether employees can save passwords locally on their devices.
**Set to: Not Allowed** | +| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the Address Bar shows search suggestions..
**Set to: Not Allowed** | +| Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
**Set to: Not Allowed** | +| Browser/FirstRunURL | Choose the home page for Microsoft Edge on Windows Mobile 10.
**Set to:** blank | For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/available-policies). @@ -691,7 +703,7 @@ In versions of Windows 10 prior to Windows 10, version 1607 and Windows Server 2 You can turn off NCSI by doing one of the following: -- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** - In Windows 10, version 1703 and later, apply the Connectivity/DisallowNetworkConnectivityActiveTests MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-connectivity#connectivity-disallownetworkconnectivityactivetests) with a value of 1. @@ -700,49 +712,49 @@ You can turn off NCSI by doing one of the following: -or- -- Create a REG\_DWORD registry setting named **NoActiveProbe** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkConnectivityStatusIndicator** with a value of 1 (one). +- Create a REG_DWORD registry setting named **NoActiveProbe** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkConnectivityStatusIndicator** with a value of 1 (one). ### 15. Offline maps You can turn off the ability to download and update offline maps. -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** -or- -- Create a REG\_DWORD registry setting named **AutoDownloadAndUpdateMapData** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps** with a value of 0 (zero). +- Create a REG_DWORD registry setting named **AutoDownloadAndUpdateMapData** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps** with a **value of 0 (zero)**. -or- -- In Windows 10, version 1607 and later, apply the Maps/EnableOfflineMapsAutoUpdate MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-maps#maps-enableofflinemapsautoupdate) with a value of 0. +- In Windows 10, version 1607 and later, apply the Maps/EnableOfflineMapsAutoUpdate MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-maps#maps-enableofflinemapsautoupdate) with a **value of 0**. -and- -- In Windows 10, version 1607 and later, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off unsolicited network traffic on the Offline Maps settings page** +- In Windows 10, version 1607 and later, **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off unsolicited network traffic on the Offline Maps settings page** -or- -- Create a REG\_DWORD registry setting named **AllowUntriggeredNetworkTrafficOnSettingsPage** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps** with a value of 0 (zero). +- Create a REG_DWORD registry setting named **AllowUntriggeredNetworkTrafficOnSettingsPage** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps** with a value of 0 (zero). ### 16. OneDrive To turn off OneDrive in your organization: -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage** -or- -- Create a REG\_DWORD registry setting named **DisableFileSyncNGSC** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\OneDrive** with a value of 1 (one). +- Create a REG_DWORD registry setting named **DisableFileSyncNGSC** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\OneDrive** with a value of 1 (one). -and- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent OneDrive from generating network traffic until the user signs in to OneDrive (Enable)** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent OneDrive from generating network traffic until the user signs in to OneDrive (Enable)** -or- -- Create a REG\_DWORD registry setting named **PreventNetworkTrafficPreUserSignIn** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\OneDrive** with a value of 1 (one). +- Create a REG_DWORD registry setting named **PreventNetworkTrafficPreUserSignIn** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OneDrive** with a **value of 1 (one)** - -or- +-or- - Set the System/DisableOneDriveFileSync MDM policy from the [Policy CSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#system-disableonedrivefilesync) to True (value 1) to disable OneDrive File Sync. @@ -756,7 +768,9 @@ To remove the News app: - Right-click the app in Start, and then click **Uninstall**. -or- - +>[!IMPORTANT] +> If you have any issues with these commands, do a system reboot and try the scripts again. +> - Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** -and- @@ -881,7 +895,7 @@ Use Settings > Privacy to configure some settings that may be important to yo - [18.5 Notifications](#bkmk-priv-notifications) -- [18.6 Speech, inking, & typing](#bkmk-priv-speech) +- [18.6 Speech](#bkmk-priv-speech) - [18.7 Account info](#bkmk-priv-accounts) @@ -895,19 +909,23 @@ Use Settings > Privacy to configure some settings that may be important to yo - [18.12 Messaging](#bkmk-priv-messaging) -- [18.13 Radios](#bkmk-priv-radios) +- [18.13 Phone Calls](#bkmk-priv-phone-calls) -- [18.14 Other devices](#bkmk-priv-other-devices) +- [18.14 Radios](#bkmk-priv-radios) -- [18.15 Feedback & diagnostics](#bkmk-priv-feedback) +- [18.15 Other devices](#bkmk-priv-other-devices) -- [18.16 Background apps](#bkmk-priv-background) +- [18.16 Feedback & diagnostics](#bkmk-priv-feedback) -- [18.17 Motion](#bkmk-priv-motion) +- [18.17 Background apps](#bkmk-priv-background) -- [18.18 Tasks](#bkmk-priv-tasks) +- [18.18 Motion](#bkmk-priv-motion) -- [18.19 App Diagnostics](#bkmk-priv-diag) +- [18.19 Tasks](#bkmk-priv-tasks) + +- [18.20 App Diagnostics](#bkmk-priv-diag) + +- [18.21 Inking & Typing](#bkmk-priv-ink) ### 18.1 General @@ -924,15 +942,15 @@ To turn off **Let apps use advertising ID to make ads more interesting to you ba -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. -or- -- Create a REG\_DWORD registry setting named **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo** with a value of 0 (zero). +- Create a REG_DWORD registry setting named **Enabled** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo** with a value of 0 (zero). - -or- + -and- -- Create a REG\_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one). +- Create a REG_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one). To turn off **Let websites provide locally relevant content by accessing my language list**: @@ -940,7 +958,7 @@ To turn off **Let websites provide locally relevant content by accessing my lang -or- -- Create a new REG\_DWORD registry setting named **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile** with a value of 1. +- Create a new REG_DWORD registry setting named **HttpAcceptLanguageOptOut** in **HKEY_CURRENT_USER\\Control Panel\\International\\User Profile** with a value of 1. To turn off **Let Windows track app launches to improve Start and search results**: @@ -948,7 +966,7 @@ To turn off **Let Windows track app launches to improve Start and search results -or- -- Create a REG_DWORD registry setting named **Start_TrackProgs** in **HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced** with value of 0 (zero). +- Create a REG_DWORD registry setting named **Start_TrackProgs** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced** with value of 0 (zero). #### Windows Server 2016 and Windows 10, version 1607 and earlier options @@ -961,15 +979,15 @@ To turn off **Let apps use my advertising ID for experiences across apps (turnin -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. + + -or- + +- Create a REG_DWORD registry setting named **Enabled** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo** with a value of 0 (zero). -or- -- Create a REG\_DWORD registry setting named **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo** with a value of 0 (zero). - - -or- - -- Create a REG\_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one). +- Create a REG_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one). To turn off **Turn on SmartScreen Filter to check web content (URLs) that Microsoft Store apps use**: @@ -977,30 +995,22 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Micros -or- -- Create a provisioning package, using: - - For Internet Explorer: **Runtime settings > Policies > Browser > AllowSmartScreen** - - For Microsoft Edge: **Runtime settings > Policies > MicrosoftEdge > AllowSmartScreen** - - -or- - -- Create a REG_DWORD registry setting named **EnableWebContentEvaluation** in **HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost** with a value of 0 (zero). +- Create a REG_DWORD registry setting named **EnableWebContentEvaluation** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost** with a value of 0 (zero). To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: > [!NOTE] > If the diagnostic data level is set to either **Basic** or **Security**, this is turned off automatically. - - - Turn off the feature in the UI. -or- - Apply the TextInput/AllowLinguisticDataCollection MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: - - **0**. Not allowed + - **0**. Not allowed - - **1**. Allowed (default) + - **1**. Allowed (default) To turn off **Let websites provide locally relevant content by accessing my language list**: @@ -1008,7 +1018,7 @@ To turn off **Let websites provide locally relevant content by accessing my lang -or- -- Create a new REG\_DWORD registry setting named **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile** with a value of 1. +- Create a new REG_DWORD registry setting named **HttpAcceptLanguageOptOut** in **HKEY_CURRENT_USER\\Control Panel\\International\\User Profile** with a value of 1. To turn off **Let apps on my other devices open apps and continue experiences on this devices**: @@ -1020,7 +1030,7 @@ To turn off **Let apps on my other devices open apps and continue experiences on -or- -- Create a REG\_DWORD registry setting named **EnableCdp** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a value of 0 (zero). +- Create a REG_DWORD registry setting named **EnableCdp** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a value of 0 (zero). To turn off **Let apps on my other devices use Bluetooth to open apps and continue experiences on this device**: @@ -1036,46 +1046,39 @@ To turn off **Location for this device**: -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**. +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**. -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessLocation** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessLocation** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. -or- - Apply the System/AllowLocation MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - **0**. Turned off and the employee can't turn it back on. + - **0**. Turned off and the employee can't turn it back on. - - **1**. Turned on, but lets the employee choose whether to use it. (default) + - **1**. Turned on, but lets the employee choose whether to use it. (default) - - **2**. Turned on and the employee can't turn it off. + - **2**. Turned on and the employee can't turn it off. > [!NOTE] > You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](https://msdn.microsoft.com/library/dn905224.aspx). - -or- - -- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowLocation**, where - - - **No**. Turns off location service. - - - **Yes**. Turns on location service. (default) - To turn off **Location**: - Turn off the feature in the UI. - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** + + -or- + +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** - Set the **Select a setting** box to **Force Deny**. -or- -- Create a REG\_DWORD registry setting named **DisableLocation** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LocationAndSensors** with a value of 1 (one). +- Create a REG_DWORD registry setting named **DisableLocation** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LocationAndSensors** with a value of 1 (one). - -or- To turn off **Location history**: @@ -1101,26 +1104,19 @@ To turn off **Let apps use my camera**: -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessCamera** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessCamera** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). -or- - Apply the Camera/AllowCamera MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - **0**. Apps can't use the camera. + - **0**. Apps can't use the camera. - - **1**. Apps can use the camera. + - **1**. Apps can use the camera. > [!NOTE] > You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](https://msdn.microsoft.com/library/dn905224.aspx). - -or- - -- Create a provisioning package with use Windows ICD, using **Runtime settings** > **Policies** > **Camera** > **AllowCamera**, where: - - - **0**. Apps can't use the camera. - - - **1**. Apps can use the camera. To turn off **Choose apps that can use your camera**: @@ -1144,13 +1140,13 @@ To turn off **Let apps use my microphone**: - Apply the Privacy/LetAppsAccessMicrophone MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessmicrophone), where: - - **0**. User in control - - **1**. Force allow - - **2**. Force deny + - **0**. User in control + - **1**. Force allow + - **2**. Force deny -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessMicrophone** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two) +- Create a REG_DWORD registry setting named **LetAppsAccessMicrophone** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two) To turn off **Choose apps that can use your microphone**: @@ -1169,15 +1165,15 @@ To turn off notifications network usage: -or- -- Create a REG\_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a value of 1 (one) +- Create a REG_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a value of 1 (one) -or- - Apply the Notifications/DisallowCloudNotification MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-notifications#notifications-disallowcloudnotification), where: - - **0**. WNS notifications allowed - - **1**. No WNS notifications allowed + - **0**. WNS notifications allowed + - **1**. No WNS notifications allowed In the **Notifications** area, you can also choose which apps have access to notifications. @@ -1195,55 +1191,33 @@ To turn off **Let apps access my notifications**: - Apply the Privacy/LetAppsAccessNotifications MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessnotifications), where: - - **0**. User in control - - **1**. Force allow - - **2**. Force deny + - **0**. User in control + - **1**. Force allow + - **2**. Force deny -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessNotifications** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two) +- Create a REG_DWORD registry setting named **LetAppsAccessNotifications** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two) -### 18.6 Speech, inking, & typing +### 18.6 Speech -In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. +In the **Speech** area, you can configure the functionality as such: -> [!NOTE] -> For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. +To turn off streaming audio to Microsoft Speech services, -To turn off the functionality: - -- Click the **Stop getting to know me** button, and then click **Turn off**. +- Toggle the Settings -> Privacy -> Speech -> **Online speech recognition** switch to **Off** -or- -- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Regional and Language Options** > **Handwriting personalization** > **Turn off automatic learning** +- **Disable** the Group Policy: **Computer Configuration > Administrative Templates > Control Panel > Regional and Language Options > Allow users to enable online speech recognition services** -or- -- Create a REG\_DWORD registry setting named **RestrictImplicitInkCollection** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\InputPersonalization** with a value of 1 (one). +- Set the Privacy\AllowInputPersonalization MDM Policy from the Policy CSP to **0 - Not allowed** -or- -- Create a REG\_DWORD registry setting named **AcceptedPrivacyPolicy** in **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Personalization\\Settings** with a value of 0 (zero). - - -and- - -- Create a REG\_DWORD registry setting named **HarvestContacts** in **HKEY\_CURRENT\_USER\\Software\\Microsoft\\InputPersonalization\\TrainedDataStore** with a value of 0 (zero). - -If you're running at least Windows 10, version 1703, you can turn off updates to the speech recognition and speech synthesis models: - -- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Speech** > **Allow automatically update of Speech Data** - -If you're running at least Windows 10, version 1607, you can turn off updates to the speech recognition and speech synthesis models: - -Apply the Speech/AllowSpeechModelUpdate MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Speech_AllowSpeechModelUpdate), where: - -- **0** (default). Not allowed. -- **1**. Allowed. - - -or- - -- Create a REG\_DWORD registry setting named **ModelDownloadAllowed** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Preferences** with a value of 0 (zero). +- Create a REG_DWORD registry setting named **HasAccepted** in **HKEY_CURRENT_USER\\Software\\Microsoft\\Speech_OneCore\\Settings\\OnlineSpeechPrivacy** with a **value of 0 (zero)** ### 18.7 Account info @@ -1263,13 +1237,15 @@ To turn off **Let apps access my name, picture, and other account info**: - Apply the Privacy/LetAppsAccessAccountInfo MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessaccountinfo), where: - - **0**. User in control - - **1**. Force allow - - **2**. Force deny + - **0**. User in control + - **1**. Force allow + - **2**. Force deny -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). + + To turn off **Choose the apps that can access your account info**: @@ -1293,13 +1269,13 @@ To turn off **Choose apps that can access contacts**: - Apply the Privacy/LetAppsAccessContacts MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccesscontacts), where: - - **0**. User in control - - **1**. Force allow - - **2**. Force deny + - **0**. User in control + - **1**. Force allow + - **2**. Force deny -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessContacts** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessContacts** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). ### 18.9 Calendar @@ -1319,13 +1295,13 @@ To turn off **Let apps access my calendar**: - Apply the Privacy/LetAppsAccessCalendar MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccesscalendar), where: - - **0**. User in control - - **1**. Force allow - - **2**. Force deny + - **0**. User in control + - **1**. Force allow + - **2**. Force deny -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessCalendar** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessCalendar** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). To turn off **Choose apps that can access calendar**: @@ -1349,13 +1325,13 @@ To turn off **Let apps access my call history**: - Apply the Privacy/LetAppsAccessCallHistory MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccesscallhistory), where: - - **0**. User in control - - **1**. Force allow - - **2**. Force deny + - **0**. User in control + - **1**. Force allow + - **2**. Force deny -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessCallHistory** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessCallHistory** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). ### 18.11 Email @@ -1381,7 +1357,7 @@ To turn off **Let apps access and send email**: -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessEmail** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessEmail** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). ### 18.12 Messaging @@ -1401,13 +1377,13 @@ To turn off **Let apps read or send messages (text or MMS)**: - Apply the Privacy/LetAppsAccessMessaging MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessmessaging), where: - - **0**. User in control - - **1**. Force allow - - **2**. Force deny + - **0**. User in control + - **1**. Force allow + - **2**. Force deny -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessMessaging** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessMessaging** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). To turn off **Choose apps that can read or send messages**: @@ -1415,13 +1391,13 @@ To turn off **Choose apps that can read or send messages**: **To turn off Message Sync** -- Create a REG\_DWORD registry setting named **AllowMessageSync** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\Messaging and set the value to 0. +- Create a REG_DWORD registry setting named **AllowMessageSync** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Messaging** and set the **value to 0 (zero)**. -or- - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Messaging** - - Set the **Allow Message Service Cloud** to **Disable**. + - Set the **Allow Message Service Cloud Sync** to **Disable**. ### 18.13 Phone calls @@ -1441,13 +1417,13 @@ To turn off **Let apps make phone calls**: - Apply the Privacy/LetAppsAccessPhone MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessphone), where: - - **0**. User in control - - **1**. Force allow - - **2**. Force deny + - **0**. User in control + - **1**. Force allow + - **2**. Force deny -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessPhone** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessPhone** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). To turn off **Choose apps that can make phone calls**: @@ -1478,7 +1454,7 @@ To turn off **Let apps control radios**: -or- -- Create a REG\_DWORD registry setting named **LetAppsAccessRadios** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessRadios** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). To turn off **Choose apps that can control radios**: @@ -1491,23 +1467,19 @@ In the **Other Devices** area, you can choose whether devices that aren't paired To turn off **Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone**: -- Turn off the feature in the UI. +- Turn off the feature in the UI by going to Settings > Privacy > Other devices > "Communicate with unpaired devices. Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone" and **Turn it OFF**. -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps sync with devices** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps communicate with unpaired devices** and set the **Select a setting** box to **Force Deny**. -or- -- Apply the Privacy/LetAppsSyncWithDevices MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappssyncwithdevices), where: - - - **0**. User in control - - **1**. Force allow - - **2**. Force deny +- Set the Privacy/LetAppsSyncWithDevices MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappssyncwithdevices) to **2**. Force deny -or- -- Create a REG\_DWORD registry setting named **LetAppsSyncWithDevices** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsSyncWithDevices** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. To turn off **Let your apps use your trusted devices (hardware you've already connected, or comes with your PC, tablet, or phone)**: @@ -1515,9 +1487,11 @@ To turn off **Let your apps use your trusted devices (hardware you've already co -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access trusted devices** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access trusted devices** and set the **Select a setting** box to **Force Deny**. -- Set the **Select a setting** box to **Force Deny**. + -or- + +- Create a REG_DWORD registry setting named **LetAppsAccessTrustedDevices** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. -or- @@ -1538,24 +1512,23 @@ To change how frequently **Windows should ask for my feedback**: > Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device. - - To change from **Automatically (Recommended)**, use the drop-down list in the UI. -or- -- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Do not show feedback notifications** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Do not show feedback notifications** -or- -- Create a REG\_DWORD registry setting named **DoNotShowFeedbackNotifications** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection** with a value of 1 (one). +- Create a REG_DWORD registry setting named **DoNotShowFeedbackNotifications** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection** with a value of 1 (one). -or- -- Create the registry keys (REG\_DWORD type): +- Create the registry keys (REG_DWORD type): - - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\PeriodInNanoSeconds + - HKEY_CURRENT_USER\\Software\\Microsoft\\Siuf\\Rules\\PeriodInNanoSeconds - - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\NumberOfSIUFInPeriod + - HKEY_CURRENT_USER\\Software\\Microsoft\\Siuf\\Rules\\NumberOfSIUFInPeriod Based on these settings: @@ -1574,11 +1547,11 @@ To change the level of diagnostic and usage data sent when you **Send your devic -or- -- Apply the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** and select the appropriate option for your deployment. +- **Enable** the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** and **set it to a value of 0**. -or- -- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry** with a value of 0-3, as appropriate for your deployment (see below for the values for each level). +- Create a REG_DWORD registry setting in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry** with a **value of 0**. > [!NOTE] > If the **Security** option is configured by using Group Policy or the Registry, the value will not be reflected in the UI. The **Security** option is only available in Windows 10 Enterprise edition. @@ -1587,25 +1560,14 @@ To change the level of diagnostic and usage data sent when you **Send your devic - Apply the System/AllowTelemetry MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - **0**. Maps to the **Security** level. + - **0**. Maps to the **Security** level. - - **1**. Maps to the **Basic** level. + - **1**. Maps to the **Basic** level. - - **2**. Maps to the **Enhanced** level. + - **2**. Maps to the **Enhanced** level. - - **3**. Maps to the **Full** level. - - -or- - -- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowTelemetry**, where: - - - **0**. Maps to the **Security** level. - - - **1**. Maps to the **Basic** level. - - - **2**. Maps to the **Enhanced** level. - - - **3**. Maps to the **Full** level. + - **3**. Maps to the **Full** level. + To turn off tailored experiences with relevant tips and recommendations by using your diagnostics data: @@ -1613,7 +1575,20 @@ To turn off tailored experiences with relevant tips and recommendations by using -or- -- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences** + + -or- + +- Create a REG_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of **1** + + -and- + +- **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences** + + -or- + +- Create a REG_DWORD registry setting named **DisableTailoredExperiencesWithDiagnosticData** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of **1** + ### 18.17 Background apps @@ -1621,25 +1596,23 @@ In the **Background Apps** area, you can choose which apps can run in the backgr To turn off **Let apps run in the background**: -- In **Background apps**, set **Let apps run in the background** to **Off**. +- In the **Background apps** settings page, set **Let apps run in the background** to **Off**. -or- -- In **Background apps**, turn off the feature for each app. +- In the **Background apps** settings page, turn off the feature for each app. + + -or- + +- **Enable** the Group Policy (only applicable for Windows 10 version 1703 and above): **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps run in the background** and set the **Select a setting** box to **Force Deny**. -or- -- Apply the Group Policy (only applicable for Windows 10, version 1703): **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps run in the background** - - - Set the **Select a setting** box to **Force Deny**. +- Create a REG_DWORD registry setting named **LetAppsRunInBackground** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)** -or- -- Apply the Privacy/LetAppsRunInBackground MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessruninbackground), where: - - - **0**. User in control - - **1**. Force allow - - **2**. Force deny +- Set the Privacy/LetAppsRunInBackground MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessruninbackground) to **2 Force Deny**. > [!NOTE] > Some apps, including Cortana and Search, might not function as expected if you set **Let apps run in the background** to **Force Deny**. @@ -1654,19 +1627,20 @@ To turn off **Let Windows and your apps use your motion data and collect motion -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access motion** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access motion** and set the **Default for all apps** to **Force Deny** + + -or- + +- Create a REG_DWORD registry setting named **LetAppsAccessMotion** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. -or- - Apply the Privacy/LetAppsAccessMotion MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessmotion), where: - - **0**. User in control - - **1**. Force allow - - **2**. Force deny + - **0**. User in control + - **1**. Force allow + - **2**. Force deny - -or- - -- Create a REG\_DWORD registry setting named **LetAppsAccessMotion** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). ### 18.19 Tasks @@ -1678,17 +1652,19 @@ To turn this off: -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access Tasks** +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access Tasks**. Set the **Select a setting** box to **Force Deny**. - - Set the **Select a setting** box to **Force Deny**. + -or- + +- Create a REG_DWORD registry setting named **LetAppsAccessTasks** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. -or- - Apply the Privacy/LetAppsAccessTasks MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccesstasks), where: - - **0**. User in control - - **1**. Force allow - - **2**. Force deny + - **0**. User in control + - **1**. Force allow + - **2**. Force deny ### 18.20 App Diagnostics @@ -1700,59 +1676,117 @@ To turn this off: -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access dignostic information about other apps** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access dignostic information about other apps** -or- -- Apply the Privacy/LetAppsGetDiagnosticInfo MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsgetdiagnosticinfo), where: +- Create a REG_DWORD registry setting named **LetAppsGetDiagnosticInfo** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. - - **0**. User in control - - **1**. Force allow - - **2**. Force deny + -or- +- Set the Privacy/LetAppsGetDiagnosticInfo MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsgetdiagnosticinfo) to **2**. Force deny + + +### 18.21 Inking & Typing + +In the **Inking & Typing** area you can configure the functionality as such: + +To turn off Inking & Typing data collection (note: there is no Group Policy for this setting): + + - In the UI go to **Settings -> Privacy -> Diagnostics & Feedback -> Inking and typing** and turn **Improve inking & typing** to **Off** + + -or- + + - Set **RestrictImplicitTextCollection** registry REG_DWORD setting in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\InputPersonalization** to a **value of 1 (one)** + + -or- + + - Set the Privacy\AllowInputPersonalization MDM Policy from the Policy CSP. + [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) to **0** (not allowed). This policy setting controls the ability to send inking and typing data to Microsoft to improve the language recognition and suggestion capabilities of apps and services running on Windows. + + +If you're running at least Windows 10, version 1703, you can turn off updates to the speech recognition and speech synthesis models: + + **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Speech** > **Allow automatic update of Speech Data** + + -or- + + - Create a REG_DWORD registry setting named **AllowSpeechModelUpdate** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Speech** with a **value of 0 (zero)** + + -or- + + - Set the Speech/AllowSpeechModelUpdate MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Speech_AllowSpeechModelUpdate) to **0** + + +> [!NOTE] +> Releases 1803 and earlier support **Speech, Inking, & Typing** as a combined settings area. For customizing those setting please follow the below instructions. For 1809 and above **Speech** and **Inking & Typing** are separate settings pages, please see the specific section (18.6 Speech or 18.21 Inking and Typing) above for those areas. + +In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. + + For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. + + To turn off the functionality: + + - Click the **Stop getting to know me** button, and then click **Turn off**. + + -or- + + - Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Regional and Language Options** > **Handwriting personalization** > **Turn off automatic learning** + + -or- + + - Create a REG_DWORD registry setting named **RestrictImplicitInkCollection** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\InputPersonalization** with a value of 1 (one). + + -or- + + - Create a REG_DWORD registry setting named **AcceptedPrivacyPolicy** in **HKEY_CURRENT_USER\\Software\\Microsoft\\Personalization\\Settings** with a value of 0 (zero). + + -and- + + - Create a REG_DWORD registry setting named **HarvestContacts** in **HKEY_CURRENT_USER\\Software\\Microsoft\\InputPersonalization\\TrainedDataStore** with a value of **0 (zero)**. ### 19. Software Protection Platform -Enterprise customers can manage their Windows activation status with volume licensing using an on-premises Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following: + Enterprise customers can manage their Windows activation status with volume licensing using an on-premises Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following: -For Windows 10: + **For Windows 10:** -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation** + - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation** -or- -- Apply the Licensing/DisallowKMSClientOnlineAVSValidation MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is disabled (default) and 1 is enabled. + - Apply the Licensing/DisallowKMSClientOnlineAVSValidation MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) and **set the value to 1 (Enabled)**. -or- -- Create a REG\_DWORD registry setting named **NoGenTicket** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one). + - Create a REG_DWORD registry setting named **NoGenTicket** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a **value of 1 (one)**. -For Windows Server 2019 or later: +**For Windows Server 2019 or later:** -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation** + - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation** -or- -- Create a REG\_DWORD registry setting named **NoGenTicket** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one). + - Create a REG_DWORD registry setting named **NoGenTicket** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one). -For Windows Server 2016: -- Create a REG\_DWORD registry setting named **NoAcquireGT** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one). +**For Windows Server 2016:** ->[!NOTE] ->Due to a known issue the **Turn off KMS Client Online AVS Validation** group policy does not work as intended on Windows Server 2016, the **NoAcquireGT** value needs to be set instead. + - Create a REG_DWORD registry setting named **NoAcquireGT** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one). -The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. + >[!NOTE] + >Due to a known issue the **Turn off KMS Client Online AVS Validation** group policy does not work as intended on Windows Server 2016, the **NoAcquireGT** value needs to be set instead. + >The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. ### 20. Storage health Enterprise customers can manage updates to the Disk Failure Prediction Model. For Windows 10: -- Disable this Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Storage Health** > **Allow downloading updates to the Disk Failure Prediction Model** +- **Disable** this Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Storage Health** > **Allow downloading updates to the Disk Failure Prediction Model** -or- -- Create a REG\_DWORD registry setting named **AllowDiskHealthModelUpdates** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\StorageHealth** with a value of 0. +- Create a REG_DWORD registry setting named **AllowDiskHealthModelUpdates** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\StorageHealth** with a value of 0. ### 21. Sync your settings @@ -1762,28 +1796,24 @@ You can control if your settings are synchronized: -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Sync your settings** > **Do not sync** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Sync your settings** > **Do not sync**. Leave the "Allow users to turn syncing on" checkbox **unchecked**. -or- -- Create a REG\_DWORD registry setting named **DisableSettingSync** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\SettingSync** with a value of 2 (two) and another named **DisableSettingSyncUserOverride** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\SettingSync** with a value of 1 (one). +- Create a REG_DWORD registry setting named **DisableSettingSync** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\SettingSync** with a value of 2 (two) and another named **DisableSettingSyncUserOverride** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\SettingSync** with a value of 1 (one). -or- -- Apply the Experience/AllowSyncMySettings MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. +- Apply the Experience/AllowSyncMySettings MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) and **set the value to 0 (not allowed)**. - -or- - -- Create a provisioning package, using **Runtime settings** > **Policies** > **Experience** > **AllowSyncMySettings**, where - - - **No**. Settings are not synchronized. - - - **Yes**. Settings are synchronized. (default) To turn off Messaging cloud sync: -- Set the Group Policy Allow Message Service Cloud to Disable. The Group Policy path is Computer Configuration\Administrative templates\Windows Components\Messaging\Allow Message Service Cloud -- Create a REG\_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging** with a value of 0 (zero). +- Note: There is no Group Policy corresponding to this registry key. + + -or- + +- Create a REG_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Messaging** and set to a **value of 0 (zero)**. ### 22. Teredo @@ -1792,15 +1822,12 @@ You can disable Teredo by using Group Policy or by using the netsh.exe command. >[!NOTE] >If you disable Teredo, some XBOX gaming features and Windows Update Delivery Optimization will not work. -- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **TCPIP Settings** > **IPv6 Transition Technologies** > **Set Teredo State** and set it to **Disabled State**. +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **TCPIP Settings** > **IPv6 Transition Technologies** > **Set Teredo State** and set it to **Disabled State**. -or- -- Create a new REG\_SZ registry setting named **Teredo_State** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TCPIP\\v6Transition** with a value of **Disabled**. +- Create a new REG_SZ registry setting named **Teredo_State** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TCPIP\\v6Transition** with a value of **Disabled**. - -or- - -- From an elevated command prompt, run **netsh interface teredo set state disabled** ### 23. Wi-Fi Sense @@ -1811,23 +1838,16 @@ Wi-Fi Sense automatically connects devices to known hotspots and to the wireless To turn off **Connect to suggested open hotspots** and **Connect to networks shared by my contacts**: -- Turn off the feature in the UI. +- Turn off the feature in the UI in Settings > Network & Internet > Wi-Fi -or- -- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **WLAN Service** > **WLAN Settings** > **Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services**. +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **WLAN Service** > **WLAN Settings** > **Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services**. -or- -- Create a new REG\_DWORD registry setting named **AutoConnectAllowedOEM** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config** with a value of 0 (zero). +- Create a new REG_DWORD registry setting named **AutoConnectAllowedOEM** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config** with a **value of 0 (zero)**. - -or- - -- Change the Windows Provisioning setting, WiFISenseAllowed, to 0 (zero). For more info, see the Windows Provisioning Settings reference doc, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620909). - - -or- - -- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620910). When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. @@ -1835,67 +1855,72 @@ When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings scr You can disconnect from the Microsoft Antimalware Protection Service. -- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Join Microsoft MAPS** +- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Join Microsoft MAPS** and then select **Disabled** from the drop down box named **Join Microsoft MAPS** - -or- +-OR- -- Delete the registry setting **named** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Updates**. +- Use the registry to set the REG_DWORD value **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to **0 (zero)**. - -or- +-OR- - For Windows 10 only, apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - -or- - -- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to 0 (zero). - - -and- - - From an elevated Windows PowerShell prompt, run **set-mppreference -Mapsreporting 0** You can stop sending file samples back to Microsoft. -- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Send file samples when further analysis is required** to **Always Prompt** or **Never Send**. +- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Send file samples when further analysis is required** to **Never Send**. -or- -- For Windows 10 only, apply the Defender/SubmitSamplesConsent MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender), where: - - - **0**. Always prompt. - - - **1**. (default) Send safe samples automatically. - - - **2**. Never send. - - - **3**. Send all samples automatically. +- For Windows 10 only, apply the Defender/SubmitSamplesConsent MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) to **2 (two) for Never Send**. -or- -- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SubmitSamplesConsent** to 0 (zero) to always prompt or 2 to never send. +- Use the registry to set the REG_DWORD value **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SubmitSamplesConsent** to **2 (two) for Never Send**. -You can stop downloading definition updates: -- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. +You can stop downloading **Definition Updates**: + +- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. -and- -- Disable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. +- **Disable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to **Nothing**. -or- -- Create a new REG\_SZ registry setting named **FallbackOrder** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Updates** with a value of **FileShares**. +- Create a new REG_SZ registry setting named **FallbackOrder** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Signature Updates** with a value of **FileShares**. -For Windows 10 only, you can stop Enhanced Notifications: + -and- -- Turn off the feature in the UI. +- **Remove** the **DefinitionUpdateFileSharesSources** reg value if it exists under **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Signature Updates** + + +You can turn off **Malicious Software Reporting Tool diagnostic data**: + +- Set the REG_DWORD value **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to **1**. + +**Note:** There is no Group Policy to turn off the Malicious Software Reporting Tool diagnostic data. + + +You can turn off **Enhanced Notifications** as follows: + +- Set in the UI: Settings -> Update & Security -> Windows Security -> Virus & Threat Protection -> Virus & Threat Protection Manage Settings -> scroll to bottom for Notifications, click Change Notifications Settings -> Notifications -> click Manage Notifications -> Turn off General Notifications + + -or- + +- **Enable** the Group Policy **Turn off enhanced notifications** under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Reporting**. + + -or- + +- Create a new REG_SZ registry setting named **DisableEnhancedNotifications** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Reporting** to a value of **1**. -You can also use the registry to turn off Malicious Software Reporting Tool diagnostic data by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1. ### 24.1 Windows Defender SmartScreen To disable Windows Defender Smartscreen: -- In Group Policy, configure - **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure Windows Defender SmartScreen** : **Disable** +- In Group Policy, configure - **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure Windows Defender SmartScreen** to be **Disabled** -and- @@ -1903,137 +1928,148 @@ To disable Windows Defender Smartscreen: -and- -- **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure app install control** : **Enable** +- **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure app install control** : **Enable**, and select **Turn off app recommendations** - -or- +-OR- -- Create a REG_DWORD registry setting named **EnableSmartScreen** in **HKEY_LOCAL_MACHINE\Sofware\Policies\Microsoft\Windows\System** with a value of 0 (zero). +- Create a REG_DWORD registry setting named **EnableSmartScreen** in **HKEY_LOCAL_MACHINE\\Sofware\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)**. -and- -- Create a REG_DWORD registry setting named **ConfigureAppInstallControlEnabled** in **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen** with a value of 1. - +- Create a REG_DWORD registry setting named **ConfigureAppInstallControlEnabled** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SmartScreen** with a **value of 1**. + -and- -- Create a SZ registry setting named **ConfigureAppInstallControl** in **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen** with a value of **Anywhere**. +- Create a SZ registry setting named **ConfigureAppInstallControl** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SmartScreen** with a value of **Anywhere**. - -or- +-OR- -- Apply the Browser/AllowSmartScreen MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on. +- Set the Browser/AllowSmartScreen MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to **0 (turned Off)**. -### 25. Windows Media Player -To remove Windows Media Player on Windows 10: - -- From the **Programs and Features** control panel, click **Turn Windows features on or off**, under **Media Features**, clear the **Windows Media Player** check box, and then click **OK**. - - -or- - -- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** - -To remove Windows Media Player on Windows Server 2016: - -- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** - -### 26. Windows Spotlight +### 25. Windows Spotlight Windows Spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface, MDM policy, or through Group Policy. -If you're running Windows 10, version 1607 or later, you only need to enable the following Group Policy: +If you're running Windows 10, version 1607 or later, you need to: -- **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off all Windows spotlight features** +- **Enable** the following Group Policy **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off all Windows spotlight features** > [!NOTE] > This must be done within 15 minutes after Windows 10 is installed. Alternatively, you can create an image with this setting. - -or- + -or- - For Windows 10 only, apply the Experience/AllowWindowsSpotlight MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience), with a value of 0 (zero). - -or- + -or- -- Create a new REG\_DWORD registry setting named **DisableWindowsSpotlightFeatures** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one). +- Create a new REG_DWORD registry setting named **DisableWindowsSpotlightFeatures** in **HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one). --and- +-AND- -- **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the Lock Screen** +- Enable the following Group Policy **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the Lock Screen** - -or- + -or- -- Create a new REG\_DWORD registry setting named **NoLockScreen** in **HKEY\Local\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of 1 (one). +- Create a new REG_DWORD registry setting named **NoLockScreen** in **HKEY_Local_Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a **value of 1 (one)** -If you're not running Windows 10, version 1607 or later, you can use the other options in this section. -- Configure the following in **Settings**: +-AND- - - **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Get fun facts, tips, tricks and more on your lock screen**. - - **Personalization** > **Start** > **Occasionally show suggestions in Start**. +- Configure the following in **Settings** UI: - - **System** > **Notifications & actions** > **Show me tips about Windows**. + - **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Get fun facts, tips, tricks and more on your lock screen** - -or- + - **Personalization** > **Start** > **Occasionally show suggestions in Start** + + - **System** > **Notifications & actions** > **Show me tips about Windows** + + -or- - Apply the Group Policies: - - **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image**. - - Add a location in the **Path to local lock screen image** box. + - **Enable** the **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image and logon image** Group Policy. + - Add **C:\\windows\\web\\screen\\lockscreen.jpg** as the location in the **Path to local lock screen image** box. - - Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box. + - Check the **Turn off fun facts, tips, tricks, and more on lock screen** check box. > [!NOTE] - > This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. Alternatively, you can create a new REG\_SZ registry setting named **LockScreenImage** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG\_DWORD registry setting named **LockScreenOverlaysDisabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of 1 (one). + > This will only take effect if the policy is applied before the first logon. + > If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, + > you can **Enable** the **Do not display the lock screen** policy under **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** + + > Alternatively, you can create a new REG_SZ registry setting named **LockScreenImage** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** + > with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG_DWORD registry setting named **LockScreenOverlaysDisabled** in + > **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of **1 (one)**. + + > The Group Policy for the **LockScreenOverlaysDisabled** regkey is **Force a specific default lock screen and logon image** that is under **Control Panel** **Personalization**. - - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips**. +-AND- - -or- - - Create a new REG\_DWORD registry setting named **DisableSoftLanding** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one). + - Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips** to **Enabled** - - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**. + -or- - -or- + - Create a new REG_DWORD registry setting named **DisableSoftLanding** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)** - - Create a new REG\_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one). - - This policy setting controls whether the lock screen appears for users. The Do not display the lock screen Group Policy should be set to Enable to prevent the lock screen from being displayed. The Group Computer Configuration\Administrative templates\Control Panel\Personalization!Do not display the lock screen. +-AND- - - If you enable this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC. - - If you disable or do not configure this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see a lock screen after locking their PC. They must dismiss the lock screen using touch, the keyboard, or by dragging it with the mouse. + - Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences** to **Enabled** + + -or- + + - Create a new REG_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY_LOCAL_MACHINE\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)** + + +This policy setting controls whether the lock screen appears for users. The Do not display the lock screen Group Policy should be set to Enable to prevent the lock screen from being displayed. The Group Computer Configuration\Administrative templates\Control Panel\Personalization!Do not display the lock screen. + +If you enable this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC. + +If you disable or do not configure this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see a lock screen after locking their PC. They must dismiss the lock screen using touch, the keyboard, or by dragging it with the mouse. For more info, see [Windows Spotlight on the lock screen](/windows/configuration/windows-spotlight). -### 27. Microsoft Store +### 26. Microsoft Store You can turn off the ability to launch apps from the Microsoft Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Microsoft Store will be disabled. In addition, new email accounts cannot be created by clicking **Settings** > **Accounts** > **Email & app accounts** > **Add an account**. On Windows Server 2016, this will block Microsoft Store calls from Universal Windows Apps. -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Microsoft Store**. +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Microsoft Store**. -or- - - Create a new REG\_DWORD registry setting named **DisableStoreApps** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore** with a value of 1 (one). +- Create a new REG_DWORD registry setting named **DisableStoreApps** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore** with a value of 1 (one). -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Turn off Automatic Download and Install of updates**. +-AND- + +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Turn off Automatic Download and Install of updates**. -or- - - Create a new REG\_DWORD registry setting named **AutoDownload** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore** with a value of 2 (two). +- Create a new REG_DWORD registry setting named **AutoDownload** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore** with a value of 2 (two). -### 27.1 Apps for websites +### 26.1 Apps for websites You can turn off apps for websites, preventing customers who visit websites that are registered with their associated app from directly launching the app. -Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Configure web-to-app linking with URI handlers** +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Configure web-to-app linking with URI handlers** -### 28. Windows Update Delivery Optimization + -or- + +- Create a new REG_DWORD registry setting named **EnableAppUriHandlers** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)**. + +### 27. Windows Update Delivery Optimization Windows Update Delivery Optimization lets you get Windows updates and Microsoft Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. @@ -2041,33 +2077,39 @@ By default, PCs running Windows 10 Enterprise and Windows 10 Education will only Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delivery Optimization. -In Windows 10, version 1607, you can stop network traffic related to Windows Update Delivery Optimization by setting **Download Mode** to **Simple** (99) or **Bypass** (100), as described below. +In Windows 10 version 1607 and above you can stop network traffic related to Windows Update Delivery Optimization by setting **Download Mode** to **Bypass** (100), as described below. -### 28.1 Settings > Update & security +### 27.1 Settings > Update & security You can set up Delivery Optimization from the **Settings** UI. - Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**. -### 28.2 Delivery Optimization Group Policies +### 27.2 Delivery Optimization Group Policies You can find the Delivery Optimization Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization**. | Policy | Description | |---------------------------|-----------------------------------------------------------------------------------------------------| -| Download Mode | Lets you choose where Delivery Optimization gets or sends updates and apps, including
None. Turns off Delivery Optimization.
