mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-20 17:27:23 +00:00
Merged PR 9503: 6/29 PM Publish
This commit is contained in:
Huaping Yu (Beyondsoft Consulting Inc)
commit
124eee3136
@ -7,7 +7,7 @@ ms.sitesec: library
|
||||
ms.localizationpriority: high
|
||||
ms.pagetype: mobile
|
||||
author: greg-lindsay
|
||||
ms.date: 06/28/2018
|
||||
ms.date: 06/29/2018
|
||||
---
|
||||
|
||||
# Windows 10 edition downgrade
|
||||
@ -21,19 +21,10 @@ To perform a downgrade, you can use the same methods as when performing an [edit
|
||||
|
||||
Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 by entering a different product key is not supported. The only downgrade method available for this path is through the rollback of a previous upgrade. You also cannot downgrade from a later version to an earlier version of the same edition (Ex: Windows 10 Pro 1709 to 1703) unless the rollback process is used. This topic does not discuss version downgrades.
|
||||
|
||||
### Firmware-embedded activation keys
|
||||
|
||||
As of October 2017, computers that are supplied by an OEM include a firmware embedded product key that can affect the available downgrade paths. If this key exists, you can display it and the pre-installed OS edition by typing the following commands at an elevated Windows PowerShell prompt:
|
||||
|
||||
```
|
||||
(Get-WmiObject -query ‘select * from SoftwareLicensingService’).OA3xOriginalProductKey
|
||||
(Get-WmiObject -query ‘select * from SoftwareLicensingService’).OA3xOriginalProductKeyDescription
|
||||
```
|
||||
|
||||
### Scenario example
|
||||
|
||||
Downgrading from Enterprise
|
||||
- Original edition with firmware-embedded key: **Professional OEM**
|
||||
- Original edition: **Professional OEM**
|
||||
- Upgrade edition: **Enterprise**
|
||||
- Valid downgrade paths: **Pro, Pro for Workstations, Pro Education, Education**
|
||||
|
||||
@ -45,10 +36,9 @@ You can move directly from Enterprise to any valid destination edition. In this
|
||||
>Edition changes that are considered upgrades (Ex: Pro to Enterprise, Pro to Pro for Workstations) are not shown here.
|
||||
>For more information see [Windows 10 edition upgrade](windows-10-edition-upgrades.md).<br>
|
||||
|
||||
Switching between different editions of Pro might not be possible if the source OS is associated with a [firmware-embedded activation key](#firmware-embedded-activation-keys). An exception is that you can perform an upgrade from Pro to Pro for Workstation on a computer with an embedded Pro key, and then later downgrade this computer back to Pro.
|
||||
|
||||
✔ = Supported downgrade path<br>
|
||||
N = Not supported from OEM pre-installed<br>
|
||||
S = Supported; Not considered a downgrade or an upgrade<br>
|
||||
[blank] = Not supported or not a downgrade<br>
|
||||
|
||||
<br>
|
||||
<table border="0" cellpadding="1">
|
||||
@ -102,8 +92,8 @@ Switching between different editions of Pro might not be possible if the source
|
||||
<tr>
|
||||
<td>Pro Education</td>
|
||||
<td></td>
|
||||
<td align="center">N</td>
|
||||
<td align="center">N</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
@ -117,7 +107,7 @@ Switching between different editions of Pro might not be possible if the source
|
||||
<td align="center">✔</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td>S</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise LTSC</td>
|
||||
@ -135,7 +125,7 @@ Switching between different editions of Pro might not be possible if the source
|
||||
<td align="center">✔</td>
|
||||
<td align="center">✔</td>
|
||||
<td align="center">✔</td>
|
||||
<td align="center">✔</td>
|
||||
<td align="center">S</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
@ -145,14 +135,11 @@ Switching between different editions of Pro might not be possible if the source
|
||||
|
||||
>**Windows N/KN**: Windows "N" and "KN" SKUs follow the same rules shown above.
|
||||
|
||||
Some slightly more complex scenarios are not represented by the table above. For example, you can perform an upgrade from Pro to Pro for Workstation on a computer with an embedded Pro key using a Pro for Workstation license key, and then later downgrade this computer back to Pro with the firmware-embedded key. The downgrade is allowed but only because the pre-installed OS is Pro.