Group. Gets or sends updates and apps to PCs on the same local network domain.
Internet. Gets or sends updates and apps to PCs on the Internet.
LAN. Gets or sends updates and apps to PCs on the same NAT only.
Simple. Simple download mode with no peering.
Bypass. Use BITS instead of Windows Update Delivery Optimization.Set to Bypass to restrict traffic.
None. Turns off Delivery Optimization.
Group. Gets or sends updates and apps to PCs on the same local network domain.
Internet. Gets or sends updates and apps to PCs on the Internet.
LAN. Gets or sends updates and apps to PCs on the same NAT only.
Simple. Simple download mode with no peering.
Bypass. Use BITS instead of Windows Update Delivery Optimization. **Set to Bypass** to restrict traffic.
**Note:** This ID must be a GUID.| | Max Cache Age | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
The default value is 259200 seconds (3 days).| | Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
The default value is 20, which represents 20% of the disk.| | Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
The default value is 0, which means unlimited possible bandwidth.| -Set the Delivery Optimization Group Policy to "Bypass" to prevent traffic. Alternatively, you can set the **Download Mode** policy by creating a new REG\_DWORD registry setting named **DODownloadMode** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** to a value of 100 (one hundred). +### 27.3 Delivery Optimization -### 28.3 Delivery Optimization MDM policies +- **Enable** the **Download Mode** Group Policy under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization** and set the **Download Mode** to **"Bypass"** to prevent traffic. + +-or- + +- Create a new REG_DWORD registry setting named **DODownloadMode** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** to a value of **100 (one hundred)**. + +### 27.4 Delivery Optimization MDM policies The following Delivery Optimization MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). -| Policy | Description | +| MDM Policy | Description | |---------------------------|-----------------------------------------------------------------------------------------------------| | DeliveryOptimization/DODownloadMode | Lets you choose where Delivery Optimization gets or sends updates and apps, including
0. Turns off Delivery Optimization.
1. Gets or sends updates and apps to PCs on the same NAT only.
2. Gets or sends updates and apps to PCs on the same local network domain.
3. Gets or sends updates and apps to PCs on the Internet.
99. Simple download mode with no peering.
100. Use BITS instead of Windows Update Delivery Optimization.
**Note** This ID must be a GUID.| @@ -2076,52 +2118,54 @@ The following Delivery Optimization MDM policies are available in the [Policy CS | DeliveryOptimization/DOMaxUploadBandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
The default value is 0, which means unlimited possible bandwidth.| -### 28.4 Delivery Optimization Windows Provisioning - -If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies - -Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windows ADK)](https://go.microsoft.com/fwlink/p/?LinkId=526803), to create a provisioning package for Delivery Optimization. - -1. Open Windows ICD, and then click **New provisioning package**. - -2. In the **Name** box, type a name for the provisioning package, and then click **Next.** - -3. Click the **Common to all Windows editions** option, click **Next**, and then click **Finish**. - -4. Go to **Runtime settings** > **Policies** > **DeliveryOptimization** to configure the policies. - For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730684). -### 29. Windows Update +### 28. Windows Update You can turn off Windows Update by setting the following registry entries: -- Add a REG\_DWORD value named **DoNotConnectToWindowsUpdateInternetLocations** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. +- Add a REG_DWORD value named **DoNotConnectToWindowsUpdateInternetLocations** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. -and- -- Add a REG\_DWORD value named **DisableWindowsUpdateAccess** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. +- Add a REG_DWORD value named **DisableWindowsUpdateAccess** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. -and- -- Add a REG\_DWORD value named **UseWUServer** to **HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU** and set the value to 1. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Do not connect to any Windows Update Internet locations**. +- Add a REG_SZ value named **WUServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. -and- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off access to all Windows Update features**. +- Add a REG_SZ value named **WUStatusServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. -and- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Specify intranet Microsoft update service location** and set the **Set the alternate download server** to " ". +- Add a REG_SZ value named **UpdateServiceUrlAlternate** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. + + -and- + +- Add a REG_DWORD value named **UseWUServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\WindowsUpdate\\AU** and set the value to 1. + +-OR- + +- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Do not connect to any Windows Update Internet locations** to **Enabled** + + -and- + +- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off access to all Windows Update features** to **Enabled** + + -and- + +- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Specify intranet Microsoft update service location** to **Enabled** and ensure all Option settings (Intranet Update Service, Intranet Statistics Server, Alternate Download Server) are set to **" "** + + -and- + +- Set the Group Policy **User Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Remove access to use all Windows Update features** to **Enabled** and then set **Computer Configurations** to **0 (zero)**. You can turn off automatic updates by doing one of the following. This is not recommended. -- Add a REG\_DWORD value named **AutoDownload** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5. +- Add a REG_DWORD value named **AutoDownload** to **HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5. -or- @@ -2139,5 +2183,12 @@ You can turn off automatic updates by doing one of the following. This is not re - **5**. Turn off automatic updates. +For China releases of Windows 10 there is one additional Regkey to be set to prevent traffic: + +- Add a REG_DWORD value named **HapDownloadEnabled** to **HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LexiconUpdate\\loc_0804** and set the value to 0. + + + + To learn more, see [Device update management](https://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](https://technet.microsoft.com/library/cc720539.aspx). diff --git a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md index b6be3b5acd..1df90d39e0 100644 --- a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md @@ -98,7 +98,7 @@ We used the following methodology to derive these network endpoints: | *.e-msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. | | *.g.akamaiedge.net | HTTPS | Used to check for updates to maps that have been downloaded for offline use. | | *.s-msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. | -| *.tlu.dl.delivery.mp.microsoft.com/* | HTTP | Enables connections to Windows Update. | +| \*.tlu.dl.delivery.mp.microsoft.com/\* | HTTP | Enables connections to Windows Update. | | *geo-prod.dodsp.mp.microsoft.com.nsatc.net | HTTPS | Enables connections to Windows Update. | | arc.msn.com.nsatc.net | HTTPS | Used to retrieve Windows Spotlight metadata. | | au.download.windowsupdate.com/* | HTTP | Enables connections to Windows Update. | diff --git a/windows/release-information/resolved-issues-windows-10-1607.yml b/windows/release-information/resolved-issues-windows-10-1607.yml index 72407b6ba9..1f3fe84925 100644 --- a/windows/release-information/resolved-issues-windows-10-1607.yml +++ b/windows/release-information/resolved-issues-windows-10-1607.yml @@ -32,6 +32,8 @@ sections: - type: markdown text: "
| Summary | Originating update | Status | Date resolved | |||
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | OS Build 14393.2941 April 25, 2019 KB4493473 | Resolved KB4494440 | May 15, 2019 05:55 PM PT | |||
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail. See details > | OS Build 14393.2941 April 25, 2019 KB4493473 | Resolved KB4494440 | May 14, 2019 01:18 PM PT | |||
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 14393.2848 March 12, 2019 KB4489882 | Resolved KB4493473 | April 25, 2019 02:00 PM PT | |||
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup. See details > | OS Build 14393.2879 March 19, 2019 KB4489889 | Resolved KB4493470 | April 09, 2019 10:00 AM PT | |||
| Internet Explorer 11 authentication issue with multiple concurrent logons Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine. See details > | OS Build 14393.2724 January 08, 2019 KB4480961 | Resolved KB4493470 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | OS Build 14393.2941 April 25, 2019 KB4493473 | Resolved KB4494440 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Details | Originating update | Status | History |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493473. Affected platforms:
Resolution: This issue was resolved in KB4494440. Back to top | OS Build 14393.2941 April 25, 2019 KB4493473 | Resolved KB4494440 | Resolved: May 14, 2019 10:00 AM PT Opened: April 25, 2019 02:00 PM PT |
| Summary | Originating update | Status | Date resolved | |||
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | OS Build 15063.1784 April 25, 2019 KB4493436 | Resolved KB4499181 | May 15, 2019 05:55 PM PT | |||
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 15063.1689 March 12, 2019 KB4489871 | Resolved KB4493436 | April 25, 2019 02:00 PM PT | |||
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. See details > | OS Build 15063.1716 March 19, 2019 KB4489888 | Resolved KB4493474 | April 09, 2019 10:00 AM PT | |||
| MSXML6 may cause applications to stop responding MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | OS Build 15063.1563 January 08, 2019 KB4480973 | Resolved KB4493474 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | OS Build 15063.1784 April 25, 2019 KB4493436 | Resolved KB4499181 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Summary | Originating update | Status | Date resolved | |||
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493440 | April 25, 2019 02:00 PM PT | |||
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | OS Build 16299.1127 April 25, 2019 KB4493440 | Resolved KB4499179 | May 15, 2019 05:55 PM PT | |||
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail. See details > | OS Build 16299.1127 April 25, 2019 KB4493440 | Resolved KB4499179 | May 14, 2019 01:18 PM PT | |||
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493440 | April 25, 2019 02:00 PM PT | |||
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. See details > | OS Build 16299.1059 March 19, 2019 KB4489890 | Resolved KB4493441 | April 09, 2019 10:00 AM PT | |||
| MSXML6 causes applications to stop responding if an exception was thrown MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | OS Build 16299.904 January 08, 2019 KB4480978 | Resolved KB4493441 | April 09, 2019 10:00 AM PT | |||
| Stop error when attempting to start SSH from WSL A stop error occurs when attempting to start Secure Shell from Windows Subsystem for Linux with agent forwarding using a command line switch (ssh –A) or a configuration setting. See details > | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493441 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | OS Build 16299.1127 April 25, 2019 KB4493440 | Resolved KB4499179 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Details | Originating update | Status | History |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493440. Affected platforms:
Resolution: This issue was resolved in KB4499179. Back to top | OS Build 16299.1127 April 25, 2019 KB4493440 | Resolved KB4499179 | Resolved: May 14, 2019 10:00 AM PT Opened: April 25, 2019 02:00 PM PT |
| Details | Originating update | Status | History |
| Custom URI schemes may not start corresponding application After installing KB4489886, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer. Affected platforms:
Resolution: This issue is resolved in KB4493440. Back to top | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493440 | Resolved: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT |
| Custom URI schemes may not start corresponding application After installing KB4489886, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer. Affected platforms:
Resolution: This issue is resolved in KB4493440. Back to top | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493440 | Resolved: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT |
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions. Affected platforms:
Resolution: This issue is resolved in KB4493441. Back to top | OS Build 16299.1059 March 19, 2019 KB4489890 | Resolved KB4493441 | Resolved: April 09, 2019 10:00 AM PT Opened: March 19, 2019 10:00 AM PT |
| Stop error when attempting to start SSH from WSL After applying KB4489886, a stop error occurs when attempting to start the Secure Shell (SSH) client program from Windows Subsystem for Linux (WSL) with agent forwarding enabled using a command line switch (ssh –A) or a configuration setting. Affected platforms:
Resolution: This issue is resolved in KB4493441. Back to top | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493441 | Resolved: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Summary | Originating update | Status | Date resolved | |||
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | OS Build 17134.753 April 25, 2019 KB4493437 | Resolved KB4499167 | May 15, 2019 05:55 PM PT | |||
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail. See details > | OS Build 17134.753 April 25, 2019 KB4493437 | Resolved KB4499167 | May 14, 2019 01:19 PM PT | |||
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 17134.648 March 12, 2019 KB4489868 | Resolved KB4493437 | April 25, 2019 02:00 PM PT | |||
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. See details > | OS Build 17134.677 March 19, 2019 KB4489894 | Resolved KB4493464 | April 09, 2019 10:00 AM PT | |||
| First character of the Japanese era name not recognized The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues. See details > | OS Build 17134.556 January 15, 2019 KB4480976 | Resolved KB4487029 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | OS Build 17134.753 April 25, 2019 KB4493437 | Resolved KB4499167 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Details | Originating update | Status | History |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493437. Affected platforms:
Resolution: This issue was resolved in KB4499167. Back to top | OS Build 17134.753 April 25, 2019 KB4493437 | Resolved KB4499167 | Resolved: May 14, 2019 10:00 AM PT Opened: April 25, 2019 02:00 PM PT |
| Summary | Originating update | Status | Date resolved | |||
| Windows 10, version 1809 update history may show an update installed twice Some customers are reporting that KB4494441 installed twice on their device See details > | OS Build 17763.503 May 14, 2019 KB4494441 | Resolved | May 16, 2019 02:37 PM PT | |||
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved KB4494441 | May 15, 2019 05:55 PM PT | |||
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail. See details > | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved KB4494441 | May 14, 2019 01:19 PM PT | |||
| Latest cumulative update (KB 4495667) installs automatically Reports that the optional cumulative update (KB 4495667) installs automatically. See details > | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved | May 08, 2019 03:37 PM PT | |||
| System may be unresponsive after restart if ArcaBit antivirus software installed After further investigation ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809 See details > | OS Build 17763.437 April 09, 2019 KB4493509 | Resolved | May 08, 2019 03:30 PM PT | |||
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 17763.379 March 12, 2019 KB4489899 | Resolved KB4495667 | May 03, 2019 12:40 PM PT | |||
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. See details > | OS Build 17763.404 April 02, 2019 KB4490481 | Resolved KB4493509 | April 09, 2019 10:00 AM PT | |||
| Internet Explorer 11 authentication issue with multiple concurrent logons Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine. See details > | OS Build 17763.253 January 08, 2019 KB4480116 | Resolved KB4493509 | April 09, 2019 10:00 AM PT | |||
| MSXML6 may cause applications to stop responding MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | OS Build 17763.253 January 08, 2019 KB4480116 | Resolved KB4493509 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Windows 10, version 1809 update history may show an update installed twice Affected platforms:
Cause: In certain situations, installing an update requires multiple download and restart steps. In cases where two intermediate steps of the installation complete successfully, the View your Update history page will report that installation completed successfully twice. Resolution: No action is required on your part. The update installation may take longer and may require more than one restart, but will install successfully after all intermediate installation steps have completed. We are working on improving this update experience to ensure the Update history correctly reflects the installation of the latest cumulative update (LCU). Back to top | OS Build 17763.503 May 14, 2019 KB4494441 | Resolved | Resolved: May 16, 2019 02:37 PM PT Opened: May 14, 2019 02:56 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved KB4494441 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4495667. Affected platforms:
Resolution: This issue was resolved in KB4494441. Back to top | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved KB4494441 | Resolved: May 14, 2019 10:00 AM PT Opened: May 14, 2019 01:19 PM PT |
| Latest cumulative update (KB 4495667) installs automatically Due to a servicing side issue some users were offered KB4495667 (optional update) automatically and rebooted devices. This issue has been mitigated. Affected platforms:
Resolution:: This issue has been mitigated on the servicing side to prevent auto installing of this update. Customers do not need to take any action. Back to top | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved | Resolved: May 08, 2019 03:37 PM PT Opened: May 05, 2019 12:01 PM PT |
| Details | Originating update | Status | History |
| System may be unresponsive after restart if ArcaBit antivirus software installed ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809 (client or server). Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart. Affected platforms:
Workaround: ArcaBit has released an update to address this issue for affected platforms. For more information, see the ArcaBit support article. Resolution: This issue has been resolved. ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809 (client or server). Back to top | OS Build 17763.437 April 09, 2019 KB4493509 | Resolved | Resolved: May 08, 2019 03:30 PM PT Opened: April 09, 2019 10:00 AM PT |
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions. Affected platforms:
Resolution: This issue was resolved in KB4493509. Back to top | OS Build 17763.404 April 02, 2019 KB4490481 | Resolved KB4493509 | Resolved: April 09, 2019 10:00 AM PT Opened: April 02, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Custom URI schemes may not start corresponding application After installing KB4489899, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer. Affected platforms:
Workaround: Right-click the URL link to open it in a new window or tab, or enable Protected Mode in Internet Explorer for local intranet and trusted sites
You must restart the browser after making these changes. Resolution: This issue is resolved in KB4495667. Back to top | OS Build 17763.379 March 12, 2019 KB4489899 | Resolved KB4495667 | Resolved: May 03, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Apps may stop working after selecting an audio output device other than the default After installing KB4482887 on machines that have multiple audio devices, applications that provide advanced options for internal or external audio output devices may stop working unexpectedly. This issue occurs for users that select an audio output device different from the \"Default Audio Device\". Examples of applications that may stop working include:
Affected platforms:
Resolution: This issue was resolved in KB4490481. Back to top | OS Build 17763.348 March 01, 2019 KB4482887 | Resolved KB4490481 | Resolved: April 02, 2019 10:00 AM PT Opened: March 01, 2019 10:00 AM PT |
| Summary | Originating update | Status | Date resolved | |||
| System may be unresponsive after restart if ArcaBit antivirus software installed Devices with ArcaBit antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493472 | Resolved | May 14, 2019 01:23 PM PT | |||
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493472 | Resolved | May 14, 2019 01:22 PM PT | |||
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493472 | Resolved | May 14, 2019 01:21 PM PT | |||
| Authentication may fail for services after the Kerberos ticket expires Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires. See details > | March 12, 2019 KB4489878 | Resolved KB4499164 | May 14, 2019 01:17 PM PT | |||
| Devices may not respond at login or Welcome screen if running certain Avast software Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart. See details > | April 09, 2019 KB4493472 | Resolved | April 25, 2019 02:00 PM PT | |||
| Internet Explorer 11 authentication issue with multiple concurrent logons Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine. See details > | January 08, 2019 KB4480970 | Resolved KB4493472 | April 09, 2019 10:00 AM PT | |||
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | March 12, 2019 KB4489878 | Resolved KB4493472 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| System may be unresponsive after restart if ArcaBit antivirus software installed Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493472. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. ArcaBit has released an update to address this issue. For more information, see the Arcabit support article. Back to top | April 09, 2019 KB4493472 | Resolved | Resolved: May 14, 2019 01:23 PM PT Opened: April 09, 2019 10:00 AM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493472. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493472 | Resolved | Resolved: May 14, 2019 01:22 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493472. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article. Back to top | April 09, 2019 KB4493472 | Resolved | Resolved: May 14, 2019 01:21 PM PT Opened: April 09, 2019 10:00 AM PT |
| Devices may not respond at login or Welcome screen if running certain Avast software Microsoft and Avast have identified an issue on devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software after you install KB4493472 and restart. Devices may become unresponsive at the login or Welcome screen. Additionally, you may be unable to log in or log in after an extended period of time. Affected platforms:
Resolution: Avast has released emergency updates to address this issue. For more information and AV update schedule, see the Avast support KB article. Back to top | April 09, 2019 KB4493472 | Resolved | Resolved: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Authentication may fail for services after the Kerberos ticket expires After installing KB4489878, some customers report that authentication fails for services that require unconstrained delegation after the Kerberos ticket expires (the default is 10 hours). For example, the SQL server service fails. Affected platforms:
Resolution: This issue was resolved in KB4499164. Back to top | March 12, 2019 KB4489878 | Resolved KB4499164 | Resolved: May 14, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Custom URI schemes may not start corresponding application After installing KB4489878, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites on Internet Explorer. Affected platforms:
Resolution: This issue is resolved in KB4493472. Back to top | March 12, 2019 KB4489878 | Resolved KB4493472 | Resolved: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| NETDOM.EXE fails to run After installing KB4489878, NETDOM.EXE fails to run, and the on-screen error, “The command failed to complete successfully.” appears. Affected platforms:
Resolution: This issue is resolved in KB4493472. Back to top | March 12, 2019 KB4489878 | Resolved KB4493472 | Resolved: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Summary | Originating update | Status | Date resolved |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | April 25, 2019 KB4493443 | Resolved KB4499151 | May 15, 2019 05:55 PM PT |
| System may be unresponsive after restart if ArcaBit antivirus software installed Devices with ArcaBit antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493446 | Resolved | May 14, 2019 01:22 PM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493446 | Resolved | May 14, 2019 01:22 PM PT |
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493446 | Resolved | May 14, 2019 01:21 PM PT |
| Devices may not respond at login or Welcome screen if running certain Avast software Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart. See details > | April 09, 2019 KB4493446 | Resolved | April 25, 2019 02:00 PM PT |
| Internet Explorer 11 authentication issue with multiple concurrent logons Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine. See details > | January 08, 2019 KB4480963 | Resolved KB4493446 | April 09, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding. MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | January 08, 2019 KB4480963 | Resolved KB4493446 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | April 25, 2019 KB4493443 | Resolved KB4499151 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Details | Originating update | Status | History |
| System may be unresponsive after restart if ArcaBit antivirus software installed Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493446. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. ArcaBit has released an update to address this issue. For more information, see the Arcabit support article. Back to top | April 09, 2019 KB4493446 | Resolved | Resolved: May 14, 2019 01:22 PM PT Opened: April 09, 2019 10:00 AM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493446. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493446 | Resolved | Resolved: May 14, 2019 01:22 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493446. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article. Back to top | April 09, 2019 KB4493446 | Resolved | Resolved: May 14, 2019 01:21 PM PT Opened: April 09, 2019 10:00 AM PT |
| Devices may not respond at login or Welcome screen if running certain Avast software Microsoft and Avast have identified an issue on devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software after you install KB4493446 and restart. Devices may become unresponsive at the login or Welcome screen. Additionally, you may be unable to log in or log in after an extended period of time. Affected platforms:
Resolution: Avast has released emergency updates to address this issue. For more information and AV update schedule, see the Avast support KB article. Back to top | April 09, 2019 KB4493446 | Resolved | Resolved: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| Summary | Originating update | Status | Date resolved |
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493471 | Resolved | May 14, 2019 01:21 PM PT |
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493471 | Resolved | May 14, 2019 01:19 PM PT |
| Authentication may fail for services after the Kerberos ticket expires Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires. See details > | March 12, 2019 KB4489880 | Resolved KB4499149 | May 14, 2019 01:18 PM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | February 12, 2019 KB4487023 | Resolved KB4493471 | April 09, 2019 10:00 AM PT |
| NETDOM.EXE fails to run NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen. See details > | March 12, 2019 KB4489880 | Resolved KB4493471 | April 09, 2019 10:00 AM PT |
| First character of the Japanese era name not recognized as an abbreviation The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues. See details > | January 17, 2019 KB4480974 | Resolved KB4489880 | March 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493471. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493471 | Resolved | Resolved: May 14, 2019 01:21 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493471. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article. Back to top | April 09, 2019 KB4493471 | Resolved | Resolved: May 14, 2019 01:19 PM PT Opened: April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Authentication may fail for services after the Kerberos ticket expires After installing KB4489880, some customers report that authentication fails for services that require unconstrained delegation after the Kerberos ticket expires (the default is 10 hours). For example, the SQL server service fails. Affected platforms:
Resolution: This issue was resolved in KB4499149. Back to top | March 12, 2019 KB4489880 | Resolved KB4499149 | Resolved: May 14, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| NETDOM.EXE fails to run After installing KB4489880, NETDOM.EXE fails to run, and the on-screen error, “The command failed to complete successfully.” appears. Affected platforms:
Resolution: This issue is resolved in KB4493471. Back to top | March 12, 2019 KB4489880 | Resolved KB4493471 | Resolved: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Summary | Originating update | Status | Date resolved |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | April 25, 2019 KB4493462 | Resolved KB4499171 | May 15, 2019 05:55 PM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493451 | Resolved | May 14, 2019 01:21 PM PT |
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493451 | Resolved | May 14, 2019 01:19 PM PT |
| Internet Explorer 11 authentication issue with multiple concurrent logons Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine. See details > | January 08, 2019 KB4480975 | Resolved KB4493451 | April 09, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | January 08, 2019 KB4480975 | Resolved KB4493451 | April 09, 2019 10:00 AM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | February 12, 2019 KB4487025 | Resolved KB4493451 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | April 25, 2019 KB4493462 | Resolved KB4499171 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Details | Originating update | Status | History |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493451. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493451 | Resolved | Resolved: May 14, 2019 01:21 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493451. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article. Back to top | April 09, 2019 KB4493451 | Resolved | Resolved: May 14, 2019 01:19 PM PT Opened: April 09, 2019 10:00 AM PT |
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
| Summary | Originating update | Status | Last updated |
| Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessible See details > | OS Build 10240.18210 May 14, 2019 KB4498353 | Investigating | May 16, 2019 06:41 PM PT |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". See details > | OS Build 10240.18094 January 08, 2019 KB4480962 | Mitigated | April 25, 2019 02:00 PM PT |
| MSXML6 may cause applications to stop responding MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | OS Build 10240.18094 January 08, 2019 KB4480962 | Resolved KB4493475 | April 09, 2019 10:00 AM PT |
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 10240.18158 March 12, 2019 KB4489872 | Resolved KB4493475 | April 09, 2019 10:00 AM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | OS Build 10240.18132 February 12, 2019 KB4487018 | Resolved KB4493475 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Custom URI schemes may not start corresponding application After installing KB4489872, Custom URI Schemes for Application Protocol handlers may not start the corresponding application for local intranet and trusted sites on Internet Explorer. Affected platforms:
Resolution: This issue was resolved in KB4493475. Back to top | OS Build 10240.18158 March 12, 2019 KB4489872 | Resolved KB4493475 | Resolved: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. Affected platforms:
Resolution: This issue is resolved in KB4493475. Back to top | OS Build 10240.18132 February 12, 2019 KB4487018 | Resolved KB4493475 | Resolved: April 09, 2019 10:00 AM PT Opened: February 12, 2019 10:00 AM PT |
| Unable to access some gov.uk websites After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge. Affected platforms:
Next Steps: Microsoft is working on a resolution and will provide an update as quickly as possible. Back to top | OS Build 10240.18210 May 14, 2019 KB4498353 | Investigating | Last updated: May 16, 2019 06:41 PM PT Opened: May 16, 2019 01:57 PM PT |
| Details | Originating update | Status | History |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. Affected platforms:
Workaround: Do one of the following:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 10240.18094 January 08, 2019 KB4480962 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: January 08, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding After installing KB4480962, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings. Affected platforms:
Resolution: This issue was resolved in KB4493475. Back to top | OS Build 10240.18094 January 08, 2019 KB4480962 | Resolved KB4493475 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
| Summary | Originating update | Status | Last updated |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail. See details > | OS Build 14393.2941 April 25, 2019 KB4493473 | Investigating | April 25, 2019 02:00 PM PT |
| Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessible See details > | OS Build 14393.2969 May 14, 2019 KB4494440 | Investigating | May 16, 2019 06:41 PM PT |
| Cluster service may fail if the minimum password length is set to greater than 14 The cluster service may fail to start with the error “2245 (NERR_PasswordTooShort)” if the Group Policy “Minimum Password Length” is configured with greater than 14 characters. See details > | OS Build 14393.2639 November 27, 2018 KB4467684 | Mitigated | April 25, 2019 02:00 PM PT |
| Issue using PXE to start a device from WDS There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. See details > | OS Build 14393.2848 March 12, 2019 KB4489882 | Mitigated | April 25, 2019 02:00 PM PT |
| SCVMM cannot enumerate and manage logical switches deployed on the host For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host. See details > | OS Build 14393.2639 November 27, 2018 KB4467684 | Mitigated | April 25, 2019 02:00 PM PT |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". See details > | OS Build 14393.2724 January 08, 2019 KB4480961 | Mitigated | April 25, 2019 02:00 PM PT |
| Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM. See details > | OS Build 14393.2608 November 13, 2018 KB4467691 | Mitigated | February 19, 2019 10:00 AM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | OS Build 14393.2941 April 25, 2019 KB4493473 | Resolved KB4494440 | May 15, 2019 05:55 PM PT |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail. See details > | OS Build 14393.2941 April 25, 2019 KB4493473 | Resolved KB4494440 | May 14, 2019 01:18 PM PT |
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 14393.2848 March 12, 2019 KB4489882 | Resolved KB4493473 | April 25, 2019 02:00 PM PT |
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup. See details > | OS Build 14393.2879 March 19, 2019 KB4489889 | Resolved KB4493470 | April 09, 2019 10:00 AM PT |
| Internet Explorer 11 authentication issue with multiple concurrent logons Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine. See details > | OS Build 14393.2724 January 08, 2019 KB4480961 | Resolved KB4493470 | April 09, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | OS Build 14393.2724 January 08, 2019 KB4480961 | Resolved KB4493470 | April 09, 2019 10:00 AM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | OS Build 14393.2791 February 12, 2019 KB4487026 | Resolved KB4493470 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Unable to access some gov.uk websites After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge. Affected platforms:
Next Steps: Microsoft is working on a resolution and will provide an update as quickly as possible. Back to top | OS Build 14393.2969 May 14, 2019 KB4494440 | Investigating | Last updated: May 16, 2019 06:41 PM PT Opened: May 16, 2019 01:57 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | OS Build 14393.2941 April 25, 2019 KB4493473 | Resolved KB4494440 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Details | Originating update | Status | History |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493473. Affected platforms:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 14393.2941 April 25, 2019 KB4493473 | Investigating | Last updated: April 25, 2019 02:00 PM PT Opened: April 25, 2019 02:00 PM PT |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493473. Affected platforms:
Resolution: This issue was resolved in KB4494440. Back to top | OS Build 14393.2941 April 25, 2019 KB4493473 | Resolved KB4494440 | Resolved: May 14, 2019 10:00 AM PT Opened: April 25, 2019 02:00 PM PT |
After installing KB4489882, there may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause the connection to the WDS server to terminate prematurely while downloading the image. This issue does not affect clients or devices that are not using Variable Window Extension.
Affected platforms:
- Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1
- Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
Workaround: To mitigate the issue, disable the Variable Window Extension on WDS server using one of the following options:
Option 1:
Open an Administrator Command prompt and type the following:
Wdsutil /Set-TransportServer /EnableTftpVariableWindowExtension:No
Option 2:
Use the Windows Deployment Services UI to make the following adjustment:
- Open Windows Deployment Services from Windows Administrative Tools.
- Expand Servers and right-click a WDS server.
- Open its properties and clear the Enable Variable Window Extension box on the TFTP tab.
Option 3:
Set the following registry value to 0:
HKLM\\System\\CurrentControlSet\\Services\\WDSServer\\Providers\\WDSTFTP\\EnableVariableWindowExtension
Restart the WDSServer service after disabling the Variable Window Extension.
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.
Back to top
March 12, 2019
KB4489882
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PT
After installing KB4489882, Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.
Affected platforms:
- Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
- Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
Resolution: This issue is resolved in KB4493473.
Back to top
March 12, 2019
KB4489882
KB4493473
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PT
If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions.
Affected platforms:
- Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
- Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016
Resolution: This issue was resolved in KB4493470.
Back to top
March 19, 2019
KB4489889
KB4493470
April 09, 2019
10:00 AM PT
Opened:
March 19, 2019
10:00 AM PT
| Details | Originating update | Status | History |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. Affected platforms:
Resolution: This issue is resolved in KB4493470. Back to top | OS Build 14393.2791 February 12, 2019 KB4487026 | Resolved KB4493470 | Resolved: April 09, 2019 10:00 AM PT Opened: February 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. Affected platforms:
Workaround: Do one of the following:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 14393.2724 January 08, 2019 KB4480961 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: January 08, 2019 10:00 AM PT |
| Internet Explorer 11 authentication issue with multiple concurrent logons After installing KB4480961, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
Affected platforms:
Resolution: This issue was resolved in KB4493470. Back to top | OS Build 14393.2724 January 08, 2019 KB4480961 | Resolved KB4493470 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding After installing KB4480961, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings. Affected platforms:
Resolution: This issue was resolved in KB4493470. Back to top | OS Build 14393.2724 January 08, 2019 KB4480961 | Resolved KB4493470 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
| Summary | Originating update | Status | Last updated |
| Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessible See details > | OS Build 15063.1805 May 14, 2019 KB4499181 | Investigating | May 16, 2019 06:41 PM PT |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". See details > | OS Build 15063.1563 January 08, 2019 KB4480973 | Mitigated | April 25, 2019 02:00 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | OS Build 15063.1784 April 25, 2019 KB4493436 | Resolved KB4499181 | May 15, 2019 05:55 PM PT |
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 15063.1689 March 12, 2019 KB4489871 | Resolved KB4493436 | April 25, 2019 02:00 PM PT |
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. See details > | OS Build 15063.1716 March 19, 2019 KB4489888 | Resolved KB4493474 | April 09, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | OS Build 15063.1563 January 08, 2019 KB4480973 | Resolved KB4493474 | April 09, 2019 10:00 AM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | OS Build 15063.1631 February 12, 2019 KB4487020 | Resolved KB4493474 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Unable to access some gov.uk websites After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge. Affected platforms:
Next Steps: Microsoft is working on a resolution and will provide an update as quickly as possible. Back to top | OS Build 15063.1805 May 14, 2019 KB4499181 | Investigating | Last updated: May 16, 2019 06:41 PM PT Opened: May 16, 2019 01:57 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | OS Build 15063.1784 April 25, 2019 KB4493436 | Resolved KB4499181 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Details | Originating update | Status | History |
| Custom URI schemes may not start corresponding application After installing KB4489871, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer. Affected platforms:
Resolution: This issue is resolved in KB4493436. Back to top | OS Build 15063.1689 March 12, 2019 KB4489871 | Resolved KB4493436 | Resolved: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT |
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions. Affected platforms:
Resolution: This issue was resolved in KB4493474. Back to top | OS Build 15063.1716 March 19, 2019 KB4489888 | Resolved KB4493474 | Resolved: April 09, 2019 10:00 AM PT Opened: March 19, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. Affected platforms:
Resolution: This issue is resolved in KB4493474. Back to top | OS Build 15063.1631 February 12, 2019 KB4487020 | Resolved KB4493474 | Resolved: April 09, 2019 10:00 AM PT Opened: February 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. Affected platforms:
Workaround: Do one of the following:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 15063.1563 January 08, 2019 KB4480973 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: January 08, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding After installing KB4480973, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings. Affected platforms:
Resolution: This issue was resolved in KB4493474. Back to top | OS Build 15063.1563 January 08, 2019 KB4480973 | Resolved KB4493474 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
| Summary | Originating update | Status | Last updated |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail. See details > | OS Build 16299.1127 April 25, 2019 KB4493440 | Investigating | April 25, 2019 02:00 PM PT |
| Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessible See details > | OS Build 16299.1143 May 14, 2019 KB4498946 | Investigating | May 16, 2019 06:41 PM PT |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". See details > | OS Build 16299.904 January 08, 2019 KB4480978 | Mitigated | April 25, 2019 02:00 PM PT |
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493440 | April 25, 2019 02:00 PM PT |
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. See details > | OS Build 16299.1059 March 19, 2019 KB4489890 | Resolved KB4493441 | April 09, 2019 10:00 AM PT |
| MSXML6 causes applications to stop responding if an exception was thrown MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | OS Build 16299.904 January 08, 2019 KB4480978 | Resolved KB4493441 | April 09, 2019 10:00 AM PT |
| Stop error when attempting to start SSH from WSL A stop error occurs when attempting to start Secure Shell from Windows Subsystem for Linux with agent forwarding using a command line switch (ssh –A) or a configuration setting. See details > | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493441 | April 09, 2019 10:00 AM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | OS Build 16299.967 February 12, 2019 KB4486996 | Resolved KB4493441 | April 09, 2019 10:00 AM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | OS Build 16299.1127 April 25, 2019 KB4493440 | Resolved KB4499179 | May 15, 2019 05:55 PM PT |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail. See details > | OS Build 16299.1127 April 25, 2019 KB4493440 | Resolved KB4499179 | May 14, 2019 01:18 PM PT |
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493440 | April 25, 2019 02:00 PM PT |
| Details | Originating update | Status | History |
| Unable to access some gov.uk websites After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge. Affected platforms:
Next Steps: Microsoft is working on a resolution and will provide an update as quickly as possible. Back to top | OS Build 16299.1143 May 14, 2019 KB4498946 | Investigating | Last updated: May 16, 2019 06:41 PM PT Opened: May 16, 2019 01:57 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | OS Build 16299.1127 April 25, 2019 KB4493440 | Resolved KB4499179 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Details | Originating update | Status | History |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493440. Affected platforms:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 16299.1127 April 25, 2019 KB4493440 | Investigating | Last updated: April 25, 2019 02:00 PM PT Opened: April 25, 2019 02:00 PM PT |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493440. Affected platforms:
Resolution: This issue was resolved in KB4499179. Back to top | OS Build 16299.1127 April 25, 2019 KB4493440 | Resolved KB4499179 | Resolved: May 14, 2019 10:00 AM PT Opened: April 25, 2019 02:00 PM PT |
| Details | Originating update | Status | History |
| Custom URI schemes may not start corresponding application After installing KB4489886, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer. Affected platforms:
Resolution: This issue is resolved in KB4493440. Back to top | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493440 | Resolved: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT |
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions. Affected platforms:
Resolution: This issue is resolved in KB4493441. Back to top | OS Build 16299.1059 March 19, 2019 KB4489890 | Resolved KB4493441 | Resolved: April 09, 2019 10:00 AM PT Opened: March 19, 2019 10:00 AM PT |
| Stop error when attempting to start SSH from WSL After applying KB4489886, a stop error occurs when attempting to start the Secure Shell (SSH) client program from Windows Subsystem for Linux (WSL) with agent forwarding enabled using a command line switch (ssh –A) or a configuration setting. Affected platforms:
Resolution: This issue is resolved in KB4493441. Back to top | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493441 | Resolved: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. Affected platforms:
Resolution: This issue is resolved in KB4493441. Back to top | OS Build 16299.967 February 12, 2019 KB4486996 | Resolved KB4493441 | Resolved: April 09, 2019 10:00 AM PT Opened: February 12, 2019 10:00 AM PT |
| Custom URI schemes may not start corresponding application After installing KB4489886, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer. Affected platforms:
Resolution: This issue is resolved in KB4493440. Back to top | OS Build 16299.1029 March 12, 2019 KB4489886 | Resolved KB4493440 | Resolved: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. Affected platforms:
Workaround: Do one of the following:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 16299.904 January 08, 2019 KB4480978 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: January 08, 2019 10:00 AM PT |
| MSXML6 causes applications to stop responding if an exception was thrown After installing KB4480978, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings. Affected platforms:
Resolution: This issue is resolved in KB4493441. Back to top | OS Build 16299.904 January 08, 2019 KB4480978 | Resolved KB4493441 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
| Summary | Originating update | Status | Last updated |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail. See details > | OS Build 17134.753 April 25, 2019 KB4493437 | Investigating | April 25, 2019 02:00 PM PT |
| Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessible See details > | OS Build 17134.765 May 14, 2019 KB4499167 | Investigating | May 16, 2019 06:41 PM PT |
| Issue using PXE to start a device from WDS Using PXE to start a device from a WDS server configured to use Variable Window Extension may cause the connection to the WDS server to terminate prematurely. See details > | OS Build 17134.648 March 12, 2019 KB4489868 | Mitigated | April 25, 2019 02:00 PM PT |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". See details > | OS Build 17134.523 January 08, 2019 KB4480966 | Mitigated | April 25, 2019 02:00 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | OS Build 17134.753 April 25, 2019 KB4493437 | Resolved KB4499167 | May 15, 2019 05:55 PM PT |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail. See details > | OS Build 17134.753 April 25, 2019 KB4493437 | Resolved KB4499167 | May 14, 2019 01:19 PM PT |
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 17134.648 March 12, 2019 KB4489868 | Resolved KB4493437 | April 25, 2019 02:00 PM PT |
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. See details > | OS Build 17134.677 March 19, 2019 KB4489894 | Resolved KB4493464 | April 09, 2019 10:00 AM PT |
| First character of the Japanese era name not recognized The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues. See details > | OS Build 17134.556 January 15, 2019 KB4480976 | Resolved KB4487029 | April 09, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | OS Build 17134.523 January 08, 2019 KB4480966 | Resolved KB4493464 | April 09, 2019 10:00 AM PT |
| Stop error when attempting to start SSH from WSL A stop error occurs when attempting to start Secure Shell from Windows Subsystem for Linux with agent forwarding using a command line switch (ssh –A) or a configuration setting. See details > | OS Build 17134.648 March 12, 2019 KB4489868 | Resolved KB4493464 | April 09, 2019 10:00 AM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | OS Build 17134.590 February 12, 2019 KB4487017 | Resolved KB4493464 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Unable to access some gov.uk websites After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge. Affected platforms:
Next Steps: Microsoft is working on a resolution and will provide an update as quickly as possible. Back to top | OS Build 17134.765 May 14, 2019 KB4499167 | Investigating | Last updated: May 16, 2019 06:41 PM PT Opened: May 16, 2019 01:57 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | OS Build 17134.753 April 25, 2019 KB4493437 | Resolved KB4499167 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Details | Originating update | Status | History |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493437. Affected platforms:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17134.753 April 25, 2019 KB4493437 | Investigating | Last updated: April 25, 2019 02:00 PM PT Opened: April 25, 2019 02:00 PM PT |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493437. Affected platforms:
Resolution: This issue was resolved in KB4499167. Back to top | OS Build 17134.753 April 25, 2019 KB4493437 | Resolved KB4499167 | Resolved: May 14, 2019 10:00 AM PT Opened: April 25, 2019 02:00 PM PT |
After installing KB4489868, there may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause the connection to the WDS server to terminate prematurely while downloading the image. This issue does not affect clients or devices that are not using Variable Window Extension.
Affected platforms:
- Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1
- Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
Workaround: To mitigate the issue, disable the Variable Window Extension on WDS server using one of the following options:
Option 1:
Open an Administrator Command prompt and type the following:
Wdsutil /Set-TransportServer /EnableTftpVariableWindowExtension:No
Option 2:
Use the Windows Deployment Services UI to make the following adjustment:
- Open Windows Deployment Services from Windows Administrative Tools.
- Expand Servers and right-click a WDS server.
- Open its properties and clear the Enable Variable Window Extension box on the TFTP tab.
Option 3:
Set the following registry value to 0:
HKLM\\System\\CurrentControlSet\\Services\\WDSServer\\Providers\\WDSTFTP\\EnableVariableWindowExtension
Restart the WDSServer service after disabling the Variable Window Extension.
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.
Back to top
March 12, 2019
KB4489868
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PT
After installing KB4489868, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.
Affected platforms:
- Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
- Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
Resolution: This issue is resolved in KB4493437.
Back to top
March 12, 2019
KB4489868
KB4493437
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PT
If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions.
Affected platforms:
- Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
- Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016
Resolution: This issue was resolved in KB4493464.
Back to top
March 19, 2019
KB4489894
KB4493464
April 09, 2019
10:00 AM PT
Opened:
March 19, 2019
10:00 AM PT
After applying KB4489868, a stop error occurs when attempting to start the Secure Shell (SSH) client program from Windows Subsystem for Linux (WSL) with agent forwarding enabled using a command line switch (ssh -A) or a configuration setting.
Affected platforms:
- Client: Windows 10, version 1803; Windows 10, version 1709
- Server: Windows Server, version 1803; Windows Server, version 1709
Resolution: This issue was resolved in KB4493464.
Back to top
March 12, 2019
KB4489868
KB4493464
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
| Details | Originating update | Status | History |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. Affected platforms:
Resolution: This issue is resolved in KB4493464. Back to top | OS Build 17134.590 February 12, 2019 KB4487017 | Resolved KB4493464 | Resolved: April 09, 2019 10:00 AM PT Opened: February 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. Affected platforms:
Workaround: Do one of the following:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17134.523 January 08, 2019 KB4480966 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: January 08, 2019 10:00 AM PT |
| First character of the Japanese era name not recognized After installing KB4480976, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues. Affected platforms:
Resolution: This issue is resolved in KB4487029. Back to top | OS Build 17134.556 January 15, 2019 KB4480976 | Resolved KB4487029 | Resolved: February 19, 2019 02:00 PM PT Opened: January 08, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding After installing KB4480966, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings. Affected platforms:
Resolution: This issue was resolved in KB4493464. Back to top | OS Build 17134.523 January 08, 2019 KB4480966 | Resolved KB4493464 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
| Summary | Originating update | Status | Last updated |
| System may be unresponsive after restart if ArcaBit antivirus software installed Devices with ArcaBit antivirus software installed may become unresponsive upon restart. See details > | OS Build 17763.437 April 09, 2019 KB4493509 | Mitigated | April 25, 2019 02:00 PM PT |
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 17763.379 March 12, 2019 KB4489899 | Mitigated | April 09, 2019 10:00 AM PT |
| Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessible See details > | OS Build 17763.502 May 14, 2019 KB4494441 | Investigating | May 16, 2019 06:41 PM PT |
| Devices with some Asian language packs installed may receive an error After installing the KB4493509 devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_F See details > | OS Build 17763.437 April 09, 2019 KB4493509 | Mitigated | May 03, 2019 10:59 AM PT |
| Printing from Microsoft Edge or other UWP apps, you may receive the error 0x80070007 Attempting to print from Microsoft Edge or other Universal Windows Platform (UWP) applications, you may receive an error. See details > | OS Build 17763.379 March 12, 2019 KB4489899 | Mitigated | May 02, 2019 04:47 PM PT |
| Issue using PXE to start a device from WDS Using PXE to start a device from a WDS server configured to use Variable Window Extension may cause the connection to the WDS server to terminate prematurely. See details > | OS Build 17763.379 March 12, 2019 KB4489899 | Mitigated | April 09, 2019 10:00 AM PT |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". See details > | OS Build 17763.253 January 08, 2019 KB4480116 | Mitigated | April 09, 2019 10:00 AM PT |
| Audio not working on monitors or TV connected to a PC via HDMI, USB, or DisplayPort Upgrade block: Microsoft has identified issues with certain new Intel display drivers, which accidentally turn on unsupported features in Windows. See details > | OS Build 17763.134 November 13, 2018 KB4467708 | Mitigated | March 15, 2019 12:00 PM PT |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". See details > | OS Build 17763.253 January 08, 2019 KB4480116 | Mitigated | January 08, 2019 10:00 AM PT |
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. See details > | OS Build 17763.404 April 02, 2019 KB4490481 | Resolved KB4493509 | April 09, 2019 10:00 AM PT |
| Internet Explorer 11 authentication issue with multiple concurrent logons Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine. See details > | OS Build 17763.253 January 08, 2019 KB4480116 | Resolved KB4493509 | April 09, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | OS Build 17763.253 January 08, 2019 KB4480116 | Resolved KB4493509 | April 09, 2019 10:00 AM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | OS Build 17763.316 February 12, 2019 KB4487044 | Resolved KB4493509 | April 09, 2019 10:00 AM PT |
| Apps may stop working after selecting an audio output device other than the default Users with multiple audio devices that select an audio output device different from the \"Default Audio Device\" may find certain applications stop working unexpectedly. See details > | OS Build 17763.348 March 01, 2019 KB4482887 | Resolved KB4490481 | April 02, 2019 10:00 AM PT |
| Windows 10, version 1809 update history may show an update installed twice Some customers are reporting that KB4494441 installed twice on their device See details > | OS Build 17763.503 May 14, 2019 KB4494441 | Resolved | May 16, 2019 02:37 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved KB4494441 | May 15, 2019 05:55 PM PT |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail. See details > | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved KB4494441 | May 14, 2019 01:19 PM PT |
| Latest cumulative update (KB 4495667) installs automatically Reports that the optional cumulative update (KB 4495667) installs automatically. See details > | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved | May 08, 2019 03:37 PM PT |
| System may be unresponsive after restart if ArcaBit antivirus software installed After further investigation ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809 See details > | OS Build 17763.437 April 09, 2019 KB4493509 | Resolved | May 08, 2019 03:30 PM PT |
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | OS Build 17763.379 March 12, 2019 KB4489899 | Resolved KB4495667 | May 03, 2019 12:40 PM PT |
| Details | Originating update | Status | History |
| Unable to access some gov.uk websites After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge. Affected platforms:
Next Steps: Microsoft is working on a resolution and will provide an update as quickly as possible. Back to top | OS Build 17763.502 May 14, 2019 KB4494441 | Investigating | Last updated: May 16, 2019 06:41 PM PT Opened: May 16, 2019 01:57 PM PT |
| Devices with some Asian language packs installed may receive an error After installing the April 2019 Cumulative Update (KB4493509), devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\" Affected platforms:
Workaround:
Note: If reinstalling the language pack does not mitigate the issue, reset your PC as follows:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17763.437 April 09, 2019 KB4493509 | Mitigated | Last updated: May 03, 2019 10:59 AM PT Opened: May 02, 2019 04:36 PM PT |
| Printing from Microsoft Edge or other UWP apps, you may receive the error 0x80070007 When attempting to print from Microsoft Edge or other Universal Windows Platform (UWP) applications you may receive the error, \"Your printer has experienced an unexpected configuration problem. 0x80070007e.\" Affected platforms:
Workaround: You can use another browser, such as Internet Explorer to print your documents. Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17763.379 March 12, 2019 KB4489899 | Mitigated | Last updated: May 02, 2019 04:47 PM PT Opened: May 02, 2019 04:47 PM PT |
| Windows 10, version 1809 update history may show an update installed twice Affected platforms:
Cause: In certain situations, installing an update requires multiple download and restart steps. In cases where two intermediate steps of the installation complete successfully, the View your Update history page will report that installation completed successfully twice. Resolution: No action is required on your part. The update installation may take longer and may require more than one restart, but will install successfully after all intermediate installation steps have completed. We are working on improving this update experience to ensure the Update history correctly reflects the installation of the latest cumulative update (LCU). Back to top | OS Build 17763.503 May 14, 2019 KB4494441 | Resolved | Resolved: May 16, 2019 02:37 PM PT Opened: May 14, 2019 02:56 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved KB4494441 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4495667. Affected platforms:
Resolution: This issue was resolved in KB4494441. Back to top | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved KB4494441 | Resolved: May 14, 2019 10:00 AM PT Opened: May 14, 2019 01:19 PM PT |
| Latest cumulative update (KB 4495667) installs automatically Due to a servicing side issue some users were offered KB4495667 (optional update) automatically and rebooted devices. This issue has been mitigated. Affected platforms:
Resolution:: This issue has been mitigated on the servicing side to prevent auto installing of this update. Customers do not need to take any action. Back to top | OS Build 17763.475 May 03, 2019 KB4495667 | Resolved | Resolved: May 08, 2019 03:37 PM PT Opened: May 05, 2019 12:01 PM PT |
| Details | Originating update | Status | History |
| System may be unresponsive after restart if ArcaBit antivirus software installed Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493509. Microsoft has temporarily blocked devices from receiving this update if ArcaBit antivirus software is installed. Affected platforms:
Workaround: ArcaBit has released an update to address this issue. For more information, see the Arcabit support article. Back to top | OS Build 17763.437 April 09, 2019 KB4493509 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| End-user-defined characters (EUDC) may cause blue screen at startup If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions. Affected platforms:
Resolution: This issue was resolved in KB4493509. Back to top | OS Build 17763.404 April 02, 2019 KB4490481 | Resolved KB4493509 | Resolved: April 09, 2019 10:00 AM PT Opened: April 02, 2019 10:00 AM PT |
| System may be unresponsive after restart if ArcaBit antivirus software installed ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809 (client or server). Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart. Affected platforms:
Workaround: ArcaBit has released an update to address this issue for affected platforms. For more information, see the ArcaBit support article. Resolution: This issue has been resolved. ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809 (client or server). Back to top | OS Build 17763.437 April 09, 2019 KB4493509 | Resolved | Resolved: May 08, 2019 03:30 PM PT Opened: April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Custom URI schemes may not start corresponding application After installing KB4489899, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer. Affected platforms:
Workaround: Right-click the URL link to open it in a new window or tab, or enable Protected Mode in Internet Explorer for local intranet and trusted sites
You must restart the browser after making these changes. Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17763.379 March 12, 2019 KB4489899 | Mitigated | Last updated: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Issue using PXE to start a device from WDS After installing KB4489899, there may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause the connection to the WDS server to terminate prematurely while downloading the image. This issue does not affect clients or devices that are not using Variable Window Extension. Affected platforms:
Workaround: To mitigate the issue, disable the Variable Window Extension on WDS server using one of the following options: Option 1: Open an Administrator Command prompt and type the following: Wdsutil /Set-TransportServer /EnableTftpVariableWindowExtension:No Option 2: Use the Windows Deployment Services UI to make the following adjustment:
Option 3: Set the following registry value to 0: HKLM\\System\\CurrentControlSet\\Services\\WDSServer\\Providers\\WDSTFTP\\EnableVariableWindowExtension Restart the WDSServer service after disabling the Variable Window Extension. Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17763.379 March 12, 2019 KB4489899 | Mitigated | Last updated: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Apps may stop working after selecting an audio output device other than the default After installing KB4482887 on machines that have multiple audio devices, applications that provide advanced options for internal or external audio output devices may stop working unexpectedly. This issue occurs for users that select an audio output device different from the \"Default Audio Device\". Examples of applications that may stop working include:
Affected platforms:
Resolution: This issue was resolved in KB4490481. Back to top | OS Build 17763.348 March 01, 2019 KB4482887 | Resolved KB4490481 | Resolved: April 02, 2019 10:00 AM PT Opened: March 01, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. Affected platforms:
Resolution: This issue is resolved in KB4493509. Back to top | OS Build 17763.316 February 12, 2019 KB4487044 | Resolved KB4493509 | Resolved: April 09, 2019 10:00 AM PT Opened: February 12, 2019 10:00 AM PT |
| Custom URI schemes may not start corresponding application After installing KB4489899, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer. Affected platforms:
Workaround: Right-click the URL link to open it in a new window or tab, or enable Protected Mode in Internet Explorer for local intranet and trusted sites
You must restart the browser after making these changes. Resolution: This issue is resolved in KB4495667. Back to top | OS Build 17763.379 March 12, 2019 KB4489899 | Resolved KB4495667 | Resolved: May 03, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. Affected platforms:
Workaround: Do one of the following:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17763.253 January 08, 2019 KB4480116 | Mitigated | Last updated: January 08, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
| Internet Explorer 11 authentication issue with multiple concurrent logons After installing KB4480116, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
Affected platforms:
Resolution: This issue was resolved in KB4493509. Back to top | OS Build 17763.253 January 08, 2019 KB4480116 | Resolved KB4493509 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding After installing KB4480116, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings. Affected platforms:
Resolution: This issue was resolved in KB4493509. Back to top | OS Build 17763.253 January 08, 2019 KB4480116 | Resolved KB4493509 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. Affected platforms:
Workaround: Do one of the following:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17763.253 January 08, 2019 KB4480116 | Mitigated | Last updated: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
| Summary | Originating update | Status | Last updated |
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493472 | Investigating | April 25, 2019 02:00 PM PT |
| Authentication may fail for services after the Kerberos ticket expires Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires. See details > | March 12, 2019 KB4489878 | Mitigated | April 25, 2019 02:00 PM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493472 | Mitigated | April 25, 2019 02:00 PM PT |
| System may be unresponsive after restart if ArcaBit antivirus software installed Devices with ArcaBit antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493472 | Mitigated | April 25, 2019 02:00 PM PT |
| Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessible See details > | May 14, 2019 KB4499164 | Investigating | May 16, 2019 06:41 PM PT |
| System may be unresponsive after restart with certain McAfee antivirus products Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup. See details > | April 09, 2019 KB4493472 | Mitigated | April 25, 2019 02:00 PM PT |
| System may be unresponsive after restart if ArcaBit antivirus software installed Devices with ArcaBit antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493472 | Resolved | May 14, 2019 01:23 PM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493472 | Resolved | May 14, 2019 01:22 PM PT |
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493472 | Resolved | May 14, 2019 01:21 PM PT |
| Authentication may fail for services after the Kerberos ticket expires Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires. See details > | March 12, 2019 KB4489878 | Resolved KB4499164 | May 14, 2019 01:17 PM PT |
| Devices may not respond at login or Welcome screen if running certain Avast software Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart. See details > | April 09, 2019 KB4493472 | Resolved | April 25, 2019 02:00 PM PT |
| Internet Explorer 11 authentication issue with multiple concurrent logons Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine. See details > | January 08, 2019 KB4480970 | Resolved KB4493472 | April 09, 2019 10:00 AM PT |
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | March 12, 2019 KB4489878 | Resolved KB4493472 | April 09, 2019 10:00 AM PT |
| NETDOM.EXE fails to run NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen. See details > | March 12, 2019 KB4489878 | Resolved KB4493472 | April 09, 2019 10:00 AM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | February 12, 2019 KB4486563 | Resolved KB4493472 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Unable to access some gov.uk websites After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge. Affected platforms:
Next Steps: Microsoft is working on a resolution and will provide an update as quickly as possible. Back to top | May 14, 2019 KB4499164 | Investigating | Last updated: May 16, 2019 06:41 PM PT Opened: May 16, 2019 01:57 PM PT |
| Details | Originating update | Status | History |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493472. Microsoft has temporarily blocked devices from receiving this update if Avira antivirus software is installed. Affected platforms:
Next steps: We are presently investigating this issue with Avira and will provide an update when available. Back to top | April 09, 2019 KB4493472 | Investigating | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493472. Microsoft has temporarily blocked devices from receiving this update if the Sophos Endpoint is installed until a solution is available. Affected platforms:
Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493472 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if ArcaBit antivirus software installed Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493472. Microsoft has temporarily blocked devices from receiving this update if ArcaBit antivirus software is installed. Affected platforms:
Workaround: ArcaBit has released an update to address this issue. For more information, see the Arcabit support article. Back to top | April 09, 2019 KB4493472 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart with certain McAfee antivirus products Microsoft and McAfee have identified an issue on devices with McAfee Endpoint Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 or McAfee VirusScan Enterprise (VSE) 8.8 installed. It may cause the system to have slow startup or become unresponsive at restart after installing this update. Affected platforms:
Workaround: Guidance for McAfee customers can be found in the following McAfee support articles:
Next steps: We are presently investigating this issue with McAfee. We will provide an update once we have more information. Back to top | April 09, 2019 KB4493472 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if ArcaBit antivirus software installed Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493472. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. ArcaBit has released an update to address this issue. For more information, see the Arcabit support article. Back to top | April 09, 2019 KB4493472 | Resolved | Resolved: May 14, 2019 01:23 PM PT Opened: April 09, 2019 10:00 AM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493472. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493472 | Resolved | Resolved: May 14, 2019 01:22 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493472. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article. Back to top | April 09, 2019 KB4493472 | Resolved | Resolved: May 14, 2019 01:21 PM PT Opened: April 09, 2019 10:00 AM PT |
| Devices may not respond at login or Welcome screen if running certain Avast software Microsoft and Avast have identified an issue on devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software after you install KB4493472 and restart. Devices may become unresponsive at the login or Welcome screen. Additionally, you may be unable to log in or log in after an extended period of time. Affected platforms:
Resolution: Avast has released emergency updates to address this issue. For more information and AV update schedule, see the Avast support KB article. Back to top | April 09, 2019 KB4493472 | Resolved | Resolved: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Authentication may fail for services after the Kerberos ticket expires After installing KB4489878, some customers report that authentication fails for services that require unconstrained delegation after the Kerberos ticket expires (the default is 10 hours). For example, the SQL server service fails. Affected platforms:
Workaround: To mitigate this issue, use one of the following options:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | March 12, 2019 KB4489878 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT |
| Custom URI schemes may not start corresponding application After installing KB4489878, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites on Internet Explorer. Affected platforms:
Resolution: This issue is resolved in KB4493472. Back to top | March 12, 2019 KB4489878 | Resolved KB4493472 | Resolved: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| NETDOM.EXE fails to run After installing KB4489878, NETDOM.EXE fails to run, and the on-screen error, “The command failed to complete successfully.” appears. Affected platforms:
Resolution: This issue is resolved in KB4493472. Back to top | March 12, 2019 KB4489878 | Resolved KB4493472 | Resolved: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. Affected platforms:
Resolution: This issue is resolved in KB4493472. Back to top | February 12, 2019 KB4486563 | Resolved KB4493472 | Resolved: April 09, 2019 10:00 AM PT Opened: February 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Internet Explorer 11 authentication issue with multiple concurrent logons After installing KB4480970, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
Affected platforms:
Resolution: This issue is resolved in KB4493472. Back to top | January 08, 2019 KB4480970 | Resolved KB4493472 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
| Authentication may fail for services after the Kerberos ticket expires After installing KB4489878, some customers report that authentication fails for services that require unconstrained delegation after the Kerberos ticket expires (the default is 10 hours). For example, the SQL server service fails. Affected platforms:
Resolution: This issue was resolved in KB4499164. Back to top | March 12, 2019 KB4489878 | Resolved KB4499164 | Resolved: May 14, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
| Summary | Originating update | Status | Last updated |
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493446 | Investigating | April 25, 2019 02:00 PM PT |
| Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessible See details > | May 14, 2019 KB4499151 | Investigating | May 16, 2019 06:41 PM PT |
| Japanese IME doesn't show the new Japanese Era name as a text input option If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option. See details > | April 25, 2019 KB4493443 | Mitigated | May 15, 2019 05:53 PM PT |
| Issue using PXE to start a device from WDS There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. See details > | March 12, 2019 KB4489881 | Mitigated | April 25, 2019 02:00 PM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493446 | Mitigated | April 25, 2019 02:00 PM PT |
| System may be unresponsive after restart if ArcaBit antivirus software installed Devices with ArcaBit antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493446 | Mitigated | April 25, 2019 02:00 PM PT |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. See details > | January 08, 2019 KB4480963 | Mitigated | April 25, 2019 02:00 PM PT |
| System may be unresponsive after restart with certain McAfee antivirus products Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup. See details > | April 09, 2019 KB4493446 | Mitigated | April 18, 2019 05:00 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | April 25, 2019 KB4493443 | Resolved KB4499151 | May 15, 2019 05:55 PM PT |
| System may be unresponsive after restart if ArcaBit antivirus software installed Devices with ArcaBit antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493446 | Resolved | May 14, 2019 01:22 PM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493446 | Resolved | May 14, 2019 01:22 PM PT |
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493446 | Resolved | May 14, 2019 01:21 PM PT |
| Devices may not respond at login or Welcome screen if running certain Avast software Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart. See details > | April 09, 2019 KB4493446 | Resolved | April 25, 2019 02:00 PM PT |
| Internet Explorer 11 authentication issue with multiple concurrent logons Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine. See details > | January 08, 2019 KB4480963 | Resolved KB4493446 | April 09, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding. MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | January 08, 2019 KB4480963 | Resolved KB4493446 | April 09, 2019 10:00 AM PT |
| Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer. See details > | March 12, 2019 KB4489881 | Resolved KB4493446 | April 09, 2019 10:00 AM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | February 12, 2019 KB4487000 | Resolved KB4493446 | April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Unable to access some gov.uk websites After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge. Affected platforms:
Next Steps: Microsoft is working on a resolution and will provide an update as quickly as possible. Back to top | May 14, 2019 KB4499151 | Investigating | Last updated: May 16, 2019 06:41 PM PT Opened: May 16, 2019 01:57 PM PT |
| Japanese IME doesn't show the new Japanese Era name as a text input option If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option. Affected platforms:
Workaround: If you see any of the previous dictionary updates listed below, uninstall it from Programs and features > Uninstall or change a program. New words that were in previous dictionary updates are also in this update.
Back to top | April 25, 2019 KB4493443 | Mitigated | Last updated: May 15, 2019 05:53 PM PT Opened: May 15, 2019 05:53 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | April 25, 2019 KB4493443 | Resolved KB4499151 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Details | Originating update | Status | History |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493446. Microsoft has temporarily blocked devices from receiving this update if Avira antivirus software is installed. Affected platforms:
Next steps: We are presently investigating this issue with Avira and will provide an update when available. Back to top | April 09, 2019 KB4493446 | Investigating | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493446. Microsoft has temporarily blocked devices from receiving this update if the Sophos Endpoint is installed until a solution is available. Affected platforms:
Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493446 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if ArcaBit antivirus software installed Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493446. Microsoft has temporarily blocked devices from receiving this update if ArcaBit antivirus software is installed. Affected platforms:
Workaround: ArcaBit has released an update to address this issue. For more information, see the Arcabit support article. Back to top | April 09, 2019 KB4493446 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart with certain McAfee antivirus products Microsoft and McAfee have identified an issue on devices with McAfee Endpoint Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 or McAfee VirusScan Enterprise (VSE) 8.8 installed. It may cause the system to have slow startup or become unresponsive at restart after installing this update. Affected platforms:
Workaround: Guidance for McAfee customers can be found in the following McAfee support articles:
Next steps: We are presently investigating this issue with McAfee. We will provide an update once we have more information. Back to top | April 09, 2019 KB4493446 | Mitigated | Last updated: April 18, 2019 05:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if ArcaBit antivirus software installed Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493446. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. ArcaBit has released an update to address this issue. For more information, see the Arcabit support article. Back to top | April 09, 2019 KB4493446 | Resolved | Resolved: May 14, 2019 01:22 PM PT Opened: April 09, 2019 10:00 AM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493446. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493446 | Resolved | Resolved: May 14, 2019 01:22 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493446. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article. Back to top | April 09, 2019 KB4493446 | Resolved | Resolved: May 14, 2019 01:21 PM PT Opened: April 09, 2019 10:00 AM PT |
| Devices may not respond at login or Welcome screen if running certain Avast software Microsoft and Avast have identified an issue on devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software after you install KB4493446 and restart. Devices may become unresponsive at the login or Welcome screen. Additionally, you may be unable to log in or log in after an extended period of time. Affected platforms:
Resolution: Avast has released emergency updates to address this issue. For more information and AV update schedule, see the Avast support KB article. Back to top | April 09, 2019 KB4493446 | Resolved | Resolved: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Issue using PXE to start a device from WDS After installing KB4489881, there may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause the connection to the WDS server to terminate prematurely while downloading the image. This issue does not affect clients or devices that are not using Variable Window Extension. Affected platforms:
Workaround: To mitigate the issue, disable the Variable Window Extension on WDS server using one of the following options: Option 1: Open an Administrator Command prompt and type the following: Wdsutil /Set-TransportServer /EnableTftpVariableWindowExtension:No Option 2: Use the Windows Deployment Services UI to make the following adjustment:
Option 3: Set the following registry value to 0: HKLM\\System\\CurrentControlSet\\Services\\WDSServer\\Providers\\WDSTFTP\\EnableVariableWindowExtension Restart the WDSServer service after disabling the Variable Window Extension. Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | March 12, 2019 KB4489881 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT |
| Custom URI schemes may not start corresponding application After installing KB4489881, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer. Affected platforms:
Resolution: This issue is resolved in KB4493446. Back to top | March 12, 2019 KB4489881 | Resolved KB4493446 | Resolved: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. Affected platforms
Resolution: This issue is resolved in KB4493446. Back to top | February 12, 2019 KB4487000 | Resolved KB4493446 | Resolved: April 09, 2019 10:00 AM PT Opened: February 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. Affected platforms:
Workaround: Do one of the following:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | January 08, 2019 KB4480963 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: January 08, 2019 10:00 AM PT |
| Internet Explorer 11 authentication issue with multiple concurrent logons After installing KB4480963, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
Affected platforms:
Resolution: This issue is resolved in KB4493446. Back to top | January 08, 2019 KB4480963 | Resolved KB4493446 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding. After installing KB4480963, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings. Affected platforms:
Resolution: This issue is resolved in KB4493446. Back to top | January 08, 2019 KB4480963 | Resolved KB4493446 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
| Summary | Originating update | Status | Last updated |
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493471 | Investigating | April 25, 2019 02:00 PM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493471 | Mitigated | April 25, 2019 02:00 PM PT |
| Authentication may fail for services after the Kerberos ticket expires Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires. See details > | March 12, 2019 KB4489880 | Mitigated | April 25, 2019 02:00 PM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | February 12, 2019 KB4487023 | Resolved KB4493471 | April 09, 2019 10:00 AM PT |
| NETDOM.EXE fails to run NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen. See details > | March 12, 2019 KB4489880 | Resolved KB4493471 | April 09, 2019 10:00 AM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493471 | Resolved | May 14, 2019 01:21 PM PT |
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493471 | Resolved | May 14, 2019 01:19 PM PT |
| Authentication may fail for services after the Kerberos ticket expires Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires. See details > | March 12, 2019 KB4489880 | Resolved KB4499149 | May 14, 2019 01:18 PM PT |
| Details | Originating update | Status | History |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493471. Microsoft has temporarily blocked devices from receiving this update if Avira antivirus software is installed. Affected platforms:
Next steps: We are presently investigating this issue with Avira and will provide an update when available. Back to top | April 09, 2019 KB4493471 | Investigating | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493471. Microsoft has temporarily blocked devices from receiving this update if the Sophos Endpoint is installed until a solution is available. Affected platforms:
Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493471 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493471. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493471 | Resolved | Resolved: May 14, 2019 01:21 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493471. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article. Back to top | April 09, 2019 KB4493471 | Resolved | Resolved: May 14, 2019 01:19 PM PT Opened: April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Authentication may fail for services after the Kerberos ticket expires After installing KB4489880, some customers report that authentication fails for services that require unconstrained delegation after the Kerberos ticket expires (the default is 10 hours). For example, the SQL server service fails. Affected platforms:
Workaround: To mitigate this issue, use one of the following options:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | March 12, 2019 KB4489880 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT |
| NETDOM.EXE fails to run After installing KB4489880, NETDOM.EXE fails to run, and the on-screen error, “The command failed to complete successfully.” appears. Affected platforms:
Resolution: This issue is resolved in KB4493471. Back to top | March 12, 2019 KB4489880 | Resolved KB4493471 | Resolved: April 09, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. Affected platforms
Resolution: This issue is resolved in KB4493471. Back to top | February 12, 2019 KB4487023 | Resolved KB4493471 | Resolved: April 09, 2019 10:00 AM PT Opened: February 12, 2019 10:00 AM PT |
| Authentication may fail for services after the Kerberos ticket expires After installing KB4489880, some customers report that authentication fails for services that require unconstrained delegation after the Kerberos ticket expires (the default is 10 hours). For example, the SQL server service fails. Affected platforms:
Resolution: This issue was resolved in KB4499149. Back to top | March 12, 2019 KB4489880 | Resolved KB4499149 | Resolved: May 14, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT |
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
| Summary | Originating update | Status | Last updated |
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493451 | Investigating | April 25, 2019 02:00 PM PT |
| Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessible See details > | May 14, 2019 KB4499171 | Investigating | May 16, 2019 06:41 PM PT |
| Japanese IME doesn't show the new Japanese Era name as a text input option If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option. See details > | April 25, 2019 KB4493462 | Mitigated | May 15, 2019 05:53 PM PT |
| Issue using PXE to start a device from WDS There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. See details > | March 12, 2019 KB4489891 | Mitigated | April 25, 2019 02:00 PM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493451 | Mitigated | April 25, 2019 02:00 PM PT |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. See details > | January 08, 2019 KB4480975 | Mitigated | April 25, 2019 02:00 PM PT |
| Internet Explorer 11 authentication issue with multiple concurrent logons Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine. See details > | January 08, 2019 KB4480975 | Resolved KB4493451 | April 09, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). See details > | January 08, 2019 KB4480975 | Resolved KB4493451 | April 09, 2019 10:00 AM PT |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. See details > | February 12, 2019 KB4487025 | Resolved KB4493451 | April 09, 2019 10:00 AM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > | April 25, 2019 KB4493462 | Resolved KB4499171 | May 15, 2019 05:55 PM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart. See details > | April 09, 2019 KB4493451 | Resolved | May 14, 2019 01:21 PM PT |
| System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart. See details > | April 09, 2019 KB4493451 | Resolved | May 14, 2019 01:19 PM PT |
| Details | Originating update | Status | History |
| Unable to access some gov.uk websites After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge. Affected platforms:
Next Steps: Microsoft is working on a resolution and will provide an update as quickly as possible. Back to top | May 14, 2019 KB4499171 | Investigating | Last updated: May 16, 2019 06:41 PM PT Opened: May 16, 2019 01:57 PM PT |
| Japanese IME doesn't show the new Japanese Era name as a text input option If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option. Affected platforms:
Workaround: If you see any of the previous dictionary updates listed below, uninstall it from Programs and features > Uninstall or change a program. New words that were in previous dictionary updates are also in this update.