|
||||
|
||||
## Related Topics
|
||||
|
||||
[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)<br>
|
||||
[Windows upgrade and migration considerations](windows-upgrade-and-migration-considerations.md)<br>
|
||||
[Windows 10 edition upgrade](windows-10-edition-upgrades.md)<br>
|
||||
[Windows 10 upgrade paths](windows-10-upgrade-paths.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
ms.date: 08/16/2017
|
||||
ms.date: 06/29/2018
|
||||
---
|
||||
|
||||
# TPM Group Policy settings
|
||||
@ -52,22 +52,28 @@ This policy setting allows you to enforce or ignore the computer's local list of
|
||||
|
||||
The local list of blocked TPM commands is configured outside of Group Policy by typing **tpm.msc** at the command prompt to open the TPM Management Console, or scripting using the **Win32\_Tpm** interface. (The default list of blocked TPM commands is preconfigured by Windows.)
|
||||
|
||||
|
||||
If you enable this policy setting, the Windows operating system will ignore the computer's local list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the default list.
|
||||
|
||||
If you disable or do not configure this policy setting, Windows will block the TPM commands in the local list, in addition to the commands that are specified in Group Policy and the default list of blocked TPM commands.
|
||||
|
||||
## Configure the level of TPM owner authorization information available to the operating system
|
||||
|
||||
Beginning with Windows 10 version 1607 and Windows Server 2016, this policy setting is no longer used by Windows, but it continues to appear in GPEdit.msc for compatibility with previous versions.
|
||||
>[!IMPORTANT]
|
||||
>Beginning with Windows 10 version 1607 and Windows Server 2016, this policy setting is no longer used by Windows, but it continues to appear in GPEdit.msc for compatibility with previous versions. Beginning with Windows 10 version 1703, the default value is 5. This value is implemented during provisioning so that another Windows component can either delete it or take ownership of it, depending on the system configuration. For TPM 2.0, a value of 5 means keep the lockout authorization. For TPM 1.2, it means discard the Full TPM owner authorization and retain only the Delegated authorization.
|
||||
|
||||
This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information that is stored locally, the Windows operating system and TPM-based applications can perform certain actions in the TPM that require TPM owner authorization without requiring the user to enter the TPM owner password.
|
||||
This policy setting configured which TPM authorization values are stored in the registry of the local computer. Certain authorization values are required in order to allow Windows to perform certain actions.
|
||||
|
||||
|TPM 1.2 value | TPM 2.0 value | Purpose | Kept at level 0?| Kept at level 2?| Kept at level 4? |
|
||||
|--------------|---------------|---------|-----------------|-----------------|------------------|
|
||||
| OwnerAuthAdmin | StorageOwnerAuth | Create SRK | No | Yes | Yes |
|
||||
| OwnerAuthEndorsement | EndorsementAuth | Create or use EK (1.2 only: Create AIK) | No | Yes | Yes |
|
||||
| OwnerAuthFull | LockoutAuth | Reset/change Dictionary Attack Protection | No | No | No |
|
||||
|
||||
There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**.
|
||||
|
||||
- **Full** This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that do not require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used.
|
||||
- **Full** This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that do not require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used. Full owner authorization in TPM 1.2 is similar to lockout authorization in TPM 2.0. Owner authorization has a different meaning for TPM 2.0.
|
||||
|
||||
- **Delegated** This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. This is the default setting in Windows.
|
||||
- **Delegated** This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. This is the default setting in Windows prior to version 1703.
|
||||
|
||||
- **None** This setting provides compatibility with previous operating systems and applications. You can also use it for scenarios when TPM owner authorization cannot be stored locally. Using this setting might cause issues with some TPM-based applications.
|
||||
|
||||
@ -88,11 +94,10 @@ The following table shows the TPM owner authorization values in the registry.
|
||||
| 2 | Delegated |
|
||||
| 4 | Full |
|
||||
|
||||
A value of 5 means discard the **Full** TPM owner authorization for TPM 1.2 but keep it for TPM 2.0.
|
||||
|
||||
|
||||
If you enable this policy setting, the Windows operating system will store the TPM owner authorization in the registry of the local computer according to the TPM authentication setting you choose.
|
||||
|
||||
If you disable or do not configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not
|
||||
On Windows 10 prior to version 1607, if you disable or do not configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not
|
||||
configured, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is enabled, only the administrative delegation and the user delegation blobs are stored in the local registry.