Back to top | April 25, 2019 KB4493462 | Mitigated | Last updated: May 15, 2019 05:53 PM PT Opened: May 15, 2019 05:53 PM PT |
| Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic. Affected platforms:
Resolution: This issue has been resolved. Back to top | April 25, 2019 KB4493462 | Resolved KB4499171 | Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT |
| Details | Originating update | Status | History |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493451. Microsoft has temporarily blocked devices from receiving this update if Avira antivirus software is installed. Affected platforms:
Next steps: We are presently investigating this issue with Avira and will provide an update when available. Back to top | April 09, 2019 KB4493451 | Investigating | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493451. Microsoft has temporarily blocked devices from receiving this update if the Sophos Endpoint is installed until a solution is available. Affected platforms:
Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493451 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT |
| System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493451. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article. Back to top | April 09, 2019 KB4493451 | Resolved | Resolved: May 14, 2019 01:21 PM PT Opened: April 09, 2019 10:00 AM PT |
| System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493451. Affected platforms:
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article. Back to top | April 09, 2019 KB4493451 | Resolved | Resolved: May 14, 2019 01:19 PM PT Opened: April 09, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Embedded objects may display incorrectly Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. Affected platforms
Resolution: This issue is resolved in KB4493451. Back to top | February 12, 2019 KB4487025 | Resolved KB4493451 | Resolved: April 09, 2019 10:00 AM PT Opened: February 12, 2019 10:00 AM PT |
| Details | Originating update | Status | History |
| Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. Affected platforms:
Workaround: Do one of the following:
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release. Back to top | January 08, 2019 KB4480975 | Mitigated | Last updated: April 25, 2019 02:00 PM PT Opened: January 08, 2019 10:00 AM PT |
| Internet Explorer 11 authentication issue with multiple concurrent logons After installing KB4480975, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
Affected platforms:
Resolution: This issue is resolved in KB4493451. Back to top | January 08, 2019 KB4480975 | Resolved KB4493451 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
| MSXML6 may cause applications to stop responding After installing KB4480975, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode(). The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings. Affected platforms:
Resolution: This issue is resolved in KB4493451. Back to top | January 08, 2019 KB4480975 | Resolved KB4493451 | Resolved: April 09, 2019 10:00 AM PT Opened: January 08, 2019 10:00 AM PT |
| Message | Date |
| Reminder: Install the latest SSU for a smoother update experience We strongly recommend that you install the latest servicing stack update (SSU) before installing any Windows update; especially as an SSU may be a prerequisite for some updates. If you have difficulty installing Windows updates, verify that you have installed the latest SSU package for your version of Windows and then try installing the update again. Links to the latest SSU are always provided in the “How to get this update” section of each update KB article (e.g., KB4494441). For more information about SSUs, see our Servicing stack updates guidance. | May 14, 2019 10:00 AM PT |
| Take action: Update Remote Desktop Services on older versions of Windows Today, we released fixes for a critical wormable, remote code execution vulnerability (CVE-2019-0708) in Remote Desktop Services—formerly known as Terminal Services. This vulnerability affects Windows 7, Windows Server 2008 R2, and earlier versions of Windows nearing end of support. It does not affect Windows 8, Windows Server 2012, or newer operating systems. While we have not observed attacks exploiting this vulnerability, affected systems should be patched with priority. Here is what you need to know:
++Call to action: +
| May 14, 2019 10:00 AM PT |
| Reminder: Windows 10 update servicing cadence This month we received questions about the cadence of updates we released in April and May 2019. Here's a quick recap of our releases and servicing cadence:
++
| May 10, 2019 10:00 AM PT |
| Take action: Install servicing stack update for Windows Server 2008 SP2 for SHA-2 code sign support A standalone update, KB4493730, that introduce SHA-2 code sign support for the servicing stack (SSU) was released today as a security update. | April 19, 2019 10:00 AM PT |
| The benefits of Windows 10 Dynamic Update Dynamic Update can help organizations and end users alike ensure that their Windows 10 devices have the latest feature update content (as part of an in-place upgrade)—and preserve precious features on demand (FODs) and language packs (LPs) that may have been previously installed. diff --git a/windows/security/identity-protection/access-control/microsoft-accounts.md b/windows/security/identity-protection/access-control/microsoft-accounts.md index 38c26d9546..18d956384e 100644 --- a/windows/security/identity-protection/access-control/microsoft-accounts.md +++ b/windows/security/identity-protection/access-control/microsoft-accounts.md @@ -22,7 +22,7 @@ ms.date: 10/13/2017 This topic for the IT professional explains how a Microsoft account works to enhance security and privacy for users, and how you can manage this consumer account type in your organization. -Microsoft sites, services, and properties, as well as computers running Windows 10, can use a Microsoft account as a mean of identifying a user. Microsoft account was previously called Windows Live ID. It has user-defined secrets, and consists of a unique email address and a password. +Microsoft sites, services, and properties, as well as computers running Windows 10, can use a Microsoft account as a means of identifying a user. Microsoft account was previously called Windows Live ID. It has user-defined secrets, and consists of a unique email address and a password. When a user signs in with a Microsoft account, the device is connected to cloud services. Many of the user's settings, preferences, and apps can be shared across devices. diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index b315be80ea..63b387c407 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -20,6 +20,7 @@ ms.date: 03/01/2019 **Applies to** - Windows 10 - Windows Server 2016 +- Windows Server 2019 ## Enable Windows Defender Credential Guard @@ -134,8 +135,7 @@ DG_Readiness_Tool_v3.5.ps1 -Ready ``` > [!NOTE] - -For client machines that are running Windows 10 1703, LsaIso.exe is running whenever virtualization-based security is enabled for other features. +> For client machines that are running Windows 10 1703, LsaIso.exe is running whenever virtualization-based security is enabled for other features. - We recommend enabling Windows Defender Credential Guard before a device is joined to a domain. If Windows Defender Credential Guard is enabled after domain join, the user and device secrets may already be compromised. In other words, enabling Credential Guard will not help to secure a device or identity that has already been compromised, which is why we recommend turning on Credential Guard as early as possible. @@ -157,13 +157,14 @@ To disable Windows Defender Credential Guard, you can use the following set of p 1. If you used Group Policy, disable the Group Policy setting that you used to enable Windows Defender Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**). 2. Delete the following registry settings: - HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA\LsaCfgFlags + - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\LsaCfgFlags +3. If you also wish to disable virtualization-based security delete the following registry settings: - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\EnableVirtualizationBasedSecurity - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\RequirePlatformSecurityFeatures - > [!IMPORTANT] > If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery. -3. Delete the Windows Defender Credential Guard EFI variables by using bcdedit. From an elevated command prompt, type the following commands: +4. Delete the Windows Defender Credential Guard EFI variables by using bcdedit. From an elevated command prompt, type the following commands: ``` syntax mountvol X: /s @@ -171,18 +172,20 @@ To disable Windows Defender Credential Guard, you can use the following set of p bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi" bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215} - bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS + bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X: - bcdedit /set hypervisorlaunchtype off mountvol X: /d ``` -2. Restart the PC. -3. Accept the prompt to disable Windows Defender Credential Guard. -4. Alternatively, you can disable the virtualization-based security features to turn off Windows Defender Credential Guard. +5. Restart the PC. +6. Accept the prompt to disable Windows Defender Credential Guard. +7. Alternatively, you can disable the virtualization-based security features to turn off Windows Defender Credential Guard. > [!NOTE] -> The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Windows Defender Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS +> The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Windows Defender Credential Guard and virtualization-based security, run the following bcdedit commands after turning off all virtualization-based security Group Policy and registry settings: + + bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS + bcdedit /set vsmlaunchtype off > [!NOTE] > Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. These options will be made available with future Gen 2 VMs. diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index f1d2d6408b..01b67c4951 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -252,7 +252,7 @@ Contains numeric value ranging from 0 to 100 to represent the wireless network's ### Next Steps ### -Follow the Windows Hello for Business hybrid certificate trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Basline**. +Follow the Windows Hello for Business hybrid certificate trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Baseline**. If your environment is already federated, but does not include Azure device registration, choose **Configure Azure Device Registration**. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md index f8613819f5..c622ab65bb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -37,10 +37,10 @@ This baseline provides detailed procedures to move your environment from an on-p ## Federated Baseline ## The federated baseline helps organizations that have completed their federation with Azure Active Directory and Office 365 and enables them to introduce Windows Hello for Business into their hybrid environment. This baseline exclusively focuses on the procedures needed to add Azure Device Registration and Windows Hello for Business to an existing hybrid deployment. -Regardless of the baseline you choose, you’re next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. +Regardless of the baseline you choose, your next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. > [!div class="nextstepaction"] -> [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +> [Prerequisites](hello-hybrid-cert-trust-prereqs.md) @@ -48,7 +48,7 @@ Regardless of the baseline you choose, you’re next step is to familiarize your ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. Overview (*You are here*) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Device Registration](hello-hybrid-cert-trust-devreg.md) 5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index e295b98d48..22b4bd30cd 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -18,7 +18,7 @@ ms.date: 08/19/2018 # Hybrid Windows Hello for Business Provisioning **Applies to** -- Windows 10, version 1703 or later +- Windows 10, version 1703 or later - Hybrid deployment - Certificate trust @@ -55,17 +55,17 @@ The remainder of the provisioning includes Windows Hello for Business requesting > The following is the enrollment behavior prior to Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). > The minimum time needed to synchronize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. The Azure AD Connect scheduler controls the synchronization interval. -> **This synchronization latency delays the user's ability to authenticate and use on-premises resouces until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. +> **This synchronization latency delays the user's ability to authenticate and use on-premises resources until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. > Read [Azure AD Connect sync: Scheduler](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler) to view and adjust the **synchronization cycle** for your organization. > [!NOTE] -> Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889) provides synchronous certificate enrollment during hybrid certificate trust provisioning. With this update, users no longer need to wait for Azure AD Connect to sync their public key on-premises. Users enroll their certificate during provisioning and can use the certificate for sign-in immediately after completeling the provisioning. The update needs to be installed on the federation servers. +> Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889) provides synchronous certificate enrollment during hybrid certificate trust provisioning. With this update, users no longer need to wait for Azure AD Connect to sync their public key on-premises. Users enroll their certificate during provisioning and can use the certificate for sign-in immediately after completing the provisioning. The update needs to be installed on the federation servers. After a successful key registration, Windows creates a certificate request using the same key pair to request a certificate. Windows send the certificate request to the AD FS server for certificate enrollment. The AD FS registration authority verifies the key used in the certificate request matches the key that was previously registered. On a successful match, the AD FS registration authority signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. -The certificate authority validates the certificate was signed by the registration authority. On successful validation of the signature, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user’s certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user they can use their PIN to sign-in through the Windows Action Center. +The certificate authority validates the certificate was signed by the registration authority. On successful validation of the signature, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user’s certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user that they can use their PIN to sign-in through the Windows Action Center. @@ -73,9 +73,9 @@ The certificate authority validates the certificate was signed by the registrati ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. [Configure Windows Hello for Business policy settings](hello-hybrid-cert-whfb-settings-policy.md) -6. Sign-in and Provision(*You are here*) +6. Sign-in and Provision (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md index 005677d027..949ab5c623 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md @@ -74,7 +74,7 @@ Sign-in a domain controller or management workstation with *Domain Admin* equiva ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings: Active Directory (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index 5784150435..026d6bff2c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -73,7 +73,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings: AD FS (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index 9333aeef18..26da9ec608 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -79,7 +79,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings: Directory Synchronization (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 59da54619d..0e8e0b0ee3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -203,7 +203,7 @@ Sign-in to the certificate authority or management workstation with _Enterprise ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings: PKI (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md index 621cb9ab0b..c62c048027 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -197,7 +197,7 @@ Users must receive the Windows Hello for Business group policy settings and have ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business policy settings (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md index 3d78b7a719..f127c06ae9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md @@ -23,7 +23,7 @@ ms.date: 08/19/2018 - Certificate trust -You're environment is federated and you are ready to configure your hybrid environment for Windows Hello for business using the certificate trust model. +Your environment is federated and you are ready to configure your hybrid environment for Windows Hello for business using the certificate trust model. > [!IMPORTANT] > If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment. @@ -44,7 +44,7 @@ For the most efficient deployment, configure these technologies in order beginni ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md index d9874f88c3..4a4a80eced 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -80,7 +80,7 @@ If you do not have an existing public key infrastructure, please review [Certifi > [!IMPORTANT] > For Azure AD joined device to authenticate to and use on-premises resources, ensure you: > * Install the root certificate authority certificate for your organization in the user's trusted root certificate store. -> * Publish your certificate revocation list to a location that is available to Azure AD joined devices, such as a web-based url. +> * Publish your certificate revocation list to a location that is available to Azure AD joined devices, such as a web-based URL. ### Section Review ### @@ -124,7 +124,7 @@ If your organization uses Azure MFA on a per-consumption model (no licenses), th Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. #### Azure MFA User States #### -After you have completed configuring your Azure MFA settings, you want to review configure [User States](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. +After you have completed configuring your Azure MFA settings, you want to review configure [User States](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. ### Azure MFA via ADFS ### Alternatively, you can configure Windows Server 2016 Active Directory Federation Services (AD FS) to provide additional multi-factor authentication. To configure, read the [Configure AD FS 2016 and Azure MFA](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-ad-fs-2016-and-azure-mfa) section. @@ -135,7 +135,7 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation > * Review the overview and uses of Azure Multifactor Authentication. > * Review your Azure Active Directory subscription for Azure Multifactor Authentication. > * Create an Azure Multifactor Authentication Provider, if necessary. -> * Configure Azure Multifactor Authentiation features and settings. +> * Configure Azure Multifactor Authentication features and settings. > * Understand the different User States and their effect on Azure Multifactor Authentication. > * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server Active Directory Federation Services, if necessary. @@ -148,7 +148,7 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-key-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. New Installation Baseline (*You are here*) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index 9a49d7ab15..f7ec72d697 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -38,7 +38,7 @@ Begin configuring device registration to support Hybrid Windows Hello for Busine To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-setup/) -Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup) page. In the **Configuration steps** section, identify you configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a check mark. +Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup) page. In the **Configuration steps** section, identify your configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a check mark. @@ -47,7 +47,7 @@ Next, follow the guidance on the [How to configure hybrid Azure Active Directory ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. Configure Azure Device Registration (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md index 2c4dc3093c..617e922f94 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md @@ -26,7 +26,7 @@ ms.date: 08/19/2018 You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises. ## Deploy Azure AD Connect -Next, you need to synchronizes the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771). +Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771). > [!NOTE] @@ -38,7 +38,7 @@ Next, you need to synchronizes the on-premises Active Directory with Azure Activ ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-key-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. Configure Directory Synchronization (*You are here*) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index f59a78c750..dd447eb2b1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -27,7 +27,7 @@ Hybrid environments are distributed systems that enable organizations to use on- The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include: * [Directories](#directories) -* [Public Key Infrastucture](#public-key-infastructure) +* [Public Key Infrastructure](#public-key-infastructure) * [Directory Synchronization](#directory-synchronization) * [Federation](#federation) * [MultiFactor Authentication](#multifactor-authentication) @@ -85,7 +85,7 @@ Organizations using older directory synchronization technology, such as DirSync ## Federation with Azure ## -You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later. +You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) beginning with Windows Server 2012 R2. ### Section Review ### > [!div class="checklist"] @@ -97,7 +97,7 @@ You can deploy Windows Hello for Business key trust in non-federated and federat ## Multifactor Authentication ## Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their user name and password as one factor, but needs a second factor of authentication. -Hybrid Windows Hello for Business deployments can use Azure’s Multi-factor Authentication service or they can use multi-factor authentication provides by Windows Server 2012 R2 or later Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multi-factor authentication into AD FS. +Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication (MFA) service or they can use multifactor authentication provided by AD FS beginning with Windows Server 2012 R2, which includes an adapter model that enables third parties to integrate their MFA into AD FS. The MFA enabled by an Office 365 license is sufficient for Azure AD. ### Section Review > [!div class="checklist"] @@ -118,9 +118,9 @@ Organizations wanting to deploy hybrid key trust need their domain joined device ### Next Steps ### -Follow the Windows Hello for Business hybrid key trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Basline**. +Follow the Windows Hello for Business hybrid key trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Baseline**. -For environments transitioning from on-premises to hybrid, start with **Configure Azure Directory Syncrhonization**. +For environments transitioning from on-premises to hybrid, start with **Configure Azure Directory Synchronization**. For federated and non-federated environments, start with **Configure Windows Hello for Business settings**. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md index 303b6ce403..129be903cb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md @@ -34,10 +34,10 @@ The new deployment baseline helps organizations who are moving to Azure and Offi This baseline provides detailed procedures to move your environment from an on-premises only environment to a hybrid environment using Windows Hello for Business to authenticate to Azure Active Directory and to your on-premises Active Directory using a single Windows sign-in. -You’re next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. +Your next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. > [!div class="nextstepaction"] -> [Prerequistes](hello-hybrid-key-trust-prereqs.md) +> [Prerequisites](hello-hybrid-key-trust-prereqs.md) @@ -45,7 +45,7 @@ You’re next step is to familiarize yourself with the prerequisites needed for ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. Overview (*You are here*) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md index ce9f57fac1..7408c60b57 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -58,7 +58,7 @@ Sign-in a domain controller or management workstation with *Domain Admin* equiva ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md index 3f6e263084..d8aa1c79aa 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -55,7 +55,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index 92f7ec3365..aca13f5300 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -168,7 +168,7 @@ Users must receive the Windows Hello for Business group policy settings and have ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index 5aaee3a860..f7b76f34e8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -45,7 +45,7 @@ For the most efficient deployment, configure these technologies in order beginni ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 1700566e52..996e8121b8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -77,7 +77,7 @@ A deployment's trust type defines how each Windows Hello for Business client aut The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during the built-in provisioning experience. This requires an adequate distribution of Windows Server 2016 domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. -The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers. Users can authenticate using their certificate to any Windows Server 2008 R2 or later domain controller. +The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires [Windows Server 2016 Active Directory schema](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs#directories)). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller. #### Device registration @@ -101,7 +101,6 @@ Cloud only and hybrid deployments provide many choices for multi-factor authenti > * Azure Active Directory Premium > * Enterprise Mobility Suite > * Enterprise Cloud Suite ->* A per-user and per-authentication consumption-based model that is billed monthly against Azure monetary commitment (Read [Multi-Factor Authentication Pricing](https://azure.microsoft.com/pricing/details/multi-factor-authentication/) for more information) #### Directory synchronization @@ -136,7 +135,7 @@ The Windows Hello for Business deployment depends on an enterprise public key in ### Cloud -Some deployment combinations require an Azure account and some require Azure Active Directory for user identities. These cloud requirements may only need an Azure account while other features need an Azure Active Directory Premium subscription. The planning process identifies and differentiates the components that are needed from the those that are optional. +Some deployment combinations require an Azure account, and some require Azure Active Directory for user identities. These cloud requirements may only need an Azure account while other features need an Azure Active Directory Premium subscription. The planning process identifies and differentiates the components that are needed from the those that are optional. ## Planning a Deployment @@ -150,13 +149,13 @@ Choose the deployment model based on the resources your users access. Use the f If your organization does not have on-premises resources, write **Cloud Only** in box **1a** on your planning worksheet. -If your organization is federated with Azure or uses any online service, such as Office365 or OneDrive, or your users access cloud and on-premises resources, write **Hybrid** in box **1a** on your planning worksheet. +If your organization is federated with Azure or uses any online service, such as Office365 or OneDrive, or your users' access cloud and on-premises resources, write **Hybrid** in box **1a** on your planning worksheet. If your organization does not have cloud resources, write **On-Premises** in box **1a** on your planning worksheet. >[!NOTE] >If you’re unsure if your organization is federated, run the following Active Directory Windows PowerShell command from an elevated Windows PowerShell prompt and evaluate the results. >```Get-AdObject “CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=[forest_root_CN_name],DC=com" -Properties keywords``` ->* If the command returns an error stating it could not find the object, then you have yet to configured AAD Connect or on-premises Device Registration Services using AD FS. Ensure the name is accurate and validate the object does not exist with another Active Directory Management tool such as **ADSIEdit.msc**. If the object truly does not exist, then you environment does not bind you to a specific deployment or require changes to accommodate the desired deployment type. +>* If the command returns an error stating it could not find the object, then you have yet to configured AAD Connect or on-premises Device Registration Services using AD FS. Ensure the name is accurate and validate the object does not exist with another Active Directory Management tool such as **ADSIEdit.msc**. If the object truly does not exist, then your environment does not bind you to a specific deployment or require changes to accommodate the desired deployment type. >* If the command returns a value, compare that value with the values below. The value indicates the deployment model you should implement > * If the value begins with **azureADName:** – write **Hybrid** in box **1a**on your planning worksheet. > * If the value begins with **enterpriseDrsName:** – write **On-Premises** in box **1a** on your planning worksheet. @@ -197,7 +196,7 @@ If box **1a** on your planning worksheet reads **cloud only**, write **N/A** in If box **1a** on your planning worksheet reads **hybrid**, then write **Azure AD Connect** in box **1e** on your planning worksheet. -If box **1a** on your planning worksheet reads **on-premises**, then write **Azure MFA Server**. This deployment exclusively uses Active Directory for user information with the exception of the multi-factor authentication. The on-premises Azure MFA server synchronizes a subset of the user information, such as phone number, to provide multi-factor authentication while the user’s credential remain on the on-premises network. +If box **1a** on your planning worksheet reads **on-premises**, then write **Azure MFA Server**. This deployment exclusively uses Active Directory for user information with the exception of the multi-factor authentication. The on-premises Azure MFA server synchronizes a subset of the user information, such as phone number, to provide multi-factor authentication while the user’s credentials remain on the on-premises network. ### Multifactor Authentication @@ -274,7 +273,7 @@ Public key infrastructure prerequisites already exist in your planning worksheet If box **1a** on your planning worksheet reads **cloud only**, ignore the public key infrastructure section of your planning worksheet. Cloud only deployments do not use a public key infrastructure. -If box **1b** on your planning worksheet reads **key trust**, write **N/A** in box **5b** on your planning worksheet. +If box **1b** on your planning worksheet reads **key trust**, write **N/A** in box **5b** on your planning worksheet. Key trust doesn't require any change in public key infrastructure, skip this part and go to **Cloud** section. The registration authority only relates to certificate trust deployments and the management used for domain and non-domain joined devices. Hybrid Azure AD joined devices managed by Group Policy need the Windows Server 2016 AD FS role to issue certificates. Hybrid Azure AD joined devices and Azure AD joined devices managed by Intune or a compatible MDM need the Windows Server NDES server role to issue certificates. diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md index c9ba5464a6..9ea0ddd3dc 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md +++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md @@ -529,7 +529,7 @@ Disable-BitLocker -MountPoint E:,F:,G: ``` ## See also -- [Prepare your organization for BitLocker: Planning and p\\olicies](prepare-your-organization-for-bitlocker-planning-and-policies.md) +- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) - [BitLocker recovery guide](bitlocker-recovery-guide-plan.md) - [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) - [BitLocker overview](bitlocker-overview.md) diff --git a/windows/security/information-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md index 3f858bbcb9..263963d4db 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-overview.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md @@ -19,7 +19,7 @@ ms.date: 11/29/2018 # Trusted Platform Module Technology Overview **Applies to** -- Windows 10 +- Windows 10 - Windows Server 2016 - Windows Server 2019 @@ -53,13 +53,13 @@ Certificates can be installed or created on computers that are using the TPM. Af Automated provisioning in the TPM reduces the cost of TPM deployment in an enterprise. New APIs for TPM management can determine if TPM provisioning actions require physical presence of a service technician to approve TPM state change requests during the boot process. -Antimalware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10 or Windows Server 2016. These measurements include the launch of Hyper-V to test that datacenters using virtualization are not running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry. +Antimalware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10 or Windows Server 2016. These measurements include the launch of Hyper-V to test that datacenters using virtualization are not running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry. The TPM has several Group Policy settings that might be useful in certain enterprise scenarios. For more info, see [TPM Group Policy Settings](trusted-platform-module-services-group-policy-settings.md). ## New and changed functionality -For more info on new and changed functionality for Trusted Platform Module in Windows 10, see [What's new in Trusted Platform Module?](https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511#trusted-platform-module). +For more info on new and changed functionality for Trusted Platform Module in Windows 10, see [What's new in Trusted Platform Module?](https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511#trusted-platform-module). ## Device health attestation @@ -78,7 +78,7 @@ Some things that you can check on the device are: ## Supported versions for device health attestation -| TPM version | Windows 10 | Windows Server 2016 | Windows Server 2019 | +| TPM version | Windows 10 | Windows Server 2016 | Windows Server 2019 | |-------------|-------------|---------------------|---------------------| | TPM 1.2 | >= ver 1607 | >= ver 1607 | Yes | | TPM 2.0 | Yes | Yes | Yes | @@ -87,5 +87,12 @@ Some things that you can check on the device are: ## Related topics - [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) -- [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule) -- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations) +- [Details on the TPM standard](https://www.microsoft.com/en-us/research/project/the-trusted-platform-module-tpm/) (has links to features using TPM) +- [TPM Base Services Portal](https://docs.microsoft.com/en-us/windows/desktop/TBS/tpm-base-services-portal) +- [TPM Base Services API](https://docs.microsoft.com/en-us/windows/desktop/api/_tbs/) +- [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations) +- [Azure device provisioning: Identity attestation with TPM](https://azure.microsoft.com/en-us/blog/device-provisioning-identity-attestation-with-tpm/) +- [Azure device provisioning: A manufacturing timeline for TPM devices](https://azure.microsoft.com/en-us/blog/device-provisioning-a-manufacturing-timeline-for-tpm-devices/) +- [Windows 10: Enabling vTPM (Virtual TPM)](https://social.technet.microsoft.com/wiki/contents/articles/34431.windows-10-enabling-vtpm-virtual-tpm.aspx) +- [How to Multiboot with Bitlocker, TPM, and a Non-Windows OS](https://social.technet.microsoft.com/wiki/contents/articles/9528.how-to-multiboot-with-bitlocker-tpm-and-a-non-windows-os.aspx) \ No newline at end of file diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 2a82682a3c..33ced2e6e3 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -11,7 +11,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/29/2019 +ms.date: 05/13/2019 --- # Create a Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune @@ -21,7 +21,7 @@ ms.date: 04/29/2019 - Windows 10, version 1607 and later - Windows 10 Mobile, version 1607 and later (except Microsoft Azure Rights Management, which is only available on the desktop) -Microsoft Intune has an easy way to create and deploy a Windows Information Protection (WIP) policy. You can choose which apps to protect, the level of protection, and how to find enterprise data on the network. The devices can be fully managed by Mobile Device Management (MDM), or managed by Mobile Application Management (MAM), where Intune only manages the apps on a user's personal device. +Microsoft Intune has an easy way to create and deploy a Windows Information Protection (WIP) policy. You can choose which apps to protect, the level of protection, and how to find enterprise data on the network. The devices can be fully managed by Mobile Device Management (MDM), or managed by Mobile Application Management (MAM), where Intune manages only the apps on a user's personal device. ## Differences between MDM and MAM for WIP @@ -39,7 +39,7 @@ You can create an app protection policy in Intune either with device enrollment ## Prerequisites -Before you can create a WIP policy using Intune, you need to configure an MDM or MAM provider in Azure Active Directory (Azure AD). MAM requires an [Azure Active Direcory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery depends on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. +Before you can create a WIP policy using Intune, you need to configure an MDM or MAM provider in Azure Active Directory (Azure AD). MAM requires an [Azure Active Direcory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery relies on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. ## Configure the MDM or MAM provider @@ -98,7 +98,7 @@ Select **Store apps**, type the app product name and publisher, and click **OK**  -To add multiple Store apps, click the elipsis **…**. +To add multiple Store apps, click the ellipsis **…**. If you don't know the Store app publisher or product name, you can find them by following these steps. @@ -187,7 +187,7 @@ To add **Desktop apps**, complete the following fields, based on what results yo |
Windows Defender ATP
Microsoft Defender ATP
 Threat & Vulnerability Management |
@@ -40,19 +37,19 @@ ms.localizationpriority: medium
-**[Threat & Vulnerability Management](windows-defender-atp/next-gen-threat-and-vuln-mgt.md)**Browse to the location of the *wdatp-connector.properties* file. The name must match the file provided in the .zip that you downloaded. | |||||
| Refresh Token | -You can obtain a refresh token in two ways: by generating a refresh token from the **SIEM settings** page or using the restutil tool. For more information on generating a refresh token from the **Preferences setup** , see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md). **Get your refresh token using the restutil tool:** a. Open a command prompt. Navigate to C:\\*folder_location*\current\bin where *folder_location* represents the location where you installed the tool. b. Type: `arcsight restutil token -config` from the bin directory.For example: **arcsight restutil boxtoken -proxy proxy.location.hp.com:8080** A Web browser window will open. c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials. d. A refresh token is shown in the command prompt. e. Copy and paste it into the **Refresh Token** field. + | You can obtain a refresh token in two ways: by generating a refresh token from the **SIEM settings** page or using the restutil tool. For more information on generating a refresh token from the **Preferences setup** , see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md). **Get your refresh token using the restutil tool:** a. Open a command prompt. Navigate to C:\\*folder_location*\current\bin where *folder_location* represents the location where you installed the tool. b. Type: `arcsight restutil token -config` from the bin directory.For example: **arcsight restutil boxtoken -proxy proxy.location.hp.com:8080** A Web browser window will open. c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials. d. A refresh token is shown in the command prompt. e. Copy and paste it into the **Refresh Token** field. |
||||
| Polling Interval | -Number of seconds that Splunk will ping the Windows Defender ATP machine. Accepted values are in seconds. | +Number of seconds that Splunk will ping the Microsoft Defender ATP machine. Accepted values are in seconds. | ||||
| Set sourcetype | @@ -146,8 +146,8 @@ Use the solution explorer to view alerts in Splunk. >```source="rest://windows atp alerts" | spath | dedup _raw | table *``` ## Related topics -- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md) -- [Configure ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) -- [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) -- [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) -- [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md) +- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) +- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) +- [Microsoft Defender ATP alert API fields](api-portal-mapping.md) +- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) +- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md similarity index 82% rename from windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md rename to windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md index e6a5f47f96..c100b9ddf2 100644 --- a/windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md @@ -14,18 +14,19 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article - --- -# Create alert from event API -**Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +# Create alert from event API +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Enables using event data, as obtained from the [Advanced Hunting](run-advanced-query-api.md) for creating a new alert entity. ## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) + +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) Permission type | Permission | Permission display name :---|:---|:--- @@ -34,10 +35,11 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' >[!Note] > When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'Alerts investigation' (See [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) for more information) ->- The user needs to have access to the machine associated with the alert, based on machine group settings (See [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) for more information) +>- The user needs to have at least the following role permission: 'Alerts investigation' (See [Create and manage roles](user-roles.md) for more information) +>- The user needs to have access to the machine associated with the alert, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information) ## HTTP request + ``` POST https://api.securitycenter.windows.com/api/alerts/CreateAlertByReference ``` @@ -50,6 +52,7 @@ Authorization | String | Bearer {token}. **Required**. Content-Type | String | application/json. **Required**. ## Request body + In the request body, supply the following values (all are required): Property | Type | Description @@ -63,10 +66,9 @@ eventTime | DateTime(UTC) | The time of the event, as obtained from the advanced reportId | String | The reportId, as obtained from the advanced query. **Required**. category| String | Category of the alert. The property values are: 'None', 'SuspiciousActivity', 'Malware', 'CredentialTheft', 'Exploit', 'WebExploit', 'DocumentExploit', 'PrivilegeEscalation', 'Persistence', 'RemoteAccessTool', 'CommandAndControl', 'SuspiciousNetworkTraffic', 'Ransomware', 'MalwareDownload', 'Reconnaissance', 'WebFingerprinting', 'Weaponization', 'Delivery', 'SocialEngineering', 'CredentialStealing', 'Installation', 'Backdoor', 'Trojan', 'TrojanDownloader', 'LateralMovement', 'ExplorationEnumeration', 'NetworkPropagation', 'Exfiltration', 'NotApplicable', 'EnterprisePolicy' and 'General'. - ## Response -If successful, this method returns 200 OK, and a new [alert](alerts-windows-defender-advanced-threat-protection-new.md) object in the response body. If event with the specified properties (_reportId_, _eventTime_ and _machineId_) was not found - 404 Not Found. +If successful, this method returns 200 OK, and a new [alert](alerts.md) object in the response body. If event with the specified properties (_reportId_, _eventTime_ and _machineId_) was not found - 404 Not Found. ## Example @@ -74,7 +76,7 @@ If successful, this method returns 200 OK, and a new [alert](alerts-windows-defe Here is an example of the request. -[!include[Improve request performance](improverequestperformance-new.md)] +[!include[Improve request performance](improve-request-performance.md)] ``` POST https://api.securitycenter.windows.com/api/alerts/CreateAlertByReference @@ -89,5 +91,5 @@ Content-Length: application/json "eventTime": "2018-08-03T16:45:21.7115183Z", "reportId": "20776", "category": "None" -} +} ``` diff --git a/windows/security/threat-protection/windows-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md similarity index 89% rename from windows/security/threat-protection/windows-defender-atp/custom-detection-rules.md rename to windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index 4998ae8a80..bb24ba24f8 100644 --- a/windows/security/threat-protection/windows-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -1,5 +1,5 @@ --- -title: Create custom detection rules in Windows Defender ATP +title: Create custom detection rules in Microsoft Defender ATP description: Learn how to create custom detections rules based on advanced hunting queries keywords: create custom detections, detections, advanced hunting, hunt, detect, query search.product: eADQiWindows 10XVcnh @@ -20,7 +20,7 @@ ms.topic: article # Create custom detections rules **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) 1. In the navigation pane, select **Advanced hunting**. diff --git a/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/custom-ti-api.md similarity index 87% rename from windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/custom-ti-api.md index bc9982d2ae..d8c343030c 100644 --- a/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-ti-api.md @@ -1,6 +1,6 @@ --- title: Create custom alerts using the threat intelligence API -description: Create your custom alert definitions and indicators of compromise in Windows Defender ATP using the available APIs in Windows Enterprise, Education, and Pro editions. +description: Create your custom alert definitions and indicators of compromise in Microsoft Defender ATP using the available APIs in Windows Enterprise, Education, and Pro editions. keywords: alert definitions, indicators of compromise, threat intelligence, custom threat intelligence, rest api, api search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -15,24 +15,22 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- -# Create custom alerts using the threat intelligence (TI) application program interface (API) +# Create custom alerts using the threat intelligence (TI) application program interface (API) (Deprecated) **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-customti-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-customti-abovefoldlink) You can define custom alert definitions and indicators of compromise (IOC) using the threat intelligence API. Creating custom threat intelligence alerts allows you to generate specific alerts that are applicable to your organization. ## Before you begin -Before creating custom alerts, you'll need to enable the threat intelligence application in Azure Active Directory and generate access tokens. For more information, see [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md). +Before creating custom alerts, you'll need to enable the threat intelligence application in Azure Active Directory and generate access tokens. For more information, see [Enable the custom threat intelligence application](enable-custom-ti.md). ### Use the threat intelligence REST API to create custom threat intelligence alerts You can call and specify the resource URLs using one of the following operations to access and manipulate a threat intelligence resource: @@ -61,7 +59,7 @@ For this URL: Each tenant has a defined quota that limits the number of possible alert definitions, IOCs and another quota for IOCs of Action different than “equals” in the system. If you upload data beyond this quota, you'll encounter an HTTP error status code 507 (Insufficient Storage). ## Request an access token from the token issuing endpoint -Windows Defender ATP Threat Intelligence API uses OAuth 2.0. In the context of Windows Defender ATP, the alert definitions are a protected resource. To issue tokens for ad-hoc, non-automatic operations you can use the **Settings** page and click the **Generate Token** button. However, if you’d like to create an automated client, you need to use the “Client Credentials Grant” flow. For more information, see the [OAuth 2.0 authorization framework](https://tools.ietf.org/html/rfc6749#section-4.4). +Microsoft Defender ATP Threat Intelligence API uses OAuth 2.0. In the context of Microsoft Defender ATP, the alert definitions are a protected resource. To issue tokens for ad-hoc, non-automatic operations you can use the **Settings** page and click the **Generate Token** button. However, if you’d like to create an automated client, you need to use the “Client Credentials Grant” flow. For more information, see the [OAuth 2.0 authorization framework](https://tools.ietf.org/html/rfc6749#section-4.4). For more information about the authorization flow, see [OAuth 2.0 authorization flow](https://docs.microsoft.com/azure/active-directory/develop/active-directory-protocols-oauth-code#oauth-20-authorization-flow). @@ -71,7 +69,7 @@ Make an HTTP POST request to the token issuing endpoint with the following param > The authorization server URL is `https://login.windows.net/||||||
| 1 | -Windows Defender Advanced Threat Protection service started (Version ```variable```). | +Microsoft Defender Advanced Threat Protection service started (Version ```variable```). | Occurs during system start up, shut down, and during onbboarding. | Normal operating notification; no action required. | ||
| 2 | -Windows Defender Advanced Threat Protection service shutdown. | +Microsoft Defender Advanced Threat Protection service shutdown. | Occurs when the machine is shut down or offboarded. | Normal operating notification; no action required. | ||
| 3 | -Windows Defender Advanced Threat Protection service failed to start. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection service failed to start. Failure code: ```variable```. | Service did not start. | Review other messages to determine possible cause and troubleshooting steps. | ||
| 4 | -Windows Defender Advanced Threat Protection service contacted the server at ```variable```. | -Variable = URL of the Windows Defender ATP processing servers. + | Microsoft Defender Advanced Threat Protection service contacted the server at ```variable```. | +Variable = URL of the Microsoft Defender ATP processing servers. This URL will match that seen in the Firewall or network activity. |
Normal operating notification; no action required. | |
| 5 | -Windows Defender Advanced Threat Protection service failed to connect to the server at ```variable```. | -Variable = URL of the Windows Defender ATP processing servers. + | Microsoft Defender Advanced Threat Protection service failed to connect to the server at ```variable```. | +Variable = URL of the Microsoft Defender ATP processing servers. The service could not contact the external processing servers at that URL. |
-Check the connection to the URL. See [Configure proxy and Internet connectivity](configure-proxy-internet-windows-defender-advanced-threat-protection.md). | +Check the connection to the URL. See [Configure proxy and Internet connectivity](configure-proxy-internet.md). |
| 6 | -Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. | +Microsoft Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. | The machine did not onboard correctly and will not be reporting to the portal. | Onboarding must be run before starting the service. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). |
+See [Onboard Windows 10 machines](configure-endpoints.md).
||
| 7 | -Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure: ```variable```. | +Microsoft Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure: ```variable```. | Variable = detailed error description. The machine did not onboard correctly and will not be reporting to the portal. | Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). |
+See [Onboard Windows 10 machines](configure-endpoints.md).
||
| 8 | -Windows Defender Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```. | **During onboarding:** The service failed to clean its configuration during the onboarding. The onboarding process continues. **During offboarding:** The service failed to clean its configuration during the offboarding. The offboarding process finished but the service keeps running. |
**Onboarding:** No action required. **Offboarding:** Reboot the system. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). |
+See [Onboard Windows 10 machines](configure-endpoints.md).
||
| 9 | -Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection service failed to change its start type. Failure code: ```variable```. | **During onboarding:** The machine did not onboard correctly and will not be reporting to the portal. **During offboarding:** Failed to change the service start type. The offboarding process continues. |
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). |
+See [Onboard Windows 10 machines](configure-endpoints.md).
||
| 10 | -Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```. | The machine did not onboard correctly and will not be reporting to the portal. | Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). |
+See [Onboard Windows 10 machines](configure-endpoints.md).
||
| 11 | -Onboarding or re-onboarding of Windows Defender Advanced Threat Protection service completed. | +Onboarding or re-onboarding of Microsoft Defender Advanced Threat Protection service completed. | The machine onboarded correctly. | Normal operating notification; no action required. It may take several hours for the machine to appear in the portal. |
||
| 12 | -Windows Defender Advanced Threat Protection failed to apply the default configuration. | +Microsoft Defender Advanced Threat Protection failed to apply the default configuration. | Service was unable to apply the default configuration. | This error should resolve after a short period of time. | ||
| 13 | -Windows Defender Advanced Threat Protection machine ID calculated: ```variable```. | +Microsoft Defender Advanced Threat Protection machine ID calculated: ```variable```. | Normal operating process. | Normal operating notification; no action required. | ||
| 15 | -Windows Defender Advanced Threat Protection cannot start command channel with URL: ```variable```. | -Variable = URL of the Windows Defender ATP processing servers. + | Microsoft Defender Advanced Threat Protection cannot start command channel with URL: ```variable```. | +Variable = URL of the Microsoft Defender ATP processing servers. The service could not contact the external processing servers at that URL. |
-Check the connection to the URL. See [Configure proxy and Internet connectivity](configure-proxy-internet-windows-defender-advanced-threat-protection.md). | +Check the connection to the URL. See [Configure proxy and Internet connectivity](configure-proxy-internet.md). |
| 17 | -Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```. | An error occurred with the Windows telemetry service. | -[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostics-service-is-enabled). + | [Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-the-diagnostics-service-is-enabled). Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). |
+See [Onboard Windows 10 machines](configure-endpoints.md).
|
| 18 | @@ -182,35 +182,35 @@ If this error persists after a system restart, ensure all Windows updates have f||||||
| 25 | -Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: ```variable```. | The machine did not onboard correctly. It will report to the portal, however the service may not appear as registered in SCCM or the registry. | Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). |
+See [Onboard Windows 10 machines](configure-endpoints.md).
||
| 26 | -Windows Defender Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```. | The machine did not onboard correctly. It will report to the portal, however the service may not appear as registered in SCCM or the registry. |
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). |
+See [Onboard Windows 10 machines](configure-endpoints.md).
||
| 27 | -Windows Defender Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender Antivirus. Onboarding process failed. Failure code: ```variable```. | -Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the machine, and the machine is reporting to Windows Defender ATP. | +Microsoft Defender Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender Antivirus. Onboarding process failed. Failure code: ```variable```. | +Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the machine, and the machine is reporting to Microsoft Defender ATP. | Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). +See [Onboard Windows 10 machines](configure-endpoints.md). Ensure real-time antimalware protection is running properly. |
|
| 28 | -Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```. | An error occurred with the Windows telemetry service. | -[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostic-data-service-is-enabled). + | [Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-the-diagnostic-data-service-is-enabled). Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). |
+See [Onboard Windows 10 machines](configure-endpoints.md).
|
| 29 | @@ -220,97 +220,97 @@ See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-||||||
| 30 | -Windows Defender Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender Antivirus. Failure code: ```variable```. | -Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the machine, and the machine is reporting to Windows Defender ATP. | +Microsoft Defender Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender Antivirus. Failure code: ```variable```. | +Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the machine, and the machine is reporting to Microsoft Defender ATP. | Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) +See [Onboard Windows 10 machines](configure-endpoints.md) Ensure real-time antimalware protection is running properly. |
|
| 31 | -Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```. | An error occurred with the Windows telemetry service during onboarding. The offboarding process continues. | -[Check for errors with the Windows telemetry service](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostic-data-service-is-enabled). | +[Check for errors with the Windows telemetry service](troubleshoot-onboarding.md#ensure-the-diagnostic-data-service-is-enabled). | |
| 32 | -Windows Defender Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: %1 | +Microsoft Defender Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: %1 | An error occurred during offboarding. | Reboot the machine. | ||
| 33 | -Windows Defender Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```. | A unique identifier is used to represent each machine that is reporting to the portal. If the identifier does not persist, the same machine might appear twice in the portal. |
Check registry permissions on the machine to ensure the service can update the registry. | ||
| 34 | -Windows Defender Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```. | An error occurred with the Windows telemetry service. | -[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostic-data-service-is-enabled). + | [Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-the-diagnostic-data-service-is-enabled). Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). |
+See [Onboard Windows 10 machines](configure-endpoints.md).
|
| 35 | -Windows Defender Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```. | +Microsoft Defender Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```. | An error occurred with the Windows telemetry service during offboarding. The offboarding process continues. | Check for errors with the Windows diagnostic data service. | ||
| 36 | -Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration succeeded. Completion code: ```variable```. | -Registering Windows Defender Advanced Threat Protection with the Connected User Experiences and Telemetry service completed successfully. | +Microsoft Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration succeeded. Completion code: ```variable```. | +Registering Microsoft Defender Advanced Threat Protection with the Connected User Experiences and Telemetry service completed successfully. | Normal operating notification; no action required. | |
| 37 | -Windows Defender Advanced Threat Protection A module is about to exceed its quota. Module: %1, Quota: {%2} {%3}, Percentage of quota utilization: %4. | +Microsoft Defender Advanced Threat Protection A module is about to exceed its quota. Module: %1, Quota: {%2} {%3}, Percentage of quota utilization: %4. | The machine has almost used its allocated quota of the current 24-hour window. It’s about to be throttled. | Normal operating notification; no action required. | ||
| 38 | -Network connection is identified as low. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4. | +Network connection is identified as low. Microsoft Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4. | The machine is using a metered/paid network and will be contacting the server less frequently. | Normal operating notification; no action required. | ||
| 39 | -Network connection is identified as normal. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4. | +Network connection is identified as normal. Microsoft Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4. | The machine is not using a metered/paid connection and will contact the server as usual. | Normal operating notification; no action required. | ||
| 40 | -Battery state is identified as low. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2. | +Battery state is identified as low. Microsoft Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2. | The machine has low battery level and will contact the server less frequently. | Normal operating notification; no action required. | ||
| 41 | -Battery state is identified as normal. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2. | +Battery state is identified as normal. Microsoft Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2. | The machine doesn’t have low battery level and will contact the server as usual. | Normal operating notification; no action required. | ||
| 42 | -Windows Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception message: %4 | +Microsoft Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception message: %4 | Internal error. The service failed to start. | If this error persists, contact Support. | ||
| 43 | -Windows Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception Error: %4, Exception message: %5 | +Microsoft Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception Error: %4, Exception message: %5 | Internal error. The service failed to start. | If this error persists, contact Support. | ||
| 44 | -Offboarding of Windows Defender Advanced Threat Protection service completed. | +Offboarding of Microsoft Defender Advanced Threat Protection service completed. | The service was offboarded. | Normal operating notification; no action required. |
+Effectively identifying, assessing, and remediating endpoint weaknesses is pivotal in running a healthy security program and reducing organizational risk. This infrastructure correlates endpoint detection and response (EDR) insights with endpoint vulnerabilities real-time, thus reducing organizational vulnerability exposure and increasing threat resilience. + +**Attack surface reduction**
+The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations. + +**Next generation protection**
+To further reinforce the security perimeter of your network, Microsoft Defender ATP uses next generation protection designed to catch all types of emerging threats. + +**Endpoint detection and response**
+Endpoint detection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars. + +**Auto investigation and remediation**
+In conjunction with being able to quickly respond to advanced attacks, Microsoft Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale. + +**Secure score**
+Microsoft Defender ATP provides a security posture capability to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security state of your network. + +**Microsoft Threat Experts**
+Microsoft Threat Experts is the new managed threat hunting service in Microsoft Defender ATP that provides proactive hunting, prioritization, and additional context and insights that further empower security operations centers (SOCs) to identify and respond to threats quickly and accurately. It provides additional layer of expertise and optics that Microsoft customers can utilize to augment security operation capabilities as part of Microsoft 365. + +**Advanced hunting**
+Advanced hunting allows you to hunt for possible threats across your organization using a powerful search and query tool. You can also create custom detection rules based on the queries you created and surface alerts in Microsoft Defender Security Center. + +**Management and APIs**
+Integrate Microsoft Defender Advanced Threat Protection into your existing workflows. + +**Microsoft threat protection**
+Bring the power of Microsoft Threat Protection to your organization. + +## In this section +Topic | Description +:---|:--- +[Minimum requirements](minimum-requirements.md) | Learn about the requirements for onboarding machines to the platform. +[Validate licensing and complete setup](licensing.md) | Get guidance on how to check that licenses have been provisioned to your organization and how to access the portal for the first time. +[Preview features](preview.md) | Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience. +[Data storage and privacy](data-storage-privacy.md) | Explains the data storage and privacy details related to Microsoft Defender ATP. +[Assign user access to the portal](assign-portal-access.md) | Set permissions to manage who can access the portal. You can set basic permissions or set granular permissions using role-based access control (RBAC). +[Evaluate Microsoft Defender ATP](evaluate-atp.md) | Evaluate the various capabilities in Microsoft Defender ATP and test features out. +[Access the Microsoft Defender Security Center Community Center](community.md) | The Microsoft Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product. \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection.md similarity index 93% rename from windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md rename to windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection.md index d3469d7f53..34eaae8116 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection.md @@ -19,7 +19,7 @@ ms.topic: article # List Indicators API **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) >[!NOTE] @@ -43,7 +43,7 @@ Application | Ti.ReadWrite.All | 'Read and write All Indicators' GET https://api.securitycenter.windows.com/api/indicators ``` -[!include[Improve request performance](improverequestperformance-new.md)] +[!include[Improve request performance](improve-request-performance.md)] ## Request headers @@ -56,7 +56,7 @@ Authorization | String | Bearer {token}. **Required**. Empty ## Response -If successful, this method returns 200, Ok response code with a collection of [Indicator](ti-indicator-windows-defender-advanced-threat-protection-new.md) entities. +If successful, this method returns 200, Ok response code with a collection of [Indicator](ti-indicator.md) entities. >[!Note] > If the Application has 'Ti.ReadWrite.All' permission, it will be exposed to all Indicators. Otherwise, it will be exposed only to the Indicators it created. diff --git a/windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/microsoft-defender-atp/get-user-information.md similarity index 77% rename from windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md rename to windows/security/threat-protection/microsoft-defender-atp/get-user-information.md index 54be0763a9..3a09c868bb 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-user-information.md @@ -18,13 +18,13 @@ ms.topic: article # Get user information API **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieve a User entity by key (user name). ## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) Permission type | Permission | Permission display name :---|:---|:--- @@ -46,7 +46,7 @@ Authorization | String | Bearer {token}. **Required**. Empty ## Response -If successful and user exists - 200 OK with [user](user-windows-defender-advanced-threat-protection-new.md) entity in the body. If user does not exist - 404 Not Found. +If successful and user exists - 200 OK with [user](user.md) entity in the body. If user does not exist - 404 Not Found. ## Example @@ -55,7 +55,7 @@ If successful and user exists - 200 OK with [user](user-windows-defender-advance Here is an example of the request. -[!include[Improve request performance](improverequestperformance-new.md)] +[!include[Improve request performance](improve-request-performance.md)] ``` GET https://api.securitycenter.windows.com/api/users/user1 diff --git a/windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md similarity index 86% rename from windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md rename to windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md index e239d6ca71..2b5551a0bb 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md @@ -17,13 +17,15 @@ ms.topic: article --- # Get user related alerts API + **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves a collection of alerts related to a given user ID. ## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) Permission type | Permission | Permission display name :---|:---|:--- @@ -34,8 +36,8 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' >[!Note] > When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) for more information) ->- Response will include only alerts, associated with machines, that the user have access to, based on machine group settings (See [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) for more information) +>- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information) +>- Response will include only alerts, associated with machines, that the user have access to, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information) ## HTTP request ``` @@ -64,7 +66,7 @@ If successful and user exist - 200 OK. If the user do not exist - 404 Not Found. Here is an example of the request. -[!include[Improve request performance](improverequestperformance-new.md)] +[!include[Improve request performance](improve-request-performance.md)] ``` GET https://api.securitycenter.windows.com/api/users/user1/alerts diff --git a/windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md similarity index 84% rename from windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md rename to windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md index b137144be5..341c605bbb 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md @@ -17,13 +17,15 @@ ms.topic: article --- # Get user related machines API + **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves a collection of machines related to a given user ID. ## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) Permission type | Permission | Permission display name :---|:---|:--- @@ -34,8 +36,8 @@ Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine >[!Note] > When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) for more information) ->- Response will include only machines that the user can access, based on machine group settings (See [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) for more information) +>- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information) +>- Response will include only machines that the user can access, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information) ## HTTP request ``` @@ -56,7 +58,7 @@ Authorization | String | Bearer {token}. **Required**. Empty ## Response -If successful and user exists - 200 OK with list of [machine](machine-windows-defender-advanced-threat-protection-new.md) entities in the body. If user does not exist - 404 Not Found. +If successful and user exists - 200 OK with list of [machine](machine.md) entities in the body. If user does not exist - 404 Not Found. ## Example @@ -65,7 +67,7 @@ If successful and user exists - 200 OK with list of [machine](machine-windows-de Here is an example of the request. -[!include[Improve request performance](improverequestperformance-new.md)] +[!include[Improve request performance](improve-request-performance.md)] ``` GET https://api.securitycenter.windows.com/api/users/user1/machines diff --git a/windows/security/threat-protection/windows-defender-atp/images/1.png b/windows/security/threat-protection/microsoft-defender-atp/images/1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/1.png rename to windows/security/threat-protection/microsoft-defender-atp/images/1.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/AH_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/AH_icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/AH_icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/AH_icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/AR_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/AR_icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/AR_icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/AR_icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/ASR_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/ASR_icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/ASR_icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/ASR_icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/EDR_icon.jpg b/windows/security/threat-protection/microsoft-defender-atp/images/EDR_icon.jpg similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/EDR_icon.jpg rename to windows/security/threat-protection/microsoft-defender-atp/images/EDR_icon.jpg diff --git a/windows/security/threat-protection/windows-defender-atp/images/EDR_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/EDR_icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/EDR_icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/EDR_icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/Failed.png b/windows/security/threat-protection/microsoft-defender-atp/images/Failed.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/Failed.png rename to windows/security/threat-protection/microsoft-defender-atp/images/Failed.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/MTE_applicationconfirmation.png b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_applicationconfirmation.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/MTE_applicationconfirmation.png rename to windows/security/threat-protection/microsoft-defender-atp/images/MTE_applicationconfirmation.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/MTE_apply.png b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_apply.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/MTE_apply.png rename to windows/security/threat-protection/microsoft-defender-atp/images/MTE_apply.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/MTE_collaboratewithmte.png b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_collaboratewithmte.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/MTE_collaboratewithmte.png rename to windows/security/threat-protection/microsoft-defender-atp/images/MTE_collaboratewithmte.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/MTE_icon.jpg b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_icon.jpg similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/MTE_icon.jpg rename to windows/security/threat-protection/microsoft-defender-atp/images/MTE_icon.jpg diff --git a/windows/security/threat-protection/windows-defender-atp/images/MTE_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/MTE_icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/MTE_icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/NGP_icon.jpg b/windows/security/threat-protection/microsoft-defender-atp/images/NGP_icon.jpg similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/NGP_icon.jpg rename to windows/security/threat-protection/microsoft-defender-atp/images/NGP_icon.jpg diff --git a/windows/security/threat-protection/windows-defender-atp/images/NGP_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/NGP_icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/NGP_icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/NGP_icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/No threats found.png b/windows/security/threat-protection/microsoft-defender-atp/images/No threats found.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/No threats found.png rename to windows/security/threat-protection/microsoft-defender-atp/images/No threats found.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/Partially investigated.png b/windows/security/threat-protection/microsoft-defender-atp/images/Partially investigated.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/Partially investigated.png rename to windows/security/threat-protection/microsoft-defender-atp/images/Partially investigated.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/Partially remediated.png b/windows/security/threat-protection/microsoft-defender-atp/images/Partially remediated.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/Partially remediated.png rename to windows/security/threat-protection/microsoft-defender-atp/images/Partially remediated.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/Pending.png b/windows/security/threat-protection/microsoft-defender-atp/images/Pending.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/Pending.png rename to windows/security/threat-protection/microsoft-defender-atp/images/Pending.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/Remediated.png b/windows/security/threat-protection/microsoft-defender-atp/images/Remediated.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/Remediated.png rename to windows/security/threat-protection/microsoft-defender-atp/images/Remediated.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/Running.png b/windows/security/threat-protection/microsoft-defender-atp/images/Running.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/Running.png rename to windows/security/threat-protection/microsoft-defender-atp/images/Running.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/SS_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/SS_icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/SS_icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/SS_icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/TVM_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/TVM_icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/TVM_icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/TVM_icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/Terminated by system.png b/windows/security/threat-protection/microsoft-defender-atp/images/Terminated by system.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/Terminated by system.png rename to windows/security/threat-protection/microsoft-defender-atp/images/Terminated by system.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/WDATP-components.png b/windows/security/threat-protection/microsoft-defender-atp/images/WDATP-components.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/WDATP-components.png rename to windows/security/threat-protection/microsoft-defender-atp/images/WDATP-components.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/active-alerts-tile.png b/windows/security/threat-protection/microsoft-defender-atp/images/active-alerts-tile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/active-alerts-tile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/active-alerts-tile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/active-threat-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/active-threat-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/active-threat-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/active-threat-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/advanced-features.png b/windows/security/threat-protection/microsoft-defender-atp/images/advanced-features.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/advanced-features.png rename to windows/security/threat-protection/microsoft-defender-atp/images/advanced-features.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-query-example.PNG b/windows/security/threat-protection/microsoft-defender-atp/images/advanced-hunting-query-example.PNG similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-query-example.PNG rename to windows/security/threat-protection/microsoft-defender-atp/images/advanced-hunting-query-example.PNG diff --git a/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-save-query.PNG b/windows/security/threat-protection/microsoft-defender-atp/images/advanced-hunting-save-query.PNG similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-save-query.PNG rename to windows/security/threat-protection/microsoft-defender-atp/images/advanced-hunting-save-query.PNG diff --git a/windows/security/threat-protection/windows-defender-atp/images/alert-details.png b/windows/security/threat-protection/microsoft-defender-atp/images/alert-details.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/alert-details.png rename to windows/security/threat-protection/microsoft-defender-atp/images/alert-details.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/alert-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/alert-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/alert-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/alert-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/alerts-q-bulk.png b/windows/security/threat-protection/microsoft-defender-atp/images/alerts-q-bulk.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/alerts-q-bulk.png rename to windows/security/threat-protection/microsoft-defender-atp/images/alerts-q-bulk.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/alerts-queue-list.png b/windows/security/threat-protection/microsoft-defender-atp/images/alerts-queue-list.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/alerts-queue-list.png rename to windows/security/threat-protection/microsoft-defender-atp/images/alerts-queue-list.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/alerts-queue-numbered.png b/windows/security/threat-protection/microsoft-defender-atp/images/alerts-queue-numbered.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/alerts-queue-numbered.png rename to windows/security/threat-protection/microsoft-defender-atp/images/alerts-queue-numbered.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/analysis-results.png b/windows/security/threat-protection/microsoft-defender-atp/images/analysis-results.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/analysis-results.png rename to windows/security/threat-protection/microsoft-defender-atp/images/analysis-results.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/api-jwt-ms.png b/windows/security/threat-protection/microsoft-defender-atp/images/api-jwt-ms.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/api-jwt-ms.png rename to windows/security/threat-protection/microsoft-defender-atp/images/api-jwt-ms.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/api-tenant-id.png b/windows/security/threat-protection/microsoft-defender-atp/images/api-tenant-id.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/api-tenant-id.png rename to windows/security/threat-protection/microsoft-defender-atp/images/api-tenant-id.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-Application-Guard-events-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-Application-Guard-events-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-Application-Guard-events-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-Application-Guard-events-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-Device-Guard-events-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-Device-Guard-events-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-Device-Guard-events-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-Device-Guard-events-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-ETW-event-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-ETW-event-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-ETW-event-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-ETW-event-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-Exploit-Guard-events-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-Exploit-Guard-events-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-Exploit-Guard-events-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-Exploit-Guard-events-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-File-path-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-File-path-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-File-path-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-File-path-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-Firewall-events-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-Firewall-events-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-Firewall-events-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-Firewall-events-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-O365-admin-portal-customer.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-O365-admin-portal-customer.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-O365-admin-portal-customer.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-O365-admin-portal-customer.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-Other-events-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-Other-events-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-Other-events-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-Other-events-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-Smart-Screen-events-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-Smart-Screen-events-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-Smart-Screen-events-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-Smart-Screen-events-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-access-token-modification-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-access-token-modification-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-access-token-modification-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-access-token-modification-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-action-block-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-action-block-file.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-action-block-file.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-action-block-file.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-action-center-app-restriction.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-action-center-app-restriction.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-action-center-app-restriction.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-action-center-app-restriction.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-action-center-package-collection.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-action-center-package-collection.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-action-center-package-collection.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-action-center-package-collection.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-action-center-restrict-app.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-action-center-restrict-app.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-action-center-restrict-app.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-action-center-restrict-app.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-action-center-with-info.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-action-center-with-info.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-action-center-with-info.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-action-center-with-info.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actions-action-center.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-action-center.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actions-action-center.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-action-center.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actions-collect-investigation-package.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-collect-investigation-package.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actions-collect-investigation-package.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-collect-investigation-package.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actions-isolate-machine.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-isolate-machine.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actions-isolate-machine.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-isolate-machine.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actions-manage-tags.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-manage-tags.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actions-manage-tags.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-manage-tags.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actions-release-from-isolation.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-release-from-isolation.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actions-release-from-isolation.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-release-from-isolation.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actions-release-from-isoloation.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-release-from-isoloation.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actions-release-from-isoloation.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-release-from-isoloation.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actions-remove-app-restrictions.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-remove-app-restrictions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actions-remove-app-restrictions.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-remove-app-restrictions.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actions-restrict-app-execution.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-restrict-app-execution.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actions-restrict-app-execution.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-restrict-app-execution.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actions-run-av.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-run-av.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actions-run-av.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actions-run-av.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-active-investigations-tile.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-active-investigations-tile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-active-investigations-tile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-active-investigations-tile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actor-alert.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actor-alert.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actor-alert.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actor-alert.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actor-report.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actor-report.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actor-report.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actor-report.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-actor.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-actor.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-actor.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-actor.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-add-application-name.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-add-application-name.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-add-application-name.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-add-application-name.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-add-application.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-add-application.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-add-application.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-add-application.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-add-intune-policy.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-add-intune-policy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-add-intune-policy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-add-intune-policy.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-query.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting-query.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-query.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting-query.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-results-filter.PNG b/windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting-results-filter.PNG similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-results-filter.PNG rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting-results-filter.PNG diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-results-set.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting-results-set.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-results-set.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting-results-set.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-details.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-details.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alert-details.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-details.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-mgt-pane.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-mgt-pane.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alert-mgt-pane.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-mgt-pane.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-page.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-page.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alert-page.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-page.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-process-tree.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-process-tree.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alert-process-tree.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-process-tree.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-source.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-source.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alert-source.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-source.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-status.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-status.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alert-status.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-status.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-timeline-numbered.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-timeline-numbered.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alert-timeline-numbered.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-timeline-numbered.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-timeline.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-timeline.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alert-timeline.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-timeline.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-view.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-view.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alert-view.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alert-view.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-group.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-group.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alerts-group.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-group.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-q.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-q.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alerts-q.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-q.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-queue-user.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-queue-user.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-queue.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-queue.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alerts-queue.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-queue.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-related-to-file.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-file.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-related-to-file.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-related-to-machine.PNG similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-related-to-machine.PNG diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-selected.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-selected.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alerts-selected.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-selected.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-tile.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-tile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alerts-tile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alerts-tile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alertsq1.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alertsq1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alertsq1.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alertsq1.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alertsq2.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-alertsq2.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-alertsq2.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-alertsq2.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-analyze-auto-ir.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-analyze-auto-ir.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-analyze-auto-ir.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-analyze-auto-ir.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-app-restriction.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-app-restriction.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-app-restriction.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-app-restriction.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-application-information.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-application-information.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-application-information.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-application-information.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-approve-reject-action.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-approve-reject-action.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-approve-reject-action.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-approve-reject-action.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-appsource.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-appsource.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-appsource.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-appsource.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigation-pending.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-auto-investigation-pending.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigation-pending.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-auto-investigation-pending.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigations-list.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-auto-investigations-list.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigations-list.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-auto-investigations-list.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-automated-investigations-statistics.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-automated-investigations-statistics.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-automated-investigations-statistics.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-automated-investigations-statistics.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-av-scan-action-center.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-av-scan-action-center.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-av-scan-action-center.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-av-scan-action-center.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-av-scan-notification.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-av-scan-notification.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-av-scan-notification.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-av-scan-notification.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-api-access.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-api-access.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-api-access.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-api-access.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-assign-role.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-assign-role.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-assign-role.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-assign-role.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-app.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-atp-app.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-app.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-atp-app.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine-user.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-atp-machine-user.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine-user.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-atp-machine-user.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-atp-machine.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-atp-machine.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-create.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-create.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-create.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-create.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-category.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-category.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-category.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-category.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-configure.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-configure.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-configure.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-configure.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-create-policy-configure.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-create-policy-configure.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-create-policy-configure.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-create-policy-configure.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-create-policy-name.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-create-policy-name.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-create-policy-name.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-create-policy-name.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-create-policy.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-create-policy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-create-policy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-create-policy.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-create-profile.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-create-profile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-create-profile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-create-profile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-create.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-create.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-create.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-create.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-device-config.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-device-config.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-device-config.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-device-config.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-save-policy.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-save-policy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-save-policy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-save-policy.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-save.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-save.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-save.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-save.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-select-group.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-select-group.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-select-group.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-select-group.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-settings-configure.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-settings-configure.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune-settings-configure.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune-settings-configure.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-intune.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-intune.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-license-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-license-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-license-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-license-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-new-app.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-new-app.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-new-app.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-new-app.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-required-permissions.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-required-permissions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-required-permissions.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-required-permissions.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-select-permissions.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-select-permissions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-select-permissions.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-select-permissions.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-ui-user-access.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-ui-user-access.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-azure-ui-user-access.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-azure-ui-user-access.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-billing-licenses.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-billing-licenses.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-billing-licenses.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-billing-licenses.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-billing-subscriptions.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-billing-subscriptions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-billing-subscriptions.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-billing-subscriptions.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-block-file-confirm.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-block-file-confirm.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-block-file-confirm.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-block-file-confirm.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-block-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-block-file.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-block-file.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-block-file.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-blockfile.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-blockfile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-blockfile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-blockfile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-cloud-discovery-dashboard-menu.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-cloud-discovery-dashboard-menu.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-cloud-discovery-dashboard-menu.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-cloud-discovery-dashboard-menu.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-collect-investigation-package.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-collect-investigation-package.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-collect-investigation-package.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-collect-investigation-package.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-command-line-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-command-line-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-command-line-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-command-line-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-community-center.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-community-center.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-community-center.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-community-center.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-conditional-access-numbered.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-conditional-access-numbered.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-conditional-access-numbered.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-conditional-access-numbered.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-conditional-access.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-conditional-access.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-conditional-access.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-conditional-access.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-confirm-isolate.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-confirm-isolate.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-confirm-isolate.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-confirm-isolate.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-create-dashboard.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-create-dashboard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-create-dashboard.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-create-dashboard.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-create-suppression-rule.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-create-suppression-rule.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-create-suppression-rule.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-create-suppression-rule.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-custom-oma-uri.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-custom-oma-uri.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-custom-oma-uri.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-custom-oma-uri.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-custom-ti-mapping.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-custom-ti-mapping.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-custom-ti-mapping.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-custom-ti-mapping.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-daily-machines-reporting.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-daily-machines-reporting.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-daily-machines-reporting.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-daily-machines-reporting.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-9.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-dashboard-security-analytics-9.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-9.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-dashboard-security-analytics-9.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-dashboard-security-analytics-full.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-dashboard-security-analytics-full.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-dashboard-security-analytics.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-dashboard-security-analytics.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-data-not-available.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-data-not-available.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-data-not-available.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-data-not-available.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-data-ready.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-data-ready.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-data-ready.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-data-ready.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-data-retention-policy.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-data-retention-policy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-data-retention-policy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-data-retention-policy.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-delete-query.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-delete-query.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-delete-query.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-delete-query.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-detailed-actor.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-detailed-actor.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-detailed-actor.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-detailed-actor.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-disableantispyware-regkey.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-disableantispyware-regkey.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-disableantispyware-regkey.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-disableantispyware-regkey.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-download-connector.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-download-connector.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-download-connector.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-download-connector.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-enable-security-analytics.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-enable-security-analytics.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-example-email-notification.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-example-email-notification.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-example-email-notification.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-example-email-notification.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-export-machine-timeline-events.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-export-machine-timeline-events.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-export-machine-timeline-events.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-export-machine-timeline-events.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-file-action.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-file-action.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-file-action.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-file-action.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-file-creation-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-file-creation-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-file-creation-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-file-creation-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-file-details.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-file-details.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-file-details.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-file-details.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-file-in-org.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-file-in-org.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-file-in-org.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-file-in-org.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-file-information.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-file-information.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-file-information.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-file-information.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-file-observed-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-file-observed-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-file-observed-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-file-observed-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-filter-advanced-hunting.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-filter-advanced-hunting.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-filter-advanced-hunting.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-filter-advanced-hunting.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-final-onboard-endpoints-warning-before-atp-access.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-final-onboard-endpoints-warning-before-atp-access.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-final-onboard-endpoints-warning-before-atp-access.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-final-onboard-endpoints-warning-before-atp-access.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-final-preference-setup.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-final-preference-setup.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-final-preference-setup.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-final-preference-setup.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-geographic-location-setup.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-geographic-location-setup.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-geographic-location-setup.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-geographic-location-setup.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-get-data.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-get-data.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-get-data.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-get-data.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-gpo-proxy1.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-gpo-proxy1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-gpo-proxy1.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-gpo-proxy1.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-gpo-proxy2.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-gpo-proxy2.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-gpo-proxy2.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-gpo-proxy2.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-image.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-image.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-image.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-image.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-improv-opps-9.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-improv-opps-9.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-improv-opps-9.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-improv-opps-9.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-improv-opps.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-improv-opps.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-improv-opps.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-improv-opps.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-improv-ops.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-improv-ops.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-improv-ops.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-improv-ops.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-details-page.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-details-page.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incident-details-page.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-details-page.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-details.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-details.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incident-details.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-details.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-evidence-tab.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-evidence-tab.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incident-evidence-tab.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-evidence-tab.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph-details.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-graph-details.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph-details.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-graph-details.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph-tab.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-graph-tab.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph-tab.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-graph-tab.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-graph.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-graph.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-investigations-tab.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-investigations-tab.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incident-investigations-tab.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-investigations-tab.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-machine-tab.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-machine-tab.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incident-machine-tab.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-machine-tab.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-queue.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-queue.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incident-queue.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-queue.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incidents-alerts-incidentlinkedbyreason.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incidents-alerts-incidentlinkedbyreason.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incidents-alerts-incidentlinkedbyreason.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incidents-alerts-incidentlinkedbyreason.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incidents-alerts-linkedbytooltip.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incidents-alerts-linkedbytooltip.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incidents-alerts-linkedbytooltip.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incidents-alerts-linkedbytooltip.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incidents-alerts-reason.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incidents-alerts-reason.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incidents-alerts-reason.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incidents-alerts-reason.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incidents-alerts-tooltip.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incidents-alerts-tooltip.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incidents-alerts-tooltip.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incidents-alerts-tooltip.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incidents-mgt-pane.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-incidents-mgt-pane.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-incidents-mgt-pane.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-incidents-mgt-pane.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-industry-information.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-industry-information.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-industry-information.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-industry-information.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-add-oma.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-add-oma.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-add-oma.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-add-oma.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-add-policy.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-add-policy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-add-policy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-add-policy.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-assignments.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-assignments.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-assignments.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-assignments.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-configure.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-configure.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-configure.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-configure.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-create-policy.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-create-policy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-create-policy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-create-policy.