|
||||
|
||||
## Standard User Lockout Duration
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 06/13/2018
|
||||
ms.date: 06/29/2018
|
||||
---
|
||||
|
||||
|
||||
@ -82,6 +82,10 @@ Windows 10, version 1803 has five new Attack surface reduction rules:
|
||||
- Block process creations originating from PSExec and WMI commands
|
||||
- Block untrusted and unsigned processes that run from USB
|
||||
|
||||
In addition, the following rule is available for beta testing:
|
||||
|
||||
- Block Office communication applications from creating child processes
|
||||
|
||||
The following sections describe what each rule does. Each rule is identified by a rule GUID, as in the following table:
|
||||
|
||||
Rule name | GUID
|
||||
@ -98,6 +102,7 @@ Use advanced protection against ransomware | c1db55ab-c21a-4637-bb3f-a12568109d3
|
||||
Block credential stealing from the Windows local security authority subsystem (lsass.exe) | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
|
||||
Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c
|
||||
Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
|
||||
Block Office communication applications from creating child processes (available for beta testing) | 26190899-1602-49e8-8b27-eb1d0a1ce869
|
||||
|
||||
The rules apply to the following Office apps running on Windows 10, version 1709. See the **Applies to** section at the start of this topic for a list of supported Office version.
|
||||
|
||||
@ -123,7 +128,7 @@ This rule blocks the following file types from being run or launched from an ema
|
||||
|
||||
### Rule: Block Office applications from creating child processes
|
||||
|
||||
Office apps will not be allowed to create child processes. This includes Word, Excel, PowerPoint, OneNote, Outlook, and Access.
|
||||
Office apps will not be allowed to create child processes. This includes Word, Excel, PowerPoint, OneNote, and Access.
|
||||
|
||||
This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables.
|
||||
|
||||
@ -175,10 +180,16 @@ This rule blocks the following file types from being run or launched unless they
|
||||
|
||||
- Executable files (such as .exe, .dll, or .scr)
|
||||
|
||||
>[!NOTE]
|
||||
>You must [enable cloud-delivered protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) to use this rule.
|
||||
|
||||
### Rule: Use advanced protection against ransomware
|
||||
|
||||
This rule provides an extra layer of protection against ransomware. Executable files that enter the system will be scanned to determine whether they are trustworthy. If the files exhibit characteristics that closely resemble ransomware, they are blocked from being run or launched, provided they are not already in the trusted list or exception list.
|
||||
|
||||
>[!NOTE]
|
||||
>You must [enable cloud-delivered protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) to use this rule.
|
||||
|
||||
### Rule: Block credential stealing from the Windows local security authority subsystem (lsass.exe)
|
||||
|
||||
Local Security Authority Subsystem Service (LSASS) authenticates users who log in to a Windows computer. Windows Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. This rule helps mitigate that risk by locking down LSASS.
|
||||
@ -203,6 +214,12 @@ With this rule, admins can prevent unsigned or untrusted executable files from r
|
||||
- Executable files (such as .exe, .dll, or .scr)
|
||||
- Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file)
|
||||
|
||||
### Rule: Block Office communication applications from creating child processes
|
||||
|
||||
Office communication apps will not be allowed to create child processes. This includes Outlook.
|
||||
|
||||
This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables.
|
||||
|
||||
## Review Attack surface reduction events in Windows Event Viewer
|
||||
|
||||
You can review the Windows event log to see events that are created when an Attack surface reduction rule is triggered (or audited):
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 06/15/2018
|
||||
ms.date: 06/29/2018
|
||||
---
|
||||
|
||||
# Customize Attack surface reduction
|
||||
@ -76,6 +76,8 @@ Use advanced protection against ransomware | [!include[Check mark yes](images/sv
|
||||
Block credential stealing from the Windows local security authority subsystem (lsass.exe) | [!include[Check mark no](images/svg/check-no.svg)] | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
|
||||
Block process creations originating from PSExec and WMI commands | [!include[Check mark yes](images/svg/check-yes.svg)] | d1e49aac-8f56-4280-b9ba-993a6d77406c
|
||||
Block untrusted and unsigned processes that run from USB | [!include[Check mark yes](images/svg/check-yes.svg)] | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
|
||||
Block Office communication applications from creating child processes (available for beta testing) | [!include[Check mark no](images/svg/check-yes.svg)] | 26190899-1602-49e8-8b27-eb1d0a1ce869
|
||||
|
||||
|
||||
See the [Attack surface reduction](attack-surface-reduction-exploit-guard.md) topic for details on each rule.
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 05/30/2018
|
||||
ms.date: 06/29/2018
|
||||
---
|
||||
|
||||
|
||||
@ -64,6 +64,7 @@ Use advanced protection against ransomware | c1db55ab-c21a-4637-bb3f-a12568109d3
|
||||
Block credential stealing from the Windows local security authority subsystem (lsass.exe) | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
|
||||
Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c
|
||||
Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
|
||||
Block Office communication applications from creating child processes (available for beta testing) | 26190899-1602-49e8-8b27-eb1d0a1ce869
|
||||
|
||||
See the [Attack surface reduction](attack-surface-reduction-exploit-guard.md) topic for details on each rule.
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user