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-custom.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-custom.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-custom.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-custom.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-deploy-policy.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-deploy-policy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-deploy-policy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-deploy-policy.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-group.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-group.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-group.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-group.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-manage-deployment.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-manage-deployment.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-manage-deployment.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-manage-deployment.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-new-policy.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-new-policy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-new-policy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-new-policy.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-oma-uri-setting.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-oma-uri-setting.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-oma-uri-setting.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-oma-uri-setting.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-policy-name.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-policy-name.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-policy-name.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-policy-name.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-save-deployment.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-save-deployment.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-save-deployment.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-save-deployment.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-intune-save-policy.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-save-policy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-intune-save-policy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-intune-save-policy.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-investigation-package-action-center.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-investigation-package-action-center.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-investigation-package-action-center.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-investigation-package-action-center.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-isolate-machine.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-isolate-machine.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-isolate-machine.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-isolate-machine.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-licensing-azure-portal.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-licensing-azure-portal.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-licensing-azure-portal.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-licensing-azure-portal.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-loading.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-loading.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-loading.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-loading.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-logo-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-logo-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-logo-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-logo-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-actions-undo.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-actions-undo.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-actions-undo.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-actions-undo.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-actions.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-actions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-actions.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-actions.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-details-view.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-details-view.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-details-view.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-details-view.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-details-view2.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-details-view2.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-details-view2.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-details-view2.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-health-details.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-health-details.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-health-details.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-health-details.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-health.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-health.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-health.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-health.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-investigation-package.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-investigation-package.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-investigation-package.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-investigation-package.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-isolation.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-isolation.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-isolation.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-isolation.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-timeline-details-panel.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-timeline-details-panel.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-timeline-export.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-timeline-export.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-filter.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-timeline-filter.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-filter.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-timeline-filter.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-timeline.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-timeline.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-view-ata.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-view-ata.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machine-view-ata.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machine-view-ata.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-active-threats-tile.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-active-threats-tile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machines-active-threats-tile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-active-threats-tile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-at-risk.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-at-risk.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-list-misconfigured.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-list-misconfigured.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machines-list-misconfigured.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-list-misconfigured.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-list-view.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-list-view.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machines-list-view.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-list-view.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-list-view2.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-list-view2.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machines-list-view2.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-list-view2.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-timeline.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-timeline.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machines-timeline.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-timeline.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-view-list.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-view-list.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-machines-view-list.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-machines-view-list.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-main-portal.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-main-portal.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-main-portal.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-main-portal.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-manage-tags.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-manage-tags.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-manage-tags.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-manage-tags.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mapping 3.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping 3.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mapping 3.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping 3.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mapping1.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mapping1.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping1.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mapping2.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping2.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mapping2.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping2.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mapping3.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping3.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mapping3.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping3.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mapping4.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping4.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mapping4.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping4.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mapping5.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping5.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mapping5.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping5.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mapping6.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping6.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mapping6.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping6.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mapping7.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping7.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mapping7.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mapping7.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mcas-settings.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mcas-settings.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mcas-settings.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mcas-settings.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mdm-onboarding-package.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mdm-onboarding-package.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mdm-onboarding-package.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mdm-onboarding-package.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-memory-allocation-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-memory-allocation-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-memory-allocation-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-memory-allocation-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mma-properties.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mma-properties.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mma-properties.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mma-properties.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mma.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-mma.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-mma.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-mma.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-module-load-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-module-load-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-module-load-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-module-load-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-ms-secure-score-9.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-ms-secure-score-9.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-ms-secure-score-9.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-ms-secure-score-9.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-ms-secure-score.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-ms-secure-score.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-ms-secure-score.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-ms-secure-score.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-network-communications-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-network-communications-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-network-communications-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-network-communications-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-new-alerts-list.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-new-alerts-list.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-new-alerts-list.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-new-alerts-list.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-new-suppression-rule.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-new-suppression-rule.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-new-suppression-rule.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-new-suppression-rule.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-no-network-connection.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-no-network-connection.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-no-network-connection.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-no-network-connection.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-no-subscriptions-found.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-no-subscriptions-found.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-no-subscriptions-found.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-no-subscriptions-found.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-not-authorized-to-access-portal.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-not-authorized-to-access-portal.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-not-authorized-to-access-portal.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-not-authorized-to-access-portal.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-notification-action.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-notification-action.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-notification-action.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-notification-action.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-notification-collect-package.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-notification-collect-package.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-notification-collect-package.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-notification-collect-package.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-notification-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-notification-file.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-notification-file.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-notification-file.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-notification-isolate.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-notification-isolate.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-notification-isolate.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-notification-isolate.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-notification-restrict.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-notification-restrict.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-notification-restrict.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-notification-restrict.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-notifications.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-notifications.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-notifications.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-notifications.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-observed-in-organization.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-observed-in-organization.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-observed-in-organization.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-observed-in-organization.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-observed-machines.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-observed-machines.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-observed-machines.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-observed-machines.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-oma-uri-values.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-oma-uri-values.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-oma-uri-values.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-oma-uri-values.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal-border-test.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-onboard-endpoints-WDATP-portal-border-test.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal-border-test.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-onboard-endpoints-WDATP-portal-border-test.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-run-detection-test.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-onboard-endpoints-run-detection-test.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-run-detection-test.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-onboard-endpoints-run-detection-test.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-onboard-endpoints.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-onboard-endpoints.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-mdm.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-onboard-mdm.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-onboard-mdm.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-onboard-mdm.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-org-score.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-org-score.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-org-score.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-org-score.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-org-sec-score.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-org-sec-score.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-org-sec-score.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-org-sec-score.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-organization-size.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-organization-size.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-organization-size.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-organization-size.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-auto-ir.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-pending-actions-auto-ir.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-auto-ir.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-pending-actions-auto-ir.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-pending-actions-file.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-file.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-pending-actions-file.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-list.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-pending-actions-list.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-list.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-pending-actions-list.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-multiple.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-pending-actions-multiple.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-multiple.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-pending-actions-multiple.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-notification.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-pending-actions-notification.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-notification.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-pending-actions-notification.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-permissions-applications.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-permissions-applications.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-permissions-applications.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-permissions-applications.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-portal-sensor.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-portal-sensor.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-portal-sensor.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-portal-sensor.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-portal-welcome-screen.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-portal-welcome-screen.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-portal-welcome-screen.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-portal-welcome-screen.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-portal.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-portal.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-portal.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-portal.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-accept.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-accept.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-accept.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-accept.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-consent.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-consent.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-consent.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-consent.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-extension.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-extension.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-extension.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-extension.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-get-data.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-get-data.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-get-data.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-get-data.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-importing.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-importing.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-importing.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-importing.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-navigator.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-navigator.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-navigator.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-navigator.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-options.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-options.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-options.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-options.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-preview.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-preview.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-powerbi-preview.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-powerbi-preview.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-powershell-command-run-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-powershell-command-run-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-powershell-command-run-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-powershell-command-run-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-preferences-setup.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-preferences-setup.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-preferences-setup.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-preferences-setup.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-preview-experience.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-preview-experience.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-preview-experience.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-preview-experience.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-preview-features.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-preview-features.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-preview-features.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-preview-features.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-process-event-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-process-event-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-process-event-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-process-event-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-process-injection.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-process-injection.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-process-injection.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-process-injection.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-process-tree.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-process-tree.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-process-tree.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-process-tree.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-refresh-token.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-refresh-token.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-refresh-token.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-refresh-token.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-region-control-panel.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-region-control-panel.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-region-control-panel.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-region-control-panel.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-registry-event-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-registry-event-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-registry-event-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-registry-event-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-remediated-alert.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-remediated-alert.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-remediated-alert.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-remediated-alert.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-remove-blocked-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-remove-blocked-file.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-remove-blocked-file.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-remove-blocked-file.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-rename-incident.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-rename-incident.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-rename-incident.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-rename-incident.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-respond-action-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-respond-action-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-respond-action-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-respond-action-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-restrict-app.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-restrict-app.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-restrict-app.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-restrict-app.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-run-av-scan.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-run-av-scan.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-run-av-scan.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-run-av-scan.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-running-script.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-running-script.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-running-script.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-running-script.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sample-custom-ti-alert.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-sample-custom-ti-alert.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-sample-custom-ti-alert.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-sample-custom-ti-alert.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-save-query.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-save-query.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-save-query.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-save-query.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-save-tag.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-save-tag.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-save-tag.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-save-tag.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sec-coverage.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-sec-coverage.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-sec-coverage.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-sec-coverage.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-1.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-sec-ops-1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-1.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-sec-ops-1.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-dashboard.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-sec-ops-dashboard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-dashboard.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-sec-ops-dashboard.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-analytics-dashboard.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-security-analytics-dashboard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-security-analytics-dashboard.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-security-analytics-dashboard.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-security-analytics-view-machines.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-security-analytics-view-machines.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines2.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-security-analytics-view-machines2.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines2.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-security-analytics-view-machines2.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-controls-9.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-security-controls-9.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-security-controls-9.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-security-controls-9.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-controls.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-security-controls.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-security-controls.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-security-controls.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-coverage.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-security-coverage.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-security-coverage.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-security-coverage.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-improvements.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-security-improvements.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-security-improvements.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-security-improvements.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-score-over-time-9.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-security-score-over-time-9.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-security-score-over-time-9.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-security-score-over-time-9.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-score-over-time.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-security-score-over-time.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-security-score-over-time.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-security-score-over-time.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sensor-filter.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-filter.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-sensor-filter.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-filter.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sensor-health-filter-resized.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-health-filter-resized.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-sensor-health-filter-resized.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-health-filter-resized.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sensor-health-filter-tile.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-health-filter-tile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-sensor-health-filter-tile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-health-filter-tile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sensor-health-filter.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-health-filter.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-sensor-health-filter.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-health-filter.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sensor-health-nonav.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-health-nonav.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-sensor-health-nonav.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-health-nonav.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sensor-health-tile.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-health-tile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-sensor-health-tile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-sensor-health-tile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-server-offboarding-workspaceid.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-server-offboarding-workspaceid.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-server-offboarding-workspaceid.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-server-offboarding-workspaceid.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-server-onboarding-workspaceid.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-server-onboarding-workspaceid.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-server-onboarding-workspaceid.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-server-onboarding-workspaceid.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-server-onboarding.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-server-onboarding.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-server-onboarding.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-server-onboarding.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-services.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-services.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-services.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-services.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-settings-aip.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-settings-aip.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-settings-aip.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-settings-aip.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-settings-powerbi.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-settings-powerbi.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-settings-powerbi.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-settings-powerbi.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-setup-complete.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-setup-complete.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-setup-complete.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-setup-complete.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-setup-incomplete.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-setup-incomplete.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-setup-incomplete.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-setup-incomplete.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-setup-permissions-wdatp-portal.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-setup-permissions-wdatp-portal.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-setup-permissions-wdatp-portal.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-setup-permissions-wdatp-portal.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-shared-queries.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-shared-queries.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-shared-queries.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-shared-queries.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-siem-integration.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-integration.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-siem-integration.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-integration.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-siem-mapping1.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-mapping1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-siem-mapping1.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-mapping1.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-siem-mapping13.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-mapping13.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-siem-mapping13.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-mapping13.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-siem-mapping2.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-mapping2.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-siem-mapping2.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-mapping2.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-siem-mapping3.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-mapping3.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-siem-mapping3.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-mapping3.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-siem-mapping4.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-mapping4.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-siem-mapping4.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-siem-mapping4.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-signer-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-signer-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-signer-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-signer-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-simulate-custom-ti.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-simulate-custom-ti.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-simulate-custom-ti.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-simulate-custom-ti.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-stop-quarantine-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-stop-quarantine-file.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-stop-quarantine-file.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-stop-quarantine-file.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-stop-quarantine.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-stop-quarantine.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-stop-quarantine.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-stop-quarantine.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-stopnquarantine-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-stopnquarantine-file.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-stopnquarantine-file.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-stopnquarantine-file.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-subscription-expired.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-subscription-expired.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-subscription-expired.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-subscription-expired.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-suppression-rules.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-suppression-rules.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-suppression-rules.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-suppression-rules.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-suspicious-activities-tile.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-suspicious-activities-tile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-suspicious-activities-tile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-suspicious-activities-tile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-tag-management.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-tag-management.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-tag-management.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-tag-management.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-task-manager.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-task-manager.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-task-manager.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-task-manager.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-threat-intel-api.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-threat-intel-api.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-threat-intel-api.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-threat-intel-api.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-threat-protection-reports.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-threat-protection-reports.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-threat-protection-reports.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-threat-protection-reports.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-thunderbolt-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-thunderbolt-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-thunderbolt-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-thunderbolt-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-tile-sensor-health.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-tile-sensor-health.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-tile-sensor-health.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-tile-sensor-health.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-time-zone.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-time-zone.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-time-zone.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-time-zone.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-undo-isolation.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-undo-isolation.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-undo-isolation.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-undo-isolation.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-unsigned-file-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-unsigned-file-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-unsigned-file-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-unsigned-file-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-user-details-pane.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-user-details-pane.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-user-details-pane.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-user-details-pane.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view-azureatp.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-user-details-view-azureatp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view-azureatp.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-user-details-view-azureatp.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view-tdp.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-user-details-view-tdp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view-tdp.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-user-details-view-tdp.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-user-details-view.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-user-details-view.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-user-details.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-user-details.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-user-details.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-user-details.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-user-view-ata.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-user-view-ata.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-user-view-ata.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-user-view-ata.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-users-at-risk.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-users-at-risk.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-users-at-risk.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-users-at-risk.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-verify-passive-mode.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-verify-passive-mode.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-verify-passive-mode.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-verify-passive-mode.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-windows-cloud-instance-creation.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-windows-cloud-instance-creation.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-windows-cloud-instance-creation.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-windows-cloud-instance-creation.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-windows-defender-av-events-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-windows-defender-av-events-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp-windows-defender-av-events-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-windows-defender-av-events-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/atp.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/azure-data-discovery.png b/windows/security/threat-protection/microsoft-defender-atp/images/azure-data-discovery.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/azure-data-discovery.png rename to windows/security/threat-protection/microsoft-defender-atp/images/azure-data-discovery.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/cloud-apps.png b/windows/security/threat-protection/microsoft-defender-atp/images/cloud-apps.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/cloud-apps.png rename to windows/security/threat-protection/microsoft-defender-atp/images/cloud-apps.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/cloud-discovery.png b/windows/security/threat-protection/microsoft-defender-atp/images/cloud-discovery.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/cloud-discovery.png rename to windows/security/threat-protection/microsoft-defender-atp/images/cloud-discovery.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/components.png b/windows/security/threat-protection/microsoft-defender-atp/images/components.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/components.png rename to windows/security/threat-protection/microsoft-defender-atp/images/components.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/creating-account.png b/windows/security/threat-protection/microsoft-defender-atp/images/creating-account.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/creating-account.png rename to windows/security/threat-protection/microsoft-defender-atp/images/creating-account.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/dashboard.png b/windows/security/threat-protection/microsoft-defender-atp/images/dashboard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/dashboard.png rename to windows/security/threat-protection/microsoft-defender-atp/images/dashboard.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/detection-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/detection-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/detection-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/detection-icon.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/email-notification.png b/windows/security/threat-protection/microsoft-defender-atp/images/email-notification.png new file mode 100644 index 0000000000..1b9875fcad Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/email-notification.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/enable_siem.png b/windows/security/threat-protection/microsoft-defender-atp/images/enable_siem.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/enable_siem.png rename to windows/security/threat-protection/microsoft-defender-atp/images/enable_siem.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/filter-log.png b/windows/security/threat-protection/microsoft-defender-atp/images/filter-log.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/filter-log.png rename to windows/security/threat-protection/microsoft-defender-atp/images/filter-log.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/io.png b/windows/security/threat-protection/microsoft-defender-atp/images/io.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/io.png rename to windows/security/threat-protection/microsoft-defender-atp/images/io.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/licensing-windows-defender-advanced-threat-protection.png b/windows/security/threat-protection/microsoft-defender-atp/images/licensing-windows-defender-advanced-threat-protection.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/licensing-windows-defender-advanced-threat-protection.png rename to windows/security/threat-protection/microsoft-defender-atp/images/licensing-windows-defender-advanced-threat-protection.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/machine-reports.png b/windows/security/threat-protection/microsoft-defender-atp/images/machine-reports.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/machine-reports.png rename to windows/security/threat-protection/microsoft-defender-atp/images/machine-reports.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/machines-active-threats-tile.png b/windows/security/threat-protection/microsoft-defender-atp/images/machines-active-threats-tile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/machines-active-threats-tile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/machines-active-threats-tile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/machines-at-risk-tile.png b/windows/security/threat-protection/microsoft-defender-atp/images/machines-at-risk-tile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/machines-at-risk-tile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/machines-at-risk-tile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/machines-at-risk.png b/windows/security/threat-protection/microsoft-defender-atp/images/machines-at-risk.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/machines-at-risk.png rename to windows/security/threat-protection/microsoft-defender-atp/images/machines-at-risk.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/machines-list.png b/windows/security/threat-protection/microsoft-defender-atp/images/machines-list.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/machines-list.png rename to windows/security/threat-protection/microsoft-defender-atp/images/machines-list.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/machines-reporting-tile.png b/windows/security/threat-protection/microsoft-defender-atp/images/machines-reporting-tile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/machines-reporting-tile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/machines-reporting-tile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/menu-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/menu-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/menu-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/menu-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/ms-flow-choose-action.png b/windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-choose-action.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/ms-flow-choose-action.png rename to windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-choose-action.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/ms-flow-define-action.png b/windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-define-action.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/ms-flow-define-action.png rename to windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-define-action.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/ms-flow-e2e.png b/windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-e2e.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/ms-flow-e2e.png rename to windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-e2e.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/ms-flow-insert-db.png b/windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-insert-db.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/ms-flow-insert-db.png rename to windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-insert-db.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/ms-flow-parse-json.png b/windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-parse-json.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/ms-flow-parse-json.png rename to windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-parse-json.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/ms-flow-read-db.png b/windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-read-db.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/ms-flow-read-db.png rename to windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-read-db.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/mss.png b/windows/security/threat-protection/microsoft-defender-atp/images/mss.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/mss.png rename to windows/security/threat-protection/microsoft-defender-atp/images/mss.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-add-permission.png b/windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-add-permission.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/nativeapp-add-permission.png rename to windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-add-permission.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-add-permissions-end.png b/windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-add-permissions-end.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/nativeapp-add-permissions-end.png rename to windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-add-permissions-end.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-create.png b/windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-create.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/nativeapp-create.png rename to windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-create.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-decoded-token.png b/windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-decoded-token.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/nativeapp-decoded-token.png rename to windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-decoded-token.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-get-appid.png b/windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-get-appid.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/nativeapp-get-appid.png rename to windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-get-appid.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-select-permissions.png b/windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-select-permissions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/nativeapp-select-permissions.png rename to windows/security/threat-protection/microsoft-defender-atp/images/nativeapp-select-permissions.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/new-secure-score-dashboard.png b/windows/security/threat-protection/microsoft-defender-atp/images/new-secure-score-dashboard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/new-secure-score-dashboard.png rename to windows/security/threat-protection/microsoft-defender-atp/images/new-secure-score-dashboard.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/new-ssot.png b/windows/security/threat-protection/microsoft-defender-atp/images/new-ssot.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/new-ssot.png rename to windows/security/threat-protection/microsoft-defender-atp/images/new-ssot.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/no-threats-found.png b/windows/security/threat-protection/microsoft-defender-atp/images/no-threats-found.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/no-threats-found.png rename to windows/security/threat-protection/microsoft-defender-atp/images/no-threats-found.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/no_threats_found.png b/windows/security/threat-protection/microsoft-defender-atp/images/no_threats_found.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/no_threats_found.png rename to windows/security/threat-protection/microsoft-defender-atp/images/no_threats_found.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/not-remediated-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/not-remediated-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/not-remediated-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/not-remediated-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/office-scc-label.png b/windows/security/threat-protection/microsoft-defender-atp/images/office-scc-label.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/office-scc-label.png rename to windows/security/threat-protection/microsoft-defender-atp/images/office-scc-label.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/overview.png b/windows/security/threat-protection/microsoft-defender-atp/images/overview.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/overview.png rename to windows/security/threat-protection/microsoft-defender-atp/images/overview.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/partially-investigated.png b/windows/security/threat-protection/microsoft-defender-atp/images/partially-investigated.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/partially-investigated.png rename to windows/security/threat-protection/microsoft-defender-atp/images/partially-investigated.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/partially_investigated.png b/windows/security/threat-protection/microsoft-defender-atp/images/partially_investigated.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/partially_investigated.png rename to windows/security/threat-protection/microsoft-defender-atp/images/partially_investigated.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/partially_remediated.png b/windows/security/threat-protection/microsoft-defender-atp/images/partially_remediated.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/partially_remediated.png rename to windows/security/threat-protection/microsoft-defender-atp/images/partially_remediated.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/pending-actions.png b/windows/security/threat-protection/microsoft-defender-atp/images/pending-actions.png new file mode 100644 index 0000000000..8cb0f643a6 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/pending-actions.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-create-advanced-query.png b/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-create-advanced-query.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/power-bi-create-advanced-query.png rename to windows/security/threat-protection/microsoft-defender-atp/images/power-bi-create-advanced-query.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-create-blank-query.png b/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-create-blank-query.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/power-bi-create-blank-query.png rename to windows/security/threat-protection/microsoft-defender-atp/images/power-bi-create-blank-query.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-edit-credentials.png b/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-edit-credentials.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/power-bi-edit-credentials.png rename to windows/security/threat-protection/microsoft-defender-atp/images/power-bi-edit-credentials.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-edit-data-privacy.png b/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-edit-data-privacy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/power-bi-edit-data-privacy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/power-bi-edit-data-privacy.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-open-advanced-editor.png b/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-open-advanced-editor.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/power-bi-open-advanced-editor.png rename to windows/security/threat-protection/microsoft-defender-atp/images/power-bi-open-advanced-editor.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-query-results.png b/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-query-results.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/power-bi-query-results.png rename to windows/security/threat-protection/microsoft-defender-atp/images/power-bi-query-results.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-anonymous.png b/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-set-credentials-anonymous.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-anonymous.png rename to windows/security/threat-protection/microsoft-defender-atp/images/power-bi-set-credentials-anonymous.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-organizational-cont.png b/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-set-credentials-organizational-cont.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-organizational-cont.png rename to windows/security/threat-protection/microsoft-defender-atp/images/power-bi-set-credentials-organizational-cont.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-organizational.png b/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-set-credentials-organizational.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-organizational.png rename to windows/security/threat-protection/microsoft-defender-atp/images/power-bi-set-credentials-organizational.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-data-privacy.png b/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-set-data-privacy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/power-bi-set-data-privacy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/power-bi-set-data-privacy.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/remediated-icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/remediated-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/remediated-icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/remediated-icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/rules-legend.png b/windows/security/threat-protection/microsoft-defender-atp/images/rules-legend.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/rules-legend.png rename to windows/security/threat-protection/microsoft-defender-atp/images/rules-legend.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/run-as-admin.png b/windows/security/threat-protection/microsoft-defender-atp/images/run-as-admin.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/run-as-admin.png rename to windows/security/threat-protection/microsoft-defender-atp/images/run-as-admin.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/save-query.png b/windows/security/threat-protection/microsoft-defender-atp/images/save-query.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/save-query.png rename to windows/security/threat-protection/microsoft-defender-atp/images/save-query.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/sccm-deployment.png b/windows/security/threat-protection/microsoft-defender-atp/images/sccm-deployment.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/sccm-deployment.png rename to windows/security/threat-protection/microsoft-defender-atp/images/sccm-deployment.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/sec-ops-dashboard.png b/windows/security/threat-protection/microsoft-defender-atp/images/sec-ops-dashboard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/sec-ops-dashboard.png rename to windows/security/threat-protection/microsoft-defender-atp/images/sec-ops-dashboard.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/securescore.png b/windows/security/threat-protection/microsoft-defender-atp/images/securescore.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/securescore.png rename to windows/security/threat-protection/microsoft-defender-atp/images/securescore.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/settings.png b/windows/security/threat-protection/microsoft-defender-atp/images/settings.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/settings.png rename to windows/security/threat-protection/microsoft-defender-atp/images/settings.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/setup-preferences.png b/windows/security/threat-protection/microsoft-defender-atp/images/setup-preferences.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/setup-preferences.png rename to windows/security/threat-protection/microsoft-defender-atp/images/setup-preferences.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/setup-preferences2.png b/windows/security/threat-protection/microsoft-defender-atp/images/setup-preferences2.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/setup-preferences2.png rename to windows/security/threat-protection/microsoft-defender-atp/images/setup-preferences2.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/siem_details.png b/windows/security/threat-protection/microsoft-defender-atp/images/siem_details.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/siem_details.png rename to windows/security/threat-protection/microsoft-defender-atp/images/siem_details.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/ss1.png b/windows/security/threat-protection/microsoft-defender-atp/images/ss1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/ss1.png rename to windows/security/threat-protection/microsoft-defender-atp/images/ss1.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/ssot.png b/windows/security/threat-protection/microsoft-defender-atp/images/ssot.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/ssot.png rename to windows/security/threat-protection/microsoft-defender-atp/images/ssot.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/status-tile.png b/windows/security/threat-protection/microsoft-defender-atp/images/status-tile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/status-tile.png rename to windows/security/threat-protection/microsoft-defender-atp/images/status-tile.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/submit-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/submit-file.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/submit-file.png rename to windows/security/threat-protection/microsoft-defender-atp/images/submit-file.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/ta.png b/windows/security/threat-protection/microsoft-defender-atp/images/ta.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/ta.png rename to windows/security/threat-protection/microsoft-defender-atp/images/ta.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/terminated-by-system.png b/windows/security/threat-protection/microsoft-defender-atp/images/terminated-by-system.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/terminated-by-system.png rename to windows/security/threat-protection/microsoft-defender-atp/images/terminated-by-system.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/terminated_by_system.png b/windows/security/threat-protection/microsoft-defender-atp/images/terminated_by_system.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/terminated_by_system.png rename to windows/security/threat-protection/microsoft-defender-atp/images/terminated_by_system.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/threat-analytics-report.png b/windows/security/threat-protection/microsoft-defender-atp/images/threat-analytics-report.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/threat-analytics-report.png rename to windows/security/threat-protection/microsoft-defender-atp/images/threat-analytics-report.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/top-recommendations.png b/windows/security/threat-protection/microsoft-defender-atp/images/top-recommendations.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/top-recommendations.png rename to windows/security/threat-protection/microsoft-defender-atp/images/top-recommendations.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_alert_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_alert_icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_alert_icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_alert_icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_bug_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_bug_icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_bug_icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_bug_icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_config_score.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_config_score.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_config_score.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_config_score.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_dashboard.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_dashboard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_dashboard.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_dashboard.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_exposed_machines.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_exposed_machines.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_exposed_machines.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_exposed_machines.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_exposure_score.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_exposure_score.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_exposure_score.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_exposure_score.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_insight_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_insight_icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_insight_icon.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_insight_icon.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_machine_page_details.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machine_page_details.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_machine_page_details.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_machine_page_details.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_menu.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_menu.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_menu.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_menu.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_remediation_task_created.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_remediation_task_created.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_remediation_task_created.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_remediation_task_created.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_request_remediation.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_request_remediation.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_request_remediation.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_request_remediation.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_save_csv_file.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_save_csv_file.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_save_csv_file.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_save_csv_file.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_security_controls.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_security_controls.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_security_controls.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_security_controls.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_security_recommendations.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_security_recommendations.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_security_recommendations.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_security_recommendations.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_security_recommendations_page.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_security_recommendations_page.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_security_recommendations_page.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_security_recommendations_page.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_software_page_details.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_software_page_details.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_software_page_details.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_software_page_details.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/tvm_vuln_software.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_vuln_software.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/tvm_vuln_software.png rename to windows/security/threat-protection/microsoft-defender-atp/images/tvm_vuln_software.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/wdatp-pillars.png b/windows/security/threat-protection/microsoft-defender-atp/images/wdatp-pillars.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/wdatp-pillars.png rename to windows/security/threat-protection/microsoft-defender-atp/images/wdatp-pillars.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/wdatp-pillars2.png b/windows/security/threat-protection/microsoft-defender-atp/images/wdatp-pillars2.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/wdatp-pillars2.png rename to windows/security/threat-protection/microsoft-defender-atp/images/wdatp-pillars2.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/wdsc.png b/windows/security/threat-protection/microsoft-defender-atp/images/wdsc.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/wdsc.png rename to windows/security/threat-protection/microsoft-defender-atp/images/wdsc.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-add-permission-2.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-add-permission-2.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-add-permission-2.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-add-permission-2.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-add-permission-end.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-add-permission-end.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-add-permission-end.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-add-permission-end.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-add-permission-readalerts.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-add-permission-readalerts.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-add-permission-readalerts.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-add-permission-readalerts.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-add-permission.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-add-permission.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-add-permission.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-add-permission.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-app-id1.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-app-id1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-app-id1.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-app-id1.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-create-key.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-create-key.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-create-key.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-create-key.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-create.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-create.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-create.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-create.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-decoded-token.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-decoded-token.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-decoded-token.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-decoded-token.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-edit-multitenant.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-edit-multitenant.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-edit-multitenant.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-edit-multitenant.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-edit-settings.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-edit-settings.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-edit-settings.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-edit-settings.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-get-appid.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-get-appid.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-get-appid.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-get-appid.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-grant-permissions.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-grant-permissions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-grant-permissions.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-grant-permissions.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-select-permission.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-select-permission.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-select-permission.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-select-permission.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-validate-token.png b/windows/security/threat-protection/microsoft-defender-atp/images/webapp-validate-token.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/webapp-validate-token.png rename to windows/security/threat-protection/microsoft-defender-atp/images/webapp-validate-token.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/welcome1.png b/windows/security/threat-protection/microsoft-defender-atp/images/welcome1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/welcome1.png rename to windows/security/threat-protection/microsoft-defender-atp/images/welcome1.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/win10-endpoint-users.png b/windows/security/threat-protection/microsoft-defender-atp/images/win10-endpoint-users.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/win10-endpoint-users.png rename to windows/security/threat-protection/microsoft-defender-atp/images/win10-endpoint-users.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/windefatp-sc-qc-diagtrack.png b/windows/security/threat-protection/microsoft-defender-atp/images/windefatp-sc-qc-diagtrack.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/windefatp-sc-qc-diagtrack.png rename to windows/security/threat-protection/microsoft-defender-atp/images/windefatp-sc-qc-diagtrack.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/windefatp-sc-query-diagtrack.png b/windows/security/threat-protection/microsoft-defender-atp/images/windefatp-sc-query-diagtrack.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/windefatp-sc-query-diagtrack.png rename to windows/security/threat-protection/microsoft-defender-atp/images/windefatp-sc-query-diagtrack.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/windefatp-sc-query.png b/windows/security/threat-protection/microsoft-defender-atp/images/windefatp-sc-query.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/windefatp-sc-query.png rename to windows/security/threat-protection/microsoft-defender-atp/images/windefatp-sc-query.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/windefatp-utc-console-autostart.png b/windows/security/threat-protection/microsoft-defender-atp/images/windefatp-utc-console-autostart.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/windefatp-utc-console-autostart.png rename to windows/security/threat-protection/microsoft-defender-atp/images/windefatp-utc-console-autostart.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard-boot-time-integrity.png b/windows/security/threat-protection/microsoft-defender-atp/images/windows-defender-system-guard-boot-time-integrity.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard-boot-time-integrity.png rename to windows/security/threat-protection/microsoft-defender-atp/images/windows-defender-system-guard-boot-time-integrity.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard-validate-system-integrity.png b/windows/security/threat-protection/microsoft-defender-atp/images/windows-defender-system-guard-validate-system-integrity.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard-validate-system-integrity.png rename to windows/security/threat-protection/microsoft-defender-atp/images/windows-defender-system-guard-validate-system-integrity.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard.png b/windows/security/threat-protection/microsoft-defender-atp/images/windows-defender-system-guard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard.png rename to windows/security/threat-protection/microsoft-defender-atp/images/windows-defender-system-guard.png diff --git a/windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md b/windows/security/threat-protection/microsoft-defender-atp/improve-request-performance.md similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md rename to windows/security/threat-protection/microsoft-defender-atp/improve-request-performance.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/incidents-queue.md b/windows/security/threat-protection/microsoft-defender-atp/incidents-queue.md new file mode 100644 index 0000000000..9ac051b1dd --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/incidents-queue.md @@ -0,0 +1,38 @@ +--- +title: Incidents queue in Microsoft Defender ATP +description: +keywords: incidents, aggregate, investigations, queue, ttp +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Incidents in Microsoft Defender ATP +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + + +When a cybersecurity threat is emerging, or a potential attacker is deploying its tactics, techniques/tools, and procedures (TTPs) on the network, Microsoft Defender ATP will quickly trigger alerts and launch matching automatic investigations. + +Microsoft Defender ATP applies correlation analytics and aggregates all related alerts and investigations into an incident. Doing so helps narrate a broader story of an attack, thus providing you with the right visuals (upgraded incident graph) and data representations to understand and deal with complex cross-entity threats to your organization's network. + + +## In this section + +Topic | Description +:---|:--- +[View and organize the Incidents queue](view-incidents-queue.md)| See the list of incidents and learn how to apply filters to limit the list and get a more focused view. +[Manage incidents](manage-incidents.md) | Learn how to manage incidents by assigning it, updating its status, or setting its classification and other actions. +[Investigate incidents](investigate-incidents.md)| See associated alerts, manage the incident, see alert metadata, and visualizations to help you investigate an incident. + + diff --git a/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md b/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-config.md similarity index 63% rename from windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md rename to windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-config.md index a8696ec1d9..94b5a8b730 100644 --- a/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md +++ b/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-config.md @@ -18,17 +18,19 @@ ms.date: 12/05/2018 --- # Configure information protection in Windows -**Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Learn how you can use Windows Defender ATP to expand the coverage of Windows Information Protection (WIP) to protect files based on their label, regardless of their origin. +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +Learn how you can use Microsoft Defender ATP to expand the coverage of Microsoft Information Protection (WIP) to protect files based on their label, regardless of their origin. >[!TIP] -> Read our blog post about how [Windows Defender ATP integrates with Microsoft Information Protection to discover, protect, and monitor sensitive data on Windows devices](https://cloudblogs.microsoft.com/microsoftsecure/2019/01/17/windows-defender-atp-integrates-with-microsoft-information-protection-to-discover-protect-and-monitor-sensitive-data-on-windows-devices/). +> Read our blog post about how [Microsoft Defender ATP integrates with Microsoft Information Protection to discover, protect, and monitor sensitive data on Windows devices](https://cloudblogs.microsoft.com/microsoftsecure/2019/01/17/windows-defender-atp-integrates-with-microsoft-information-protection-to-discover-protect-and-monitor-sensitive-data-on-windows-devices/). ## Prerequisites - Endpoints need to be on Windows 10, version 1809 or later -- You'll need the appropriate license to leverage the Windows Defender ATP and Azure Information Protection integration +- You'll need the appropriate license to leverage the Microsoft Defender ATP and Azure Information Protection integration - Your tenant needs to be onboarded to Azure Information Protection analytics, for more information see, [Configure a Log Analytics workspace for the reports](https://docs.microsoft.comazure/information-protection/reports-aip#configure-a-log-analytics-workspace-for-the-reports) @@ -44,10 +46,10 @@ Learn how you can use Windows Defender ATP to expand the coverage of Windows Inf 4. Repeat for every label that you want to get WIP applied to in Windows. -After completing these steps Windows Defender ATP will automatically identify labeled documents stored on the device and enable WIP on them. +After completing these steps Microsoft Defender ATP will automatically identify labeled documents stored on the device and enable WIP on them. >[!NOTE] ->- The Windows Defender ATP configuration is pulled every 15 minutes. Allow up to 30 minutes for the new policy to take effect and ensure that the endpoint is online. Otherwise, it will not receive the policy. +>- The Microsoft Defender ATP configuration is pulled every 15 minutes. Allow up to 30 minutes for the new policy to take effect and ensure that the endpoint is online. Otherwise, it will not receive the policy. >- Data forwarded to Azure Information Protection is stored in the same location as your other Azure Information Protection data. ## Related topic diff --git a/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md b/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md similarity index 50% rename from windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md rename to windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md index be963a981f..b730b7906e 100644 --- a/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md @@ -18,56 +18,56 @@ ms.topic: conceptual # Information protection in Windows overview **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) [!include[Prerelease information](prerelease.md)] Information protection is an integral part of Microsoft 365 Enterprise suite, providing intelligent protection to keep sensitive data secure while enabling productivity in the workplace. -Windows Defender ATP is seamlessly integrated in Microsoft Threat Protection to provide a complete and comprehensive data loss prevention (DLP) solution for Windows devices. This solution is delivered and managed as part of the unified Microsoft 365 information protection suite. +Microsoft Defender ATP is seamlessly integrated in Microsoft Threat Protection to provide a complete and comprehensive data loss prevention (DLP) solution for Windows devices. This solution is delivered and managed as part of the unified Microsoft 365 information protection suite. >[!TIP] -> Read our blog post about how [Windows Defender ATP integrates with Microsoft Information Protection to discover, protect, and monitor sensitive data on Windows devices](https://cloudblogs.microsoft.com/microsoftsecure/2019/01/17/windows-defender-atp-integrates-with-microsoft-information-protection-to-discover-protect-and-monitor-sensitive-data-on-windows-devices/). +> Read our blog post about how [Microsoft Defender ATP integrates with Microsoft Information Protection to discover, protect, and monitor sensitive data on Windows devices](https://cloudblogs.microsoft.com/microsoftsecure/2019/01/17/windows-defender-atp-integrates-with-microsoft-information-protection-to-discover-protect-and-monitor-sensitive-data-on-windows-devices/). -Windows Defender ATP applies two methods to discover and protect data: +Microsoft Defender ATP applies two methods to discover and protect data: - **Data discovery** - Identify sensitive data on Windows devices at risk - **Data protection** - Windows Information Protection (WIP) as outcome of Azure Information Protection label ## Data discovery -Windows Defender ATP automatically discovers files with sensitivity labels on Windows devices when the feature is enabled. You can enable the Azure Information Protection integration feature from Windows Defender Security Center. For more information, see [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md#azure-information-protection). +Microsoft Defender ATP automatically discovers files with sensitivity labels on Windows devices when the feature is enabled. You can enable the Azure Information Protection integration feature from Microsoft Defender Security Center. For more information, see [Configure advanced features](advanced-features.md#azure-information-protection).  -After enabling the Azure Information Protection integration, data discovery signals are immediately forwarded to Azure Information Protection from the device. When a labeled file is created or modified on a Windows device, Windows Defender ATP automatically reports the signal to Azure Information Protection. +After enabling the Azure Information Protection integration, data discovery signals are immediately forwarded to Azure Information Protection from the device. When a labeled file is created or modified on a Windows device, Microsoft Defender ATP automatically reports the signal to Azure Information Protection. The reported signals can be viewed on the Azure Information Protection - Data discovery dashboard. ### Azure Information Protection - Data discovery dashboard -This dashboard presents a summarized discovery information of data discovered by both Windows Defender ATP and Azure Information Protection. Data from Windows Defender ATP is marked with Location Type - Endpoint. +This dashboard presents a summarized discovery information of data discovered by both Microsoft Defender ATP and Azure Information Protection. Data from Microsoft Defender ATP is marked with Location Type - Endpoint.  -Notice the Device Risk column on the right, this device risk is derived directly from Windows Defender ATP, indicating the risk level of the security device where the file was discovered, based on the active security threats detected by Windows Defender ATP. +Notice the Device Risk column on the right, this device risk is derived directly from Microsoft Defender ATP, indicating the risk level of the security device where the file was discovered, based on the active security threats detected by Microsoft Defender ATP. -Clicking the device risk level will redirect you to the device page in Windows Defender ATP, where you can get a comprehensive view of the device security status and its active alerts. +Clicking the device risk level will redirect you to the device page in Microsoft Defender ATP, where you can get a comprehensive view of the device security status and its active alerts. >[!NOTE] ->Windows Defender ATP does not currently report the Information Types. +>Microsoft Defender ATP does not currently report the Information Types. ### Log Analytics -Data discovery based on Windows Defender ATP is also available in [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-overview), where you can perform complex queries over the raw data. +Data discovery based on Microsoft Defender ATP is also available in [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-overview), where you can perform complex queries over the raw data. For more information on Azure Information Protection analytics, see [Central reporting for Azure Information Protection](https://docs.microsoft.com/azure/information-protection/reports-aip). Open Azure Log Analytics in Azure Portal and open a query builder (standard or classic). -To view Windows Defender ATP data, perform a query that contains: +To view Microsoft Defender ATP data, perform a query that contains: ``` @@ -77,20 +77,20 @@ InformationProtectionLogs_CL **Prerequisites:** - Customers must have a subscription for Azure Information Protection. -- Enable Azure Information Protection integration in Windows Defender Security Center: - - Go to **Settings** in Windows Defender Security Center, click on **Advanced Settings** under **General**. +- Enable Azure Information Protection integration in Microsoft Defender Security Center: + - Go to **Settings** in Microsoft Defender Security Center, click on **Advanced Settings** under **General**. ## Data protection -For data to be protected, they must first be identified through labels. Sensitivity labels are created in Office Security and Compliance (SCC). Windows Defender ATP then uses the labels to identify endpoints that need Windows Information Protection (WIP) applied on them. +For data to be protected, they must first be identified through labels. Sensitivity labels are created in Office Security and Compliance (SCC). Microsoft Defender ATP then uses the labels to identify endpoints that need Windows Information Protection (WIP) applied on them. -When you create sensitivity labels, you can set the information protection functionalities that will be applied on the file. The setting that applies to Windows Defender ATP is the Data loss prevention. You'll need to turn on the Data loss prevention and select Enable Windows end point protection (DLP for devices). +When you create sensitivity labels, you can set the information protection functionalities that will be applied on the file. The setting that applies to Microsoft Defender ATP is the Data loss prevention. You'll need to turn on the Data loss prevention and select Enable Windows end point protection (DLP for devices).  -Once, the policy is set and published, Windows Defender ATP automatically enables WIP for labeled files. When a labeled file is created or modified on a Windows device, Windows Defender ATP automatically detects it and enables WIP on that file if its label corresponds with Office Security and Compliance (SCC) policy. +Once, the policy is set and published, Microsoft Defender ATP automatically enables WIP for labeled files. When a labeled file is created or modified on a Windows device, Microsoft Defender ATP automatically detects it and enables WIP on that file if its label corresponds with Office Security and Compliance (SCC) policy. This functionality expands the coverage of WIP to protect files based on their label, regardless of their origin. diff --git a/windows/security/threat-protection/windows-defender-atp/initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation.md similarity index 82% rename from windows/security/threat-protection/windows-defender-atp/initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md rename to windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation.md index 7e91cf5285..16b8d8a428 100644 --- a/windows/security/threat-protection/windows-defender-atp/initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation.md @@ -18,7 +18,7 @@ ms.topic: article # Initiate machine investigation API (Preview) **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) > [!IMPORTANT] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. @@ -26,14 +26,14 @@ ms.topic: article Initiate AutoIR investigation on a machine. >[!Note] -> This page focuses on performing an automated investigation on a machine. See [Automated Investigation](automated-investigations-windows-defender-advanced-threat-protection.md) for more information. +> This page focuses on performing an automated investigation on a machine. See [Automated Investigation](automated-investigations.md) for more information. ## Limitations 1. The number of executions is limited (up to 5 calls per hour). -2. For Automated Investigation limitations, see [Automated Investigation](automated-investigations-windows-defender-advanced-threat-protection.md). +2. For Automated Investigation limitations, see [Automated Investigation](automated-investigations.md). ## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) Permission type | Permission | Permission display name :---|:---|:--- @@ -42,8 +42,8 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' >[!Note] > When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'Alerts Investigation' (See [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) for more information) ->- The user needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) for more information) +>- The user needs to have at least the following role permission: 'Alerts Investigation' (See [Create and manage roles](user-roles.md) for more information) +>- The user needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information) ## HTTP request ``` @@ -73,7 +73,7 @@ If successful, this method returns 200 OK response code with object that holds t Here is an example of the request. -[!include[Improve request performance](improverequestperformance-new.md)] +[!include[Improve request performance](improve-request-performance.md)] ``` POST https://api.securitycenter.windows.com/api/machines/fb9ab6be3965095a09c057be7c90f0a2/InitiateInvestigation diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md similarity index 79% rename from windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md index 1c60dae5b7..275fc11cea 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md @@ -1,5 +1,5 @@ --- -title: Investigate Windows Defender Advanced Threat Protection alerts +title: Investigate Microsoft Defender Advanced Threat Protection alerts description: Use the investigation options to get details on alerts are affecting your network, what they mean, and how to resolve them. keywords: investigate, investigation, machines, machine, alerts queue, dashboard, IP address, file, submit, submissions, deep analysis, timeline, search, domain, URL, IP search.product: eADQiWindows 10XVcnh @@ -18,28 +18,28 @@ ms.topic: article ms.date: 04/24/2018 --- -# Investigate Windows Defender Advanced Threat Protection alerts +# Investigate Microsoft Defender Advanced Threat Protection alerts **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatealerts-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatealerts-abovefoldlink) Investigate alerts that are affecting your network, understand what they mean, and how to resolve them. Click an alert to see the alert details view and the various tiles that provide information about the alert. -You can also manage an alert and see alert metadata along with other information that can help you make better decisions on how to approach them. You'll also see a status of the automated investigation on the upper right corner. Clicking on the link will take you to the Automated investigations view. For more information, see [Automated investigations](automated-investigations-windows-defender-advanced-threat-protection.md). +You can also manage an alert and see alert metadata along with other information that can help you make better decisions on how to approach them. You'll also see a status of the automated investigation on the upper right corner. Clicking on the link will take you to the Automated investigations view. For more information, see [Automated investigations](automated-investigations.md).  The alert context tile shows the where, who, and when context of the alert. As with other pages, you can click on the icon beside the name or user account to bring up the machine or user details pane. The alert details view also has a status tile that shows the status of the alert in the queue. You'll also see a description and a set of recommended actions which you can expand. -For more information about managing alerts, see [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md). +For more information about managing alerts, see [Manage alerts](manage-alerts.md). The alert details page also shows the alert process tree, an incident graph, and an artifact timeline. @@ -93,12 +93,12 @@ The **Artifact timeline** feature provides an addition view of the evidence that Selecting an alert detail brings up the **Details pane** where you'll be able to see more information about the alert such as file details, detections, instances of it observed worldwide, and in the organization. ## Related topics -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) +- [View and organize the Microsoft Defender Advanced Threat Protection Alerts queue ](alerts-queue.md) +- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts.md) +- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files.md) +- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) +- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip.md) +- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain.md) +- [Investigate a user account in Microsoft Defender ATP](investigate-user.md) diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-domain.md similarity index 63% rename from windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/investigate-domain.md index 010408840d..283772ed84 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-domain.md @@ -1,5 +1,5 @@ --- -title: Investigate Windows Defender Advanced Threat Protection domains +title: Investigate Microsoft Defender Advanced Threat Protection domains description: Use the investigation options to see if machines and servers have been communicating with malicious domains. keywords: investigate domain, domain, malicious domain, windows defender atp, alert, URL search.product: eADQiWindows 10XVcnh @@ -17,16 +17,16 @@ ms.collection: M365-security-compliance ms.topic: article ms.date: 04/24/2018 --- -# Investigate a domain associated with a Windows Defender ATP alert +# Investigate a domain associated with a Microsoft Defender ATP alert **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatedomain-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatedomain-abovefoldlink) Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. @@ -60,10 +60,10 @@ The **Most recent observed machinew with URL** section provides a chronological 5. Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. ## Related topics -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) +- [View and organize the Microsoft Defender Advanced Threat Protection Alerts queue ](alerts-queue.md) +- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts.md) +- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts.md) +- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files.md) +- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) +- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip.md) +- [Investigate a user account in Microsoft Defender ATP](investigate-user.md) diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md similarity index 68% rename from windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/investigate-files.md index cf4b455f24..fc752990fc 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md @@ -1,5 +1,5 @@ --- -title: Investigate Windows Defender Advanced Threat Protection files +title: Investigate Microsoft Defender Advanced Threat Protection files description: Use the investigation options to get details on files associated with alerts, behaviours, or events. keywords: investigate, investigation, file, malicious activity, attack motivation, deep analysis, deep analysis report search.product: eADQiWindows 10XVcnh @@ -17,16 +17,16 @@ ms.collection: M365-security-compliance ms.topic: article ms.date: 04/24/2018 --- -# Investigate a file associated with a Windows Defender ATP alert +# Investigate a file associated with a Microsoft Defender ATP alert **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatefiles-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatefiles-abovefoldlink) Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. @@ -41,9 +41,9 @@ You can get information from the following sections in the file view: - Most recent observed machines with file ## File worldwide and Deep analysis -The file details, malware detection, and prevalence worldwide sections display various attributes about the file. You’ll see actions you can take on the file. For more information on how to take action on a file, see [Take response action on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md). +The file details, malware detection, and prevalence worldwide sections display various attributes about the file. You’ll see actions you can take on the file. For more information on how to take action on a file, see [Take response action on a file](respond-file-alerts.md). -You'll see details such as the file’s MD5, the VirusTotal detection ratio and Windows Defender AV detection if available, and the file’s prevalence worldwide. You'll also be able to [submit a file for deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis). +You'll see details such as the file’s MD5, the VirusTotal detection ratio and Windows Defender AV detection if available, and the file’s prevalence worldwide. You'll also be able to [submit a file for deep analysis](respond-file-alerts.md#deep-analysis).  @@ -65,10 +65,10 @@ The **Most recent observed machines with the file** section allows you to specif This allows for greater accuracy in defining entities to display such as if and when an entity was observed in the organization. For example, if you’re trying to identify the origin of a network communication to a certain IP Address within a 10-minute period on a given date, you can specify that exact time interval, and see only files that communicated with that IP Address at that time, drastically reducing unnecessary scrolling and searching. ## Related topics -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [View and organize the Microsoft Defender Advanced Threat Protection Alerts queue ](alerts-queue.md) +- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts.md) +- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts.md) +- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) +- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip.md) +- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain.md) +- [Investigate a user account in Microsoft Defender ATP](investigate-user.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents.md similarity index 77% rename from windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/investigate-incidents.md index 47c0edb764..cddaa7e5f6 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents.md @@ -1,5 +1,5 @@ --- -title: Investigate incidents in Windows Defender ATP +title: Investigate incidents in Microsoft Defender ATP description: See associated alerts, manage the incident, and see alert metadata to help you investigate an incident keywords: investigate, incident, alerts, metadata, risk, detection source, affected machines, patterns, correlation search.product: eADQiWindows 10XVcnh @@ -17,10 +17,10 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Investigate incidents in Windows Defender ATP +# Investigate incidents in Microsoft Defender ATP **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Investigate incidents that affect your network, understand what they mean, and collate evidence to resolve them. @@ -44,10 +44,10 @@ Alerts are grouped into incidents based on the following reasons:  -You can also manage an alert and see alert metadata along with other information. For more information, see [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md). +You can also manage an alert and see alert metadata along with other information. For more information, see [Investigate alerts](investigate-alerts.md). ### Machines -You can also investigate the machines that are part of, or related to, a given incident. For more information, see [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md). +You can also investigate the machines that are part of, or related to, a given incident. For more information, see [Investigate machines](investigate-machines.md).  @@ -57,13 +57,13 @@ Select **Investigations** to see all the automatic investigations launched by th  ## Going through the evidence -Windows Defender Advanced Threat Protection automatically investigates all the incidents' supported events and suspicious entities in the alerts, providing you with auto-response and information about the important files, processes, services, and more. This helps quickly detect and block potential threats in the incident. +Microsoft Defender Advanced Threat Protection automatically investigates all the incidents' supported events and suspicious entities in the alerts, providing you with auto-response and information about the important files, processes, services, and more. This helps quickly detect and block potential threats in the incident. Each of the analyzed entities will be marked as infected, remediated, or suspicious.  ## Visualizing associated cybersecurity threats -Windows Defender Advanced Threat Protection aggregates the threat information into an incident so you can see the patterns and correlations coming in from various data points. You can view such correlation through the incident graph. +Microsoft Defender Advanced Threat Protection aggregates the threat information into an incident so you can see the patterns and correlations coming in from various data points. You can view such correlation through the incident graph. ### Incident graph The **Graph** tells the story of the cybersecurity attack. For example, it shows you what was the entry point, which indicator of compromise or activity was observed on which machine. etc. @@ -77,6 +77,6 @@ You can click the circles on the incident graph to view the details of the malic ## Related topics - [Incidents queue](incidents-queue.md) - [View and organize the Incidents queue](view-incidents-queue.md) -- [Manage incidents](manage-incidents-windows-defender-advanced-threat-protection.md) +- [Manage incidents](manage-incidents.md) diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-ip.md similarity index 68% rename from windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/investigate-ip.md index cf77b8afb9..fda84c5cce 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-ip.md @@ -17,16 +17,16 @@ ms.collection: M365-security-compliance ms.topic: article ms.date: 04/24/2018 --- -# Investigate an IP address associated with a Windows Defender ATP alert +# Investigate an IP address associated with a Microsoft Defender ATP alert **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigateip-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigateip-abovefoldlink) Examine possible communication between your machines and external internet protocol (IP) addresses. @@ -67,10 +67,10 @@ Use the search filters to define the search criteria. You can also use the timel Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. ## Related topics -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) -- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) +- [View and organize the Microsoft Defender Advanced Threat Protection Alerts queue ](alerts-queue.md) +- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts.md) +- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts.md) +- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files.md) +- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) +- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain.md) +- [Investigate a user account in Microsoft Defender ATP](investigate-user.md) diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md similarity index 76% rename from windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md index 2b9d2d90f5..c8a7e86f97 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md @@ -1,5 +1,5 @@ --- -title: Investigate machines in the Windows Defender ATP Machines list +title: Investigate machines in the Microsoft Defender ATP Machines list description: Investigate affected machines by reviewing alerts, network connection information, adding machine tags and groups, and checking the service health. keywords: machines, tags, groups, endpoint, alerts queue, alerts, machine name, domain, last seen, internal IP, active alerts, threat category, filter, sort, review alerts, network, connection, type, password stealer, ransomware, exploit, threat, low severity, service heatlh search.product: eADQiWindows 10XVcnh @@ -18,21 +18,21 @@ ms.topic: article ms.date: 09/18/2018 --- -# Investigate machines in the Windows Defender ATP Machines list +# Investigate machines in the Microsoft Defender ATP Machines list **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatemachines-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatemachines-abovefoldlink) ## Investigate machines Investigate the details of an alert raised on a specific machine to identify other behaviors or events that might be related to the alert or the potential scope of breach. You can click on affected machines whenever you see them in the portal to open a detailed report about that machine. Affected machines are identified in the following areas: -- The [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) -- The [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- The [Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md) +- The [Machines list](investigate-machines.md) +- The [Alerts queue](alerts-queue.md) +- The [Security operations dashboard](security-operations-dashboard.md) - Any individual alert - Any individual file details view - Any IP address or domain details view @@ -49,7 +49,7 @@ The machine details, logged on users, machine risk, and machine reporting sectio **Machine details** The machine details tile provides information such as the domain and OS of the machine. If there's an investigation package available on the machine, you'll see a link that allows you to download the package. -For more information on how to take action on a machine, see [Take response action on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md). +For more information on how to take action on a machine, see [Take response action on a machine](respond-machine-alerts.md). **Logged on users** @@ -62,7 +62,7 @@ Clicking on the logged on users in the Logged on users tile opens the Users Deta You'll also see details such as logon types for each user account, the user group, and when the account logon occurred. - For more information, see [Investigate user entities](investigate-user-windows-defender-advanced-threat-protection.md). + For more information, see [Investigate user entities](investigate-user.md). **Machine risk** The Machine risk tile shows the overall risk assessment of a machine. A machine's risk level can be determined using the number of active alerts or by a combination of multiple risks that may increase the risk assessment and their severity levels. You can influence a machine's risk level by resolving associated alerts manually or automatically and also by suppressing an alert. It's also indicators of the active threats that machines could be exposed to. @@ -71,7 +71,7 @@ The Machine risk tile shows the overall risk assessment of a machine. A machine' If you have enabled the Azure ATP feature and there are alerts related to the machine, you can click on the link that will take you to the Azure ATP page where more information about the alerts are provided. >[!NOTE] ->You'll need to enable the integration on both Azure ATP and Windows Defender ATP to use this feature. In Windows Defender ATP, you can enable this feature in advanced features. For more information on how to enable advanced features, see [Turn on advanced features](advanced-features-windows-defender-advanced-threat-protection.md). +>You'll need to enable the integration on both Azure ATP and Microsoft Defender ATP to use this feature. In Microsoft Defender ATP, you can enable this feature in advanced features. For more information on how to enable advanced features, see [Turn on advanced features](advanced-features.md). **Machine reporting** Provides the last internal IP and external IP of the machine. It also shows when the machine was first and last seen reporting to the service. @@ -81,7 +81,7 @@ The **Alerts related to this machine** section provides a list of alerts that ar  -This list is a filtered version of the [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows the date when the alert's last activity was detected, a short description of the alert, the user account associated with the alert, the alert's severity, the alert's status in the queue, and who is addressing the alert. +This list is a filtered version of the [Alerts queue](alerts-queue.md), and shows the date when the alert's last activity was detected, a short description of the alert, the user account associated with the alert, the alert's severity, the alert's status in the queue, and who is addressing the alert. You can also choose to highlight an alert from the **Alerts related to this machine** or from the **Machine timeline** section to see the correlation between the alert and its related events on the machine by right-clicking on the alert and selecting **Select and mark events**. This highlights the alert and its related events and helps distinguish them from other alerts and events appearing in the timeline. Highlighted events are displayed in all information levels whether you choose to view the timeline by **Detections**, **Behaviors**, or **Verbose**. @@ -92,7 +92,7 @@ This feature also enables you to selectively drill down into events that occurre  -Windows Defender ATP monitors and captures suspicious or anomalous behavior on Windows 10 machines and displays the process tree flow in the **Machine timeline**. This gives you better context of the behavior which can contribute to understanding the correlation between events, files, and IP addresses in relation to the machine. +Microsoft Defender ATP monitors and captures suspicious or anomalous behavior on Windows 10 machines and displays the process tree flow in the **Machine timeline**. This gives you better context of the behavior which can contribute to understanding the correlation between events, files, and IP addresses in relation to the machine. ### Search for specific events @@ -114,7 +114,7 @@ Use the search bar to look for specific timeline events. Harness the power of us - Behaviors mode: displays "detections" and selected events of interest - Verbose mode: displays all raw events without aggregation or filtering -- **Event type** - Click the drop-down button to filter by events such as Windows - Windows Defender ATP alerts, Windows Defender Application Guard events, registry events, file events, and others. +- **Event type** - Click the drop-down button to filter by events such as Windows - Microsoft Defender ATP alerts, Windows Defender Application Guard events, registry events, file events, and others. Filtering by event type allows you to define precise queries so that you see events with a specific focus. For example, you can search for a file name, then filter the results to only see Process events matching the search criteria or to only view file events, or even better: to view only network events over a period of time to make sure no suspicious outbound communications go unnoticed. @@ -163,7 +163,7 @@ From the list of events that are displayed in the timeline, you can examine the  -You can also use the [Artifact timeline](investigate-alerts-windows-defender-advanced-threat-protection.md#artifact-timeline) feature to see the correlation between alerts and events on a specific machine. +You can also use the [Artifact timeline](investigate-alerts.md#artifact-timeline) feature to see the correlation between alerts and events on a specific machine. Expand an event to view associated processes related to the event. Click on the circle next to any process or IP address in the process tree to investigate additional details of the identified processes. This action brings up the **Details pane** which includes execution context of processes, network communications and a summary of meta data on the file or IP address. @@ -173,10 +173,10 @@ The details pane enriches the â€in-context’ information across investigation ## Related topics -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) +- [View and organize the Microsoft Defender Advanced Threat Protection Alerts queue ](alerts-queue.md) +- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts.md) +- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts.md) +- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files.md) +- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip.md) +- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain.md) +- [Investigate a user account in Microsoft Defender ATP](investigate-user.md) diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-user.md similarity index 64% rename from windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/investigate-user.md index 4260159191..69493fe5ec 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-user.md @@ -1,5 +1,5 @@ --- -title: Investigate a user account in Windows Defender ATP +title: Investigate a user account in Microsoft Defender ATP description: Investigate a user account for potential compromised credentials or pivot on the associated user account during an investigation. keywords: investigate, account, user, user entity, alert, windows defender atp search.product: eADQiWindows 10XVcnh @@ -17,15 +17,15 @@ ms.collection: M365-security-compliance ms.topic: article ms.date: 04/24/2018 --- -# Investigate a user account in Windows Defender ATP +# Investigate a user account in Microsoft Defender ATP **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatgeuser-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatgeuser-abovefoldlink) ## Investigate user account entities Identify user accounts with the most active alerts (displayed on dashboard as "Users at risk") and investigate cases of potential compromised credentials, or pivot on the associated user account when investigating an alert or machine to identify possible lateral movement between machines with that user account. @@ -53,14 +53,14 @@ The user entity tile provides details about the user such as when the user was f If you have enabled the Azure ATP feature and there are alerts related to the user, you can click on the link that will take you to the Azure ATP page where more information about the alerts are provided. The Azure ATP tile also provides details such as the last AD site, total group memberships, and login failure associated with the user. >[!NOTE] ->You'll need to enable the integration on both Azure ATP and Windows Defender ATP to use this feature. In Windows Defender ATP, you can enable this feature in advanced features. For more information on how to enable advanced features, see [Turn on advanced features](advanced-features-windows-defender-advanced-threat-protection.md). +>You'll need to enable the integration on both Azure ATP and Microsoft Defender ATP to use this feature. In Microsoft Defender ATP, you can enable this feature in advanced features. For more information on how to enable advanced features, see [Turn on advanced features](advanced-features.md). **Logged on machines** You'll also see a list of the machines that the user logged on to, and can expand these to see details of the logon events on each machine. ## Alerts related to this user -This section provides a list of alerts that are associated with the user account. This list is a filtered view of the [Alert queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows alerts where the user context is the selected user account, the date when the last activity was detected, a short description of the alert, the machine associated with the alert, the alert's severity, the alert's status in the queue, and who is assigned the alert. +This section provides a list of alerts that are associated with the user account. This list is a filtered view of the [Alert queue](alerts-queue.md), and shows alerts where the user context is the selected user account, the date when the last activity was detected, a short description of the alert, the machine associated with the alert, the alert's severity, the alert's status in the queue, and who is assigned the alert. ## Observed in organization This section allows you to specify a date range to see a list of machines where this user was observed logged on to, and the most frequent and least frequent logged on user account on each of these machines. @@ -85,11 +85,11 @@ You can filter the results by the following time periods: - 6 months ## Related topics -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) +- [View and organize the Microsoft Defender Advanced Threat Protection Alerts queue ](alerts-queue.md) +- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts.md) +- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts.md) +- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files.md) +- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) +- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip.md) +- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain.md) diff --git a/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md similarity index 79% rename from windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md rename to windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md index fbf715ebd3..408e800158 100644 --- a/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md @@ -17,13 +17,15 @@ ms.topic: article --- # Was domain seen in org + **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Answers whether a domain was seen in the organization. ## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) Permission type | Permission | Permission display name :---|:---|:--- @@ -32,7 +34,7 @@ Delegated (work or school account) | URL.Read.All | 'Read URLs' >[!Note] > When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) for more information) +>- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information) ## HTTP request ``` @@ -58,7 +60,7 @@ If successful and domain exists - 200 OK. If domain does not exist - 404 Not Fou Here is an example of the request. -[!include[Improve request performance](improverequestperformance-new.md)] +[!include[Improve request performance](improve-request-performance.md)] ``` GET https://api.securitycenter.windows.com/api/domains/example.com diff --git a/windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org.md similarity index 78% rename from windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md rename to windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org.md index 73631e76cb..3239831649 100644 --- a/windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org.md @@ -17,14 +17,15 @@ ms.topic: article --- # Was IP seen in org -**Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Answers whether an IP was seen in the organization. ## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) Permission type | Permission | Permission display name :---|:---|:--- @@ -33,7 +34,7 @@ Delegated (work or school account) | Ip.Read.All | 'Read IP address profiles' >[!Note] > When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) for more information) +>- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information) ## HTTP request ``` @@ -68,7 +69,7 @@ GET https://api.securitycenter.windows.com/api/ips/10.209.67.177 Here is an example of the response. -[!include[Improve request performance](improverequestperformance-new.md)] +[!include[Improve request performance](improve-request-performance.md)] ``` diff --git a/windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md similarity index 80% rename from windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md rename to windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md index 66ef8c4c99..095c078b1f 100644 --- a/windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md @@ -17,15 +17,17 @@ ms.topic: article --- # Isolate machine API + **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Isolates a machine from accessing external network. [!include[Machine actions note](machineactionsnote.md)] ## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) Permission type | Permission | Permission display name :---|:---|:--- @@ -34,8 +36,8 @@ Delegated (work or school account) | Machine.Isolate | 'Isolate machine' >[!Note] > When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'Active remediation actions' (See [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) for more information) ->- The user needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) for more information) +>- The user needs to have at least the following role permission: 'Active remediation actions' (See [Create and manage roles](user-roles.md) for more information) +>- The user needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information) ## HTTP request @@ -60,11 +62,11 @@ IsolationType | String | Type of the isolation. Allowed values are: 'Full' or 'S **IsolationType** controls the type of isolation to perform and can be one of the following: - Full – Full isolation -- Selective – Restrict only limited set of applications from accessing the network (see [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) for more details) +- Selective – Restrict only limited set of applications from accessing the network (see [Isolate machines from the network](respond-machine-alerts.md#isolate-machines-from-the-network) for more details) ## Response -If successful, this method returns 201 - Created response code and [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) in the response body. +If successful, this method returns 201 - Created response code and [Machine Action](machineaction.md) in the response body. ## Example @@ -73,7 +75,7 @@ If successful, this method returns 201 - Created response code and [Machine Acti Here is an example of the request. -[!include[Improve request performance](improverequestperformance-new.md)] +[!include[Improve request performance](improve-request-performance.md)] ``` POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/isolate @@ -106,4 +108,4 @@ Content-type: application/json ``` -To unisolate a machine, see [Release machine from isolation](unisolate-machine-windows-defender-advanced-threat-protection-new.md). +To unisolate a machine, see [Release machine from isolation](unisolate-machine.md). diff --git a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/licensing.md similarity index 62% rename from windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/licensing.md index 9560bb473f..c0acd27220 100644 --- a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/licensing.md @@ -1,6 +1,6 @@ --- -title: Validate licensing provisioning and complete Windows Defender ATP set up -description: Validating licensing provisioning, setting up initial preferences, and completing the user set up for Windows Defender Advanced Threat Protection portal. +title: Validate licensing provisioning and complete Microsoft Defender ATP set up +description: Validating licensing provisioning, setting up initial preferences, and completing the user set up for Microsoft Defender Advanced Threat Protection portal. keywords: license, licensing, account, set up, validating licensing, windows defender atp search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -17,14 +17,14 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Validate licensing provisioning and complete set up for Windows Defender ATP +# Validate licensing provisioning and complete set up for Microsoft Defender ATP **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-validatelicense-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-validatelicense-abovefoldlink) ## Check license state @@ -50,13 +50,13 @@ To gain access into which licenses are provisioned to your company, and to check  -## Access Windows Defender Security Center for the first time +## Access Microsoft Defender Security Center for the first time -When accessing [Windows Defender Security Center](https://SecurityCenter.Windows.com) for the first time there will be a setup wizard that will guide you through some initial steps. At the end of the setup wizard there will be a dedicated cloud instance of Windows Defender ATP created. +When accessing [Microsoft Defender Security Center](https://SecurityCenter.Windows.com) for the first time there will be a setup wizard that will guide you through some initial steps. At the end of the setup wizard there will be a dedicated cloud instance of Microsoft Defender ATP created. 1. Each time you access the portal you will need to validate that you are authorized to access the product. This **Set up your permissions** step will only be available if you are not currently authorized to access the product. -  +  Once the authorization step is completed, the **Welcome** screen will be displayed. @@ -64,7 +64,7 @@ When accessing [Windows Defender Security Center](https://SecurityCenter.Windows  - You will need to set up your preferences for Windows Defender Security Center. + You will need to set up your preferences for Microsoft Defender Security Center. 3. Set up preferences @@ -73,9 +73,9 @@ When accessing [Windows Defender Security Center](https://SecurityCenter.Windows 1. **Select data storage location**
When onboarding the service for the first time, you can choose to store your data in the Microsoft Azure datacenters in the United States, the European Union, or the United Kingdom. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation. > [!WARNING] - > This option cannot be changed without completely offboarding from Windows Defender ATP and completing a new enrollment process. + > This option cannot be changed without completely offboarding from Microsoft Defender ATP and completing a new enrollment process. - 2. **Select the data retention policy**
Windows Defender ATP will store data up to a period of 6 months in your cloud instance, however, you have the option to set the data retention period for a shorter timeframe during this step of the set up process. + 2. **Select the data retention policy**
Microsoft Defender ATP will store data up to a period of 6 months in your cloud instance, however, you have the option to set the data retention period for a shorter timeframe during this step of the set up process. > [!NOTE] > This option can be changed at a later time. @@ -85,7 +85,7 @@ When accessing [Windows Defender Security Center](https://SecurityCenter.Windows > [!NOTE] > The **organization size** question is not related to how many licenses were purchased for your organization. It is used by the service to optimize the creation of the data cluster for your organization. - 4. **Turn on preview features**
Learn about new features in the Windows Defender ATP preview release and be among the first to try upcoming features by turning on **Preview features**. + 4. **Turn on preview features**
Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on **Preview features**. You'll have access to upcoming features which you can provide feedback on to help improve the overall experience before features are generally available. @@ -97,30 +97,30 @@ When accessing [Windows Defender Security Center](https://SecurityCenter.Windows 4. You will receive a warning notifying you that you won't be able to change some of your preferences once you click **Continue**. > [!NOTE] - > Some of these options can be changed at a later time in Windows Defender Security Center. + > Some of these options can be changed at a later time in Microsoft Defender Security Center.  -5. A dedicated cloud instance of Windows Defender Security Center is being created at this time. This step will take an average of 5 minutes to complete. +5. A dedicated cloud instance of Microsoft Defender Security Center is being created at this time. This step will take an average of 5 minutes to complete. -  +  -6. You are almost done. Before you can start using Windows Defender ATP you'll need to: +6. You are almost done. Before you can start using Microsoft Defender ATP you'll need to: - - [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) + - [Onboard Windows 10 machines](configure-endpoints.md) - Run detection test (optional)  > [!IMPORTANT] - > If you click **Start using Windows Defender ATP** before onboarding machines you will receive the following notification: + > If you click **Start using Microsoft Defender ATP** before onboarding machines you will receive the following notification: > -7. After onboarding machines you can click **Start using Windows Defender ATP**. You will now launch Windows Defender ATP for the first time. +7. After onboarding machines you can click **Start using Microsoft Defender ATP**. You will now launch Microsoft Defender ATP for the first time.  ## Related topics -- [Onboard machines to the Windows Defender Advanced Threat Protection service](onboard-configure-windows-defender-advanced-threat-protection.md) -- [Troubleshoot onboarding process and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) +- [Onboard machines to the Microsoft Defender Advanced Threat Protection service](onboard-configure.md) +- [Troubleshoot onboarding process and portal access issues](troubleshoot-onboarding-error-messages.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response-command-examples.md b/windows/security/threat-protection/microsoft-defender-atp/live-response-command-examples.md new file mode 100644 index 0000000000..149999abec --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response-command-examples.md @@ -0,0 +1,212 @@ +--- +title: Live response command examples +description: Learn about common commands and see examples on how it's used +keywords: example, command, cli, remote, shell, connection, live, response, real-time, command, script, remediate, hunt, export, log, drop, download, file +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Live response command examples + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf) + + +Learn about common commands used in live response and see examples on how they are typically used. + +Depending on the role that's been granted to you, you can run basic or advanced live response commands. For more information on basic and advanced commands, see [Investigate entities on machines using live response](live-response.md). + + +## analyze + +``` +# Analyze the file malware.txt +analyze file c:\Users\user\Desktop\malware.txt +``` + +``` +# Analyze the process by PID +analyze process 1234 +``` + +## connections + +``` +# List active connections in json format using parameter name +connections -output json +``` + +``` +# List active connections in json format without parameter name +connections json +``` + +## dir + +``` +# List files and sub-folders in the current folder +dir +``` + +``` +# List files and sub-folders in a specific folder +dir C:\Users\user\Desktop\ +``` + +``` +# List files and subfolders in the current folder in json format +dir -output json +``` + +## fileinfo + +``` +# Display information about a file +fileinfo C:\Windows\notepad.exe +``` + +## findfile + +``` +# Find file by name +findfile test.txt +``` + +## getfile + +``` +# Download a file from a machine +getfile c:\Users\user\Desktop\work.txt +``` + +``` +# Download a file from a machine, automatically run prerequisite commands +getfile c:\Users\user\Desktop\work.txt -auto +``` + +## processes +``` +# Show all processes +processes +``` + +``` +# Get process by pid +processes 123 +``` + +``` +# Get process by pid with argument name +processes -pid 123 +``` + +``` +# Get process by name +processes -name notepad.exe +``` + +## putfile + +``` +# Upload file from library +putfile get-process-by-name.ps1 +``` + +``` +# Upload file from library, overwrite file if it exists +putfile get-process-by-name.ps1 -overwrite +``` + +``` +# Upload file from library, keep it on the machine after a restart +putfile get-process-by-name.ps1 -keep +``` + +## registry + +``` +# Show information about the values in a registry key +registry HKEY_CURRENT_USER\Console +``` + +``` +# Show information about a specific registry value +registry HKEY_CURRENT_USER\Console\\ScreenBufferSize +``` + + +## remediate + +``` +# Remediate file in specific path +remediate file c:\Users\user\Desktop\malware.exe +``` + +``` +# Remediate process with specific PID +remediate process 7960 +``` + +``` +# See list of all remediated entities +remediate list +``` + +## run + +``` +# Run PowerShell script from the library without arguments +run script.ps1 +``` + +``` +# Run PowerShell script from the library with arguments +run get-process-by-name.ps1 -parameters "-processName Registry" +``` + +## scheduledtask + +``` +# Get all scheduled tasks +scheduledtasks +``` + +``` +# Get specific scheduled task by location and name +scheduledtasks Microsoft\Windows\Subscription\LicenseAcquisition +``` + +``` +# Get specific scheduled task by location and name with spacing +scheduledtasks "Microsoft\Configuration Manager\Configuration Manager Health Evaluation" +``` + + +## undo + +``` +# Restore remediated registry +undo registry HKEY_CURRENT_USER\Console\ScreenBufferSize +``` + +``` +# Restore remediated scheduledtask +undo scheduledtask Microsoft\Windows\Subscription\LicenseAcquisition +``` + +``` +# Restore remediated file +undo file c:\Users\user\Desktop\malware.exe +``` + diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md new file mode 100644 index 0000000000..aaab0a442a --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -0,0 +1,255 @@ +--- +title: Investigate entities on machines using live response in Microsoft Defender ATP +description: Access a machine using a secure remote shell connection to do investigative work and take immediate response actions on a machine in real-time. +keywords: remote, shell, connection, live, response, real-time, command, script, remediate, hunt, export, log, drop, download, file, +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Investigate entities on machines using live response + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf) + +[!include[Prerelease information](prerelease.md)] + + +Live response is a capability that gives you instantaneous access to a machine using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats – real-time. + +Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats. + +With live response, analysts will have the ability to: +- Run basic and advanced commands to do investigative work +- Download files such as malware samples and outcomes of PowerShell scripts +- Upload a PowerShell script or executable to the library and run it on the machine from a tenant level +- Take or undo remediation actions + + +## Before you begin +Before you can initiate a session on a machine, make sure you fulfill the following requirements: + +- Machines must be Windows 10, version 18323 (also known as Windows 10 19H1) or later. + +- **Enable live response from the settings page**
+You'll need to enable the live response capability in the [Advanced features settings](advanced-features.md) page. + + >[!NOTE] + >Only users with manage security or global admin roles can edit these settings. + +- **Enable live response unsigned script execution** (optional)
+ + >[!WARNING] + >Allowing the use of unsigned scripts may increase your exposure to threats. + + Running unsigned scripts is generally not recommended as it can increase your exposure to threats. If you must use them however, you'll need to enable the setting in the [Advanced features settings](advanced-features.md) page. + +- **Ensure that you have the appropriate permissions**
+ Only users who have been provisioned with the appropriate permissions can initiate a session. For more information on role assignments see, [Create and manage roles](user-roles.md). + + Depending on the role that's been granted to you, you can run basic or advanced live response commands. Users permission are controlled by RBAC custom role. + +## Live response dashboard overview +When you initiate a live response session on a machine, a dashboard opens. The dashboard provides information about the session such as: + +- Who created the session +- When the session started +- The duration of the session + +The dashboard also gives you access to: +- Disconnect session +- Upload files to the library +- Command console +- Command log + + +## Initiate a live response session on a machine + +1. Log in to Microsoft Defender Security Center. +2. Navigate to the machines list page and select a machine to investigate. The machine page opens. + + >[!NOTE] + >Machines must be on Windows 10, version 18323 (also known as Windows 10 19H1) or later. + +2. Launch the live response session by selecting **Initiate live response session**. A command console is displayed. Wait while the session connects to the machine. +3. Use the built-in commands to do investigative work. For more information see, [Live response commands](#live-response-commands). +4. After completing your investigation, select **Disconnect session**, then select **Confirm**. + + + +## Live response commands +Depending on the role that's been granted to you, you can run basic or advanced live response commands. User permissions are controlled by RBAC custom roles. For more information on role assignments see, [Create and manage roles](user-roles.md). + +### Basic commands +The following commands are available for user roles that's been granted the ability to run **basic** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md). + +Command | Description +:---|:---|:--- +cd | Changes the current directory. +cls | Clears the console screen. +connect | Initiates a live response session to the machine. +connections | Shows all the active connections. +dir | Shows a list of files and subdirectories in a directory +drivers | Shows all drivers installed on the machine. +fileinfo | Get information about a file. +findfile | Locates files by a given name on the machine. +help | Provides help information for live response commands. +persistence | Shows all known persistence methods on the machine. +processes | Shows all processes running on the machine. +registry | Shows registry values. +sheduledtasks| Shows all scheduled tasks on the machine. +services | Shows all services on the machine. +trace | Sets the terminal's logging mode to debug. + + +### Advanced commands +The following commands are available for user roles that's been granted the ability to run **advanced** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md). + +Command | Description +:---|:--- +analyze | Analyses the entity with various incrimination engines to reach a verdict. +getfile | Gets a file from the machine.
NOTE: This command has a prerequisite command. You can use the `-auto` command in conjuction with `getfile` to automatically run the prerequisite command. +run | Runs a PowerShell script from the library on the machine. +library | Lists files that were uploaded to the live response library. +putfile | Puts a file from the library to the machine. Files are saved in a working folder and are deleted when the machine restarts by default. +remediate | Remediates an entity on the machine. The remediation action will vary depending on the entity type:
- File: delete
- Process: stop, delete image file
- Service: stop, delete image file
- Registry entry: delete
- Scheduled task: remove
- Startup folder item: delete file
NOTE: This command has a prerequisite command. You can use the `-auto` command in conjuction with `remediate` to automatically run the prerequisite command. +undo | Restores an entity that was remediated. + + +## Use live response commands +The commands that you can use in the console follow similar principles as [Windows Commands](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/windows-commands#BKMK_c). + +The advanced commands offer a more robust set of actions that allow you to take more powerful actions such as download and upload a file, run scripts on the machine, and take remediation actions on an entity. + +### Get a file from the machine +For scenarios when you'd like get a file from a machine you're investigating, you can use the `getfile` command. This allows you to save the file from the machine for further investigation. + +>[!NOTE] +>There is a file size limit of 750mb. + +### Put a file in the library +Live response has a library where you can put files into. The library stores files (such as scripts) that can be run in a live response session at the tenant level. + +Live response allows PowerShell scripts to run, however you must first put the files into the library before you can run them. + +You can have a collection of PowerShell scripts that can run on machines that you initiate live response sessions with. + +**To upload a file in the library:** +1. Click **Upload file to library**. +2. Click **Browse** and select the file. +3. Provide a brief description. +4. Specify if you'd like to overwrite a file with the same name. +5. If you'd like to be know what parameters are needed for the script, select the script parameters check box. In the text field, enter an example and a description. +6. Click **Confirm**. +7. (Optional) To verify that the file was uploaded to the library, run the `library` command. + + +### Cancel a command +Anytime during a session, you can cancel a command by pressing CTRL + C. + +>[!WARNING] +>Using this shortcut will not stop the command in the agent side. It will only cancel the command in the portal. So, changing operations such as "remediate" may continue, while the command is canceled. + + + +### Automatically run prerequisite commands +Some commands have prerequisite commands to run. If you don't run the prerequisite command, you'll get an error. For example, running the `download` command without `fileinfo` will return an error. + +You can use the auto flag to automatically run prerequisite commands, for example: + +``` +getfile c:\Users\user\Desktop\work.txt -auto +``` + + +## Run a PowerShell script +Before you can run a PowerShell script, you must first upload it to the library. + +After uploading the script to the library, use the `run` command to run the script. + +If you plan to use an unsigned script in the session, you'll need to enable the setting in the [Advanced features settings](advanced-features.md) page. + +>[!WARNING] +>Allowing the use of unsigned scripts may increase your exposure to threats. + + + +## Apply command parameters +- View the console help to learn about command parameters. To learn about an individual command, run: + + `help
+ +## Properties +Property | Type | Description +:---|:---|:--- +id | Guid | Identity of the [Machine Action](machineaction.md) entity. +type | Enum | Type of the action. Possible values are: "RunAntiVirusScan", "Offboard", "CollectInvestigationPackage", "Isolate", "Unisolate", "StopAndQuarantineFile", "RestrictCodeExecution" and "UnrestrictCodeExecution" +requestor | String | Identity of the person that executed the action. +requestorComment | String | Comment that was written when issuing the action. +status | Enum | Current status of the command. Possible values are: "Pending", "InProgress", "Succeeded", "Failed", "TimeOut" and "Cancelled". +machineId | String | Id of the machine on which the action was executed. +creationDateTimeUtc | DateTimeOffset | The date and time when the action was created. +lastUpdateTimeUtc | DateTimeOffset | The last date and time when the action status was updated. +relatedFileInfo | Class | Contains two Properties. 1) string 'fileIdentifier' 2) Enum 'fileIdentifierType' with the possible values: "Sha1" ,"Sha256" and "Md5". \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote.md b/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote.md new file mode 100644 index 0000000000..2e235e713e --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote.md @@ -0,0 +1,6 @@ +--- +ms.date: 08/28/2017 +author: zavidor +--- +>[!Note] +> This page focuses on performing a machine action via API. See [take response actions on a machine](respond-machine-alerts.md) for more information about response actions functionality via Microsoft Defender ATP. diff --git a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md similarity index 85% rename from windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md index c94234e9e1..79720ee3a3 100644 --- a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md @@ -1,5 +1,5 @@ --- -title: View and organize the Windows Defender ATP machines list +title: View and organize the Microsoft Defender ATP machines list description: Learn about the available features that you can use from the Machines list such as sorting, filtering, and exporting the list to enhance investigations. keywords: sort, filter, export, csv, machine name, domain, last seen, internal IP, health state, active alerts, active malware detections, threat category, review alerts, network, connection, malware, type, password stealer, ransomware, exploit, threat, general malware, unwanted software search.product: eADQiWindows 10XVcnh @@ -18,14 +18,14 @@ ms.topic: article ms.date: 09/03/2018 --- -# View and organize the Windows Defender ATP Machines list +# View and organize the Microsoft Defender ATP Machines list **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-machinesview-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-machinesview-abovefoldlink) The **Machines list** shows a list of the machines in your network where alerts were generated. By default, the queue displays machines with alerts seen in the last 30 days. @@ -74,7 +74,7 @@ Filter the list to view specific machines grouped together by the following mach - No sensor data - Impaired communications - For more information on how to address issues on misconfigured machines see, [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md). + For more information on how to address issues on misconfigured machines see, [Fix unhealthy sensors](fix-unhealthy-sensors.md). - **Inactive** – Machines that have completely stopped sending signals for more than 7 days. @@ -85,13 +85,13 @@ Filter the list to view specific machines that are well configured or require at - **Well configured** - Machines have the Windows Defender security controls well configured. - **Requires attention** - Machines where improvements can be made to increase the overall security posture of your organization. -For more information, see [View the Secure Score dashboard](secure-score-dashboard-windows-defender-advanced-threat-protection.md). +For more information, see [View the Secure Score dashboard](secure-score-dashboard.md). ### Tags You can filter the list based on the grouping and tagging that you've added to individual machines. ## Related topics -- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md similarity index 76% rename from windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md index 170f773f33..c02a9598e4 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md @@ -1,5 +1,5 @@ --- -title: Manage Windows Defender Advanced Threat Protection alerts +title: Manage Microsoft Defender Advanced Threat Protection alerts description: Change the status of alerts, create suppression rules to hide alerts, submit comments, and review change history for individual alerts with the Manage Alert menu. keywords: manage alerts, manage, alerts, status, new, in progress, resolved, resolve alerts, suppress, supression, rules, context, history, comments, changes search.product: eADQiWindows 10XVcnh @@ -17,14 +17,14 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Manage Windows Defender Advanced Threat Protection alerts +# Manage Microsoft Defender Advanced Threat Protection alerts **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-managealerts-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-managealerts-abovefoldlink) -Windows Defender ATP notifies you of possible malicious events, attributes, and contextual information through alerts. A summary of new alerts is displayed in the **Security operations dashboard**, and you can access all alerts in the **Alerts queue**. +Microsoft Defender ATP notifies you of possible malicious events, attributes, and contextual information through alerts. A summary of new alerts is displayed in the **Security operations dashboard**, and you can access all alerts in the **Alerts queue**. You can manage alerts by selecting an alert in the **Alerts queue** or the **Alerts related to this machine** section of the machine details view. @@ -40,7 +40,7 @@ If an alert is no yet assigned, you can select **Assign to me** to assign the al ## Suppress alerts -There might be scenarios where you need to suppress alerts from appearing in Windows Defender Security Center. Windows Defender ATP lets you create suppression rules for specific alerts that are known to be innocuous such as known tools or processes in your organization. +There might be scenarios where you need to suppress alerts from appearing in Microsoft Defender Security Center. Microsoft Defender ATP lets you create suppression rules for specific alerts that are known to be innocuous such as known tools or processes in your organization. Suppression rules can be created from an existing alert. They can be disabled and reenabled if needed. @@ -91,7 +91,7 @@ Create custom rules to control when alerts are suppressed, or resolved. You can 2. The list of suppression rules shows all the rules that users in your organization have created. -For more information on managing suppression rules, see [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md) +For more information on managing suppression rules, see [Manage suppression rules](manage-suppression-rules.md) ## Change the status of an alert @@ -115,11 +115,11 @@ Added comments instantly appear on the pane. ## Related topics -- [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md) -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) +- [Manage suppression rules](manage-suppression-rules.md) +- [View and organize the Microsoft Defender Advanced Threat Protection Alerts queue ](alerts-queue.md) +- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts.md) +- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files.md) +- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) +- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip.md) +- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain.md) +- [Investigate a user account in Microsoft Defender ATP](investigate-user.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md b/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md new file mode 100644 index 0000000000..c852df752c --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md @@ -0,0 +1,84 @@ +--- +title: Manage allowed/blocked lists +description: Create indicators for a file hash, IP address, URLs or domains that define the detection, prevention, and exclusion of entities. +keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Manage allowed/blocked lists + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +[!include[Prerelease information](prerelease.md)] + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) + + +Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to. + +On the top navigation you can: +- Import a list +- Add an indicator +- Customize columns to add or remove columns +- Export the entire list in CSV format +- Select the items to show per page +- Navigate between pages +- Apply filters + +## Create an indicator +1. In the navigation pane, select **Settings** > **Allowed/blocked list**. + +2. Select the tab of the type of entity you'd like to create an indicator for. You can choose any of the following entities: + - File hash + - IP address + - URLs/Domains + +3. Click **Add indicator**. + +4. For each attribute specify the following details: + - Indicator - Specify the entity details and define the expiration of the indicator. + - Action - Specify the action to be taken and provide a description. + - Scope - Define the scope of the machine group. + +5. Review the details in the Summary tab, then click **Save**. + + +>[!NOTE] +>Blocking IPs, domains, or URLs is currently available on limited preview only. +>This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforced which is an option that will be generally available soon. +>As it is not yet generally available, when Automated investigations finds this indicator during an investigation it will use the allowed/block list as the basis of its decision to automatically remediate (blocked list) or skip (allowed list) the entity. + + +## Manage indicators +1. In the navigation pane, select **Settings** > **Allowed/blocked list**. + +2. Select the tab of the entity type you'd like to manage. + +3. Update the details of the indicator and click **Save** or click the **Delete** button if you'd like to remove the entity from the list. + +## Import a list +You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details. + +Download the sample CSV to know the supported column attributes. + + +## Related topics +- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list.md) + + + + + diff --git a/windows/security/threat-protection/windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md similarity index 97% rename from windows/security/threat-protection/windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 3b6362ab90..a96e4fe4a4 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -1,5 +1,5 @@ --- -title: Learn about the automated investigations dashboard in Windows Defender Security Center +title: Learn about the automated investigations dashboard in Microsoft Defender Security Center description: View the list of automated investigations, its status, detection source and other details. keywords: autoir, automated, investigation, detection, dashboard, source, threat types, id, tags, machines, duration, filter export search.product: eADQiWindows 10XVcnh @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 09/03/2018 --- # Learn about the automated investigations dashboard @@ -161,7 +160,7 @@ This tab is only displayed when an investigation is complete and shows all pendi ## Pending actions If there are pending actions on an Automated investigation, you'll see a pop up similar to the following image. - + When you click on the pending actions link, you'll be taken to the pending actions page. You can also navigate to the page from the navigation page by going to **Automated investigation** > **Pending actions**. @@ -196,4 +195,4 @@ From the panel, you can click on the Open investigation page link to see the inv You also have the option of selecting multiple investigations to approve or reject actions on multiple investigations. ## Related topic -- [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate Microsoft Defender ATP alerts](investigate-alerts.md) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md similarity index 80% rename from windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md index 78b40b3a95..b30f739163 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md @@ -20,11 +20,11 @@ ms.topic: article # Manage automation allowed/blocked lists **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) Create a rule to control which entities are automatically incriminated or exonerated during Automated investigations. @@ -63,6 +63,6 @@ You can define the conditions for when entities are identified as malicious or s ## Related topics -- [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) -- [Manage allowed/blocked lists](manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -- [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) +- [Manage automation file uploads](manage-automation-file-uploads.md) +- [Manage indicators](manage-indicators.md) +- [Manage automation folder exclusions](manage-automation-folder-exclusions.md) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads.md similarity index 79% rename from windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads.md index e311c292ff..cdf8cabeb1 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads.md @@ -22,11 +22,11 @@ ms.topic: article **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationefileuploads-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationefileuploads-abovefoldlink) Enable the content analysis capability so that certain files and email attachments can automatically be uploaded to the cloud for additional inspection in Automated investigation. @@ -45,5 +45,5 @@ For example, if you add *exe* and *bat* as file or attachment extension names, t ## Related topics -- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -- [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list.md) +- [Manage automation folder exclusions](manage-automation-folder-exclusions.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md similarity index 84% rename from windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md index 370187b6f0..217418bd99 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md @@ -22,11 +22,11 @@ ms.topic: article **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionfolder-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionfolder-abovefoldlink) Automation folder exclusions allow you to specify folders that the Automated investigation will skip. @@ -75,5 +75,5 @@ You can specify the file names that you want to be excluded in a specific direct ## Related topics -- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -- [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) +- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list.md) +- [Manage automation file uploads](manage-automation-file-uploads.md) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-edr.md b/windows/security/threat-protection/microsoft-defender-atp/manage-edr.md similarity index 52% rename from windows/security/threat-protection/windows-defender-atp/manage-edr.md rename to windows/security/threat-protection/microsoft-defender-atp/manage-edr.md index 38ce9039ff..11c2499489 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-edr.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-edr.md @@ -25,7 +25,7 @@ Manage the alerts queue, investigate machines in the machines list, take respons ## In this section Topic | Description :---|:--- -[Alerts queue](alerts-queue-endpoint-detection-response.md)| View the alerts surfaced in Windows Defender Security Center. -[Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) | Learn how you can view and manage the machines list, manage machine groups, and investigate machine related alerts. -[Take response actions](response-actions-windows-defender-advanced-threat-protection.md)| Take response actions on machines and files to quickly respond to detected attacks and contain threats. -[Query data using advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)| Proactively hunt for possible threats across your organization using a powerful search and query tool. \ No newline at end of file +[Alerts queue](alerts-queue-endpoint-detection-response.md)| View the alerts surfaced in Microsoft Defender Security Center. +[Machines list](machines-view-overview.md) | Learn how you can view and manage the machines list, manage machine groups, and investigate machine related alerts. +[Take response actions](response-actions.md)| Take response actions on machines and files to quickly respond to detected attacks and contain threats. +[Query data using advanced hunting](advanced-hunting.md)| Proactively hunt for possible threats across your organization using a powerful search and query tool. \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/manage-incidents-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md similarity index 90% rename from windows/security/threat-protection/windows-defender-atp/manage-incidents-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md index 8b8fa19749..31fb4bb075 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-incidents-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md @@ -1,5 +1,5 @@ --- -title: Manage Windows Defender ATP incidents +title: Manage Microsoft Defender ATP incidents description: Manage incidents by assigning it, updating its status, or setting its classification. keywords: incidents, manage, assign, status, classification, true alert, false alert search.product: eADQiWindows 10XVcnh @@ -18,10 +18,10 @@ ms.topic: article ms.date: 010/08/2018 --- -# Manage Windows Defender ATP incidents +# Manage Microsoft Defender ATP incidents **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Managing incidents is an important part of every cybersecurity operation. You can manage incidents by selecting an incident from the **Incidents queue** or the **Incidents management pane**. You can assign incidents to yourself, change the status, classify, rename, or comment on them to keep track of their progress. @@ -60,4 +60,4 @@ Added comments instantly appear on the pane. ## Related topics - [Incidents queue](incidents-queue.md) - [View and organize the Incidents queue](view-incidents-queue.md) -- [Investigate incidents](investigate-incidents-windows-defender-advanced-threat-protection.md) +- [Investigate incidents](investigate-incidents.md) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md similarity index 75% rename from windows/security/threat-protection/windows-defender-atp/manage-indicators.md rename to windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index db76c00fda..912dd04e24 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -20,28 +20,27 @@ ms.topic: article # Manage indicators **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -[!include[Prerelease information](prerelease.md)] - ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to. On the top navigation you can: + - Import a list -- Add an indicator -- Customize columns to add or remove columns +- Add an indicator +- Customize columns to add or remove columns - Export the entire list in CSV format - Select the items to show per page - Navigate between pages -- Apply filters +- Apply filters ## Create an indicator -1. In the navigation pane, select **Settings** > **Allowed/blocked list**. -2. Select the tab of the type of entity you'd like to create an indicator for. You can choose any of the following entities: +1. In the navigation pane, select **Settings** > **Indicators**. + +2. Select the tab of the type of entity you'd like to create an indicator for. You can choose any of the following entities: - File hash - IP address - URLs/Domains @@ -52,33 +51,29 @@ On the top navigation you can: - Indicator - Specify the entity details and define the expiration of the indicator. - Action - Specify the action to be taken and provide a description. - Scope - Define the scope of the machine group. - + 5. Review the details in the Summary tab, then click **Save**. >[!NOTE] >Blocking IPs, domains, or URLs is currently available on limited preview only. ->This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforced which is an option that will be generally available soon. +>This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforced which is an option that will be generally available soon. >As it is not yet generally available, when Automated investigations finds this indicator during an investigation it will use the allowed/block list as the basis of its decision to automatically remediate (blocked list) or skip (allowed list) the entity. - ## Manage indicators -1. In the navigation pane, select **Settings** > **Allowed/blocked list**. + +1. In the navigation pane, select **Settings** > **Indicators**. 2. Select the tab of the entity type you'd like to manage. 3. Update the details of the indicator and click **Save** or click the **Delete** button if you'd like to remove the entity from the list. ## Import a list -You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details. - -Download the sample CSV to know the supported column attributes. - - -## Related topics -- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) - +You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details. +Download the sample CSV to know the supported column attributes. +## Related topic +- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list.md) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules.md similarity index 73% rename from windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules.md index ec47236a66..1d178278d5 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules.md @@ -1,5 +1,5 @@ --- -title: Manage Windows Defender Advanced Threat Protection suppression rules +title: Manage Microsoft Defender Advanced Threat Protection suppression rules description: Manage suppression rules keywords: manage suppression, rules, rule name, scope, action, alerts, turn on, turn off search.product: eADQiWindows 10XVcnh @@ -20,20 +20,18 @@ ms.topic: article # Manage suppression rules **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-suppressionrules-abovefoldlink) - -There might be scenarios where you need to suppress alerts from appearing in the portal. You can create suppression rules for specific alerts that are known to be innocuous such as known tools or processes in your organization. For more information on how to suppress alerts, see [Suppress alerts](manage-alerts-windows-defender-advanced-threat-protection.md#suppress-alerts). +There might be scenarios where you need to suppress alerts from appearing in the portal. You can create suppression rules for specific alerts that are known to be innocuous such as known tools or processes in your organization. For more information on how to suppress alerts, see [Suppress alerts](manage-alerts.md). You can view a list of all the suppression rules and manage them in one place. You can also turn an alert suppression rule on or off. ## Turn a suppression rule on or off + 1. In the navigation pane, select **Settings** > **Alert suppression**. The list of suppression rules that users in your organization have created is displayed. -2. Select a rule by clicking on the check-box beside the rule name. +2. Select a rule by clicking on the check-box beside the rule name. 3. Click **Turn rule on** or **Turn rule off**. @@ -44,5 +42,5 @@ You can view a list of all the suppression rules and manage them in one place. Y 2. Click on a rule name. Details of the rule is displayed. You'll see the rule details such as status, scope, action, number of matching alerts, created by, and date when the rule was created. You can also view associated alerts and the rule conditions. ## Related topics -- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) +- [Manage alerts](manage-alerts.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/management-apis.md b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md similarity index 51% rename from windows/security/threat-protection/windows-defender-atp/management-apis.md rename to windows/security/threat-protection/microsoft-defender-atp/management-apis.md index 2fd2dd6083..772e18bacf 100644 --- a/windows/security/threat-protection/windows-defender-atp/management-apis.md +++ b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md @@ -20,49 +20,49 @@ ms.topic: conceptual # Overview of management and APIs **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mgt-apis-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mgt-apis-abovefoldlink) -Windows Defender ATP supports a wide variety of options to ensure that customers can easily adopt the platform. +Microsoft Defender ATP supports a wide variety of options to ensure that customers can easily adopt the platform. -Acknowledging that customer environments and structures can vary, Windows Defender ATP was created with flexibility and granular control to fit varying customer requirements. +Acknowledging that customer environments and structures can vary, Microsoft Defender ATP was created with flexibility and granular control to fit varying customer requirements. -Machine onboarding is fully integrated into System Center Configuration Manager and Microsoft Intune for client machines and Azure Security Center for server machines, providing complete end-to-end experience of configuration, deployment, and monitoring. In addition, Windows Defender ATP supports Group Policy and other third-party tools used for machines management. +Machine onboarding is fully integrated into System Center Configuration Manager and Microsoft Intune for client machines and Azure Security Center for server machines, providing complete end-to-end experience of configuration, deployment, and monitoring. In addition, Microsoft Defender ATP supports Group Policy and other third-party tools used for machines management. -Windows Defender ATP provides fine-grained control over what users with access to the portal can see and do through the flexibility of role-based access control (RBAC). The RBAC model supports all flavors of security teams structure: +Microsoft Defender ATP provides fine-grained control over what users with access to the portal can see and do through the flexibility of role-based access control (RBAC). The RBAC model supports all flavors of security teams structure: - Globally distributed organizations and security teams - Tiered model security operations teams - Fully segregated devisions with single centralized global security operations teams -The Windows Defender ATP solution is built on top of an integration-ready platform: +The Microsoft Defender ATP solution is built on top of an integration-ready platform: - It supports integration with a number of security information and event management (SIEM) solutions and also exposes APIs to fully support pulling all the alerts and detection information into any SIEM solution. - It supports a rich set of application programming interface (APIs) providing flexibility for those who are already heavily invested in data enrichment and automation: - Enriching events coming from other security systems with foot print or prevalence information - Triggering file or machine level response actions through APIs - - Keeping systems in-sync such as importing machine tags from asset management systems into Windows Defender ATP, synchronize alerts and incidents status cross ticketing systems with Windows Defender ATP. + - Keeping systems in-sync such as importing machine tags from asset management systems into Microsoft Defender ATP, synchronize alerts and incidents status cross ticketing systems with Microsoft Defender ATP. An important aspect of machine management is the ability to analyze the environment from varying and broad perspectives. This often helps drive new insights and proper priority identification: - The Secure score dashboard provides metrics based method of prioritizing the most important proactive security measures. -- Windows Defender ATP includes a built-in PowerBI based reporting solution to quickly review trends and details related to Windows Defender ATP alerts and secure score of machines. The platform also supports full customization of the reports, including mashing of Windows Defender ATP data with your own data stream to produce business specific reports. +- Microsoft Defender ATP includes a built-in PowerBI based reporting solution to quickly review trends and details related to Microsoft Defender ATP alerts and secure score of machines. The platform also supports full customization of the reports, including mashing of Microsoft Defender ATP data with your own data stream to produce business specific reports. ## In this section Topic | Description :---|:--- Understand threat intelligence concepts | Learn about alert definitions, indicators of compromise, and other threat intelligence concepts. -Supported Windows Defender ATP APIs | Learn more about the individual supported entities where you can run API calls to and details such as HTTP request values, request headers and expected responses. +Supported Microsoft Defender ATP APIs | Learn more about the individual supported entities where you can run API calls to and details such as HTTP request values, request headers and expected responses. Managed security service provider | Get a quick overview on managed security service provider support. ## Related topics -- [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md) -- [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) -- [Windows Defender ATP Public API](use-apis.md) -- [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md) -- [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) -- [Role-based access control](rbac-windows-defender-advanced-threat-protection.md) +- [Onboard machines](onboard-configure.md) +- [Enable the custom threat intelligence application](enable-custom-ti.md) +- [Microsoft Defender ATP Public API](use-apis.md) +- [Pull alerts to your SIEM tools](configure-siem.md) +- [Create and build Power BI reports using Microsoft Defender ATP data](powerbi-reports.md) +- [Role-based access control](rbac.md) diff --git a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config.md similarity index 79% rename from windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md rename to windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config.md index 41f0442d90..78be427db5 100644 --- a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config.md @@ -1,6 +1,6 @@ --- title: Configure Microsoft Cloud App Security integration -description: Learn how to turn on the settings to enable the Windows Defender ATP integration with Microsoft Cloud App Security. +description: Learn how to turn on the settings to enable the Microsoft Defender ATP integration with Microsoft Cloud App Security. keywords: cloud, app, security, settings, integration, discovery, report search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -17,15 +17,15 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Configure Microsoft Cloud App Security in Windows Defender ATP +# Configure Microsoft Cloud App Security in Microsoft Defender ATP + **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) [!include[Prerelease information](prerelease.md)] - -To benefit from Windows Defender Advanced Threat Protection (ATP) cloud app discovery signals, turn on Microsoft Cloud App Security integration. - +To benefit from Microsoft Defender Advanced Threat Protection (ATP) cloud app discovery signals, turn on Microsoft Cloud App Security integration. >[!NOTE] >This feature will be available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441)), Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464)), Windows 10, version 1809 (OS Build 17763.379 with [KB4489899](https://support.microsoft.com/help/4489899)) or later Windows 10 versions. @@ -33,9 +33,8 @@ To benefit from Windows Defender Advanced Threat Protection (ATP) cloud app disc 1. In the navigation pane, select **Preferences setup** > **Advanced features**. 2. Select **Microsoft Cloud App Security** and switch the toggle to **On**. 3. Click **Save preferences**. - -Once activated, Windows Defender ATP will immediately start forwarding discovery signals to Cloud App Security. +Once activated, Microsoft Defender ATP will immediately start forwarding discovery signals to Cloud App Security. ## View the data collected @@ -45,7 +44,7 @@ Once activated, Windows Defender ATP will immediately start forwarding discovery  -3. Select **Win10 Endpoint Users report**, which contains the data coming from Windows Defender ATP. +3. Select **Win10 Endpoint Users report**, which contains the data coming from Microsoft Defender ATP.  diff --git a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md similarity index 58% rename from windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md rename to windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md index 0edfd423b9..d5549ce952 100644 --- a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md @@ -1,6 +1,6 @@ --- title: Microsoft Cloud App Security integration overview -description: Windows Defender ATP integrates with Cloud App Security by collecting and forwarding all cloud app networking activities, providing unparalleled visibility to cloud app usage +description: Microsoft Defender ATP integrates with Cloud App Security by collecting and forwarding all cloud app networking activities, providing unparalleled visibility to cloud app usage keywords: cloud, app, networking, visibility, usage search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,9 +18,9 @@ ms.topic: conceptual ms.date: 10/18/2018 --- -# Microsoft Cloud App Security in Windows Defender ATP overview +# Microsoft Cloud App Security in Microsoft Defender ATP overview **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) [!include[Prerelease information](prerelease.md)] @@ -29,17 +29,17 @@ Microsoft Cloud App Security (Cloud App Security) is a comprehensive solution th >[!NOTE] >This feature is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10 version 1809 or later. -## Windows Defender ATP and Cloud App Security integration +## Microsoft Defender ATP and Cloud App Security integration -Cloud App Security discovery relies on cloud traffic logs being forwarded to it from enterprise firewall and proxy servers. Windows Defender ATP integrates with Cloud App Security by collecting and forwarding all cloud app networking activities, providing unparalleled visibility to cloud app usage. The monitoring functionality is built into the device, providing complete coverage of network activity. +Cloud App Security discovery relies on cloud traffic logs being forwarded to it from enterprise firewall and proxy servers. Microsoft Defender ATP integrates with Cloud App Security by collecting and forwarding all cloud app networking activities, providing unparalleled visibility to cloud app usage. The monitoring functionality is built into the device, providing complete coverage of network activity. The integration provides the following major improvements to the existing Cloud App Security discovery: - Available everywhere - Since the network activity is collected directly from the endpoint, it's available wherever the device is, on or off corporate network, as it's no longer depended on traffic routed through the enterprise firewall or proxy servers. -- Works out of the box, no configuration required - Forwarding cloud traffic logs to Cloud App Security requires firewall and proxy server configuration. With the Windows Defender ATP and Cloud App Security integration, there's no configuration required. Just switch it on in Windows Defender Security Center settings and you're good to go. +- Works out of the box, no configuration required - Forwarding cloud traffic logs to Cloud App Security requires firewall and proxy server configuration. With the Microsoft Defender ATP and Cloud App Security integration, there's no configuration required. Just switch it on in Microsoft Defender Security Center settings and you're good to go. -- Device context - Cloud traffic logs lack device context. Windows Defender ATP network activity is reported with the device context (which device accessed the cloud app), so you are able to understand exactly where (device) the network activity took place, in addition to who (user) performed it. +- Device context - Cloud traffic logs lack device context. Microsoft Defender ATP network activity is reported with the device context (which device accessed the cloud app), so you are able to understand exactly where (device) the network activity took place, in addition to who (user) performed it. For more information about cloud discovery, see [Working with discovered apps](https://docs.microsoft.com/cloud-app-security/discovered-apps). diff --git a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md similarity index 54% rename from windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md index 14c491a3cf..aac7917bca 100644 --- a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md @@ -1,8 +1,8 @@ --- -title: Windows Defender Advanced Threat Protection -description: Windows Defender Advanced Threat Protection is an enterprise security platform that helps secops to prevent, detect, investigate, and respond to possible cybersecurity threats related to advanced persistent threats. -keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security, machine behavioral sensor, cloud security, analytics, threat intelligence, attack surface reduction, next generation protection, automated investigation and remediation, microsoft threat experts, secure score, advanced hunting, microsoft threat protection -search.product: Windows 10 +title: Microsoft Defender Advanced Threat Protection +description: Microsoft Defender Advanced Threat Protection is an enterprise security platform that helps secops to prevent, detect, investigate, and respond to possible cybersecurity threats related to advanced persistent threats. +keywords: introduction to Microsoft Defender Advanced Threat Protection, introduction to Microsoft Defender ATP, cybersecurity, advanced persistent threat, enterprise security, machine behavioral sensor, cloud security, analytics, threat intelligence, attack surface reduction, next generation protection, automated investigation and remediation, microsoft threat experts, secure score, advanced hunting, microsoft threat protection +search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy @@ -17,18 +17,18 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Windows Defender Advanced Threat Protection +# Microsoft Defender Advanced Threat Protection ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-main-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-main-abovefoldlink) > >For more info about Windows 10 Enterprise Edition features and functionality, see [Windows 10 Enterprise edition](https://www.microsoft.com/WindowsForBusiness/buy). -Windows Defender Advanced Threat Protection is a platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats. +Microsoft Defender Advanced Threat Protection is a platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats. -Windows Defender ATP uses the following combination of technology built into Windows 10 and Microsoft's robust cloud service: +Microsoft Defender ATP uses the following combination of technology built into Windows 10 and Microsoft's robust cloud service: - **Endpoint behavioral sensors**: Embedded in Windows 10, these sensors - collect and process behavioral signals from the operating system and sends this sensor data to your private, isolated, cloud instance of Windows Defender ATP. + collect and process behavioral signals from the operating system and sends this sensor data to your private, isolated, cloud instance of Microsoft Defender ATP. - **Cloud security analytics**: Leveraging big-data, machine-learning, and @@ -39,12 +39,12 @@ Windows Defender ATP uses the following combination of technology built into Win - **Threat intelligence**: Generated by Microsoft hunters, security teams, and augmented by threat intelligence provided by partners, threat - intelligence enables Windows Defender ATP to identify attacker + intelligence enables Microsoft Defender ATP to identify attacker tools, techniques, and procedures, and generate alerts when these are observed in collected sensor data. -
Windows Defender ATP
Microsoft Defender ATP
| Threat & Vulnerability Management |
@@ -67,8 +67,8 @@ Windows Defender ATP uses the following combination of technology built into Win
>[!TIP]
->- Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
->- Windows Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
+>- Learn about the latest enhancements in Microsoft Defender ATP: [What's new in Microsoft Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
+>- Microsoft Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
@@ -83,7 +83,7 @@ The attack surface reduction set of capabilities provide the first line of defen
**[Next generation protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)**