From dec8475ee01c9b4c2503c537b9f645e9da5c0274 Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Wed, 22 Apr 2020 18:28:17 -0700 Subject: [PATCH 1/9] Update manage-updates-baselines-windows-defender-antivirus.md First draft to verify the process flow --- ...es-baselines-windows-defender-antivirus.md | 68 ++++++++++++++----- 1 file changed, 50 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index d444eaedc1..fe00cf4804 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -48,24 +48,56 @@ You can manage the distribution of updates through Windows Server Update Service Only the main version is listed in the following table as reference information: -Month | Platform/Client | Engine ----|---|--- -Mar-2020 | 4.18.2003.x| 1.1.16900.x -Feb-2020 | - | 1.1.16800.x -Jan-2020 | 4.18.2001.x | 1.1.16700.x -Dec-2019 | - | - | -Nov-2019 | 4.18.1911.x | 1.1.16600.x -Oct-2019 | 4.18.1910.x | 1.1.16500.x -Sep-2019 | 4.18.1909.x | 1.1.16400.x -Aug-2019 | 4.18.1908.x | 1.1.16300.x -Jul-2019 | 4.18.1907.x | 1.1.16200.x -Jun-2019 | 4.18.1906.x | 1.1.16100.x -May-2019 | 4.18.1905.x | 1.1.16000.x -Apr-2019 | 4.18.1904.x | 1.1.15900.x -Mar-2019 | 4.18.1903.x | 1.1.15800.x -Feb-2019 | 4.18.1902.x | 1.1.15700.x -Jan-2019 | 4.18.1901.x | 1.1.15600.x -Dec-18 | 4.18.1812.X | 1.1.15500.x +
+ March-2020 (4.18.2003.8/1.1.16900.2) + + + + Released: **March 26, 2020** + Platform/Client: **4.18.2003.8** + Engine: **1.1.16900.2** + + ### What´s new + * fix1 + * fix2 + * fix3 + + ### Known Issues + * New file path + Because of a change in the file path location in the update, many downloads are blocked when AppLocker is enabled. +To work around this issue, open Group Policy, and then change the setting to Allow for the following path: + + +%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\* + + +> [!NOTE] +> Information the user should notice even if skimming. + +
+ +
+ Jan-2020 (4.18.2001.10/1.1.16700.2) + + + Released: **March 26, 2020** + Platform/Client: **4.18.2001.10** + Engine: **1.1.16700.2** + + ### What´s new + * fix1 + * fix2 + * fix3 + + ### Known Issues + * New file path + Because of a change in the file path location in the update, many downloads are blocked when AppLocker is enabled. +To work around this issue, open Group Policy, and then change the setting to Allow for the following path: + +%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\* + +
+ ## In this section From 818b815adae8e76485f0435b740a0e3406e45ed9 Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Sun, 26 Apr 2020 18:07:51 -0700 Subject: [PATCH 2/9] Update manage-updates-baselines-windows-defender-antivirus.md revision of the doc + supportability statement --- ...es-baselines-windows-defender-antivirus.md | 212 ++++++++++++++---- 1 file changed, 168 insertions(+), 44 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index fe00cf4804..9cbd8b642a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Manage Windows Defender Antivirus updates and apply baselines -description: Manage how Windows Defender Antivirus receives protection and product updates. +title: Manage Microsoft Defender Antivirus updates and apply baselines +description: Manage how Microsoft Defender Antivirus receives protection and product updates. keywords: updates, security baselines, protection, schedule updates, force updates, mobile updates, wsus search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -17,7 +17,7 @@ ms.reviewer: manager: dansimp --- -# Manage Windows Defender Antivirus updates and apply baselines +# Manage Microsoft Defender Antivirus updates and apply baselines **Applies to:** @@ -25,16 +25,16 @@ manager: dansimp There are two types of updates related to keeping Windows Defender Antivirus up to date: -1. Protection updates +1. Security intelligence updates 2. Product updates -You can also apply [Windows security baselines](https://technet.microsoft.com/itpro/windows/keep-secure/windows-security-baselines) to quickly bring your endpoints up to a uniform level of protection. -## Protection updates -Windows Defender Antivirus uses both [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloaded protection updates to provide protection. These protection updates are also known as Security intelligence updates. +## Security intelligence updates -The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the protection updates generally occur once a day (although this can be configured). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection. +Microsoft Defender Antivirus uses [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloads Security intelligence updates to provide protection. + +The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the Security intelligence updates occur on a scheduled cadence (configurable via policy). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection. Engine updates are included with the Security intelligence updates and are released on a monthly cadence. @@ -46,59 +46,183 @@ You can manage the distribution of updates through Windows Server Update Service ## Released platform and engine versions -Only the main version is listed in the following table as reference information: +### Monthly platform and engine releases +For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform)
- March-2020 (4.18.2003.8/1.1.16900.2) - + April-2020 (Platform: 4.18.2004.5 | Engine: 1.1.17000.2) +Security intelligence update version: **TBD** +Released: **April 30, 2020** +Platform: **4.18.2004.5** +Engine: **1.1.17000.2** +Support phase: **Security and Critical Updates** - Released: **March 26, 2020** - Platform/Client: **4.18.2003.8** - Engine: **1.1.16900.2** - - ### What´s new - * fix1 - * fix2 - * fix3 - - ### Known Issues - * New file path - Because of a change in the file path location in the update, many downloads are blocked when AppLocker is enabled. -To work around this issue, open Group Policy, and then change the setting to Allow for the following path: +### What's new +:::row::: + :::column::: + **Platform** + * fix1 + * fix2 -%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\* - - -> [!NOTE] -> Information the user should notice even if skimming. - + :::column-end::: + :::column::: + **Engine** + * fix1 + * fix2 + :::column-end::: +:::row-end::: + +### Known Issues +No known issues
- Jan-2020 (4.18.2001.10/1.1.16700.2) + March-2020 (Platform: 4.18.2003.8 | Engine: 1.1.16900.2) + +Security intelligence update version: **1.313.8.0** +Released: **March 24, 2020** +Platform: **4.18.2003.8** +Engine: **1.1.16900.4** +Support phase: **Technical upgrade Support (Only)** + +### What's new + +:::row::: + :::column::: + **Platform** + * fix1 + * fix2 + + :::column-end::: + :::column::: + **Engine** + * fix1 + * fix2 + :::column-end::: +:::row-end::: + +### Known Issues +No known issues +
+ +
+ + February-2020 (Platform: - | Engine: 1.1.16800.2) + + Security intelligence update version: **1.311.4.0** + Released: **February 25, 2020** + Platform/Client: **-** + Engine: **1.1.16800.2** + Support phase: **N/A** + +### What's new + +:::row::: + :::column::: + **Platform** + * fix1 + * fix2 + + :::column-end::: + :::column::: + **Engine** + * fix1 + * fix2 + :::column-end::: +:::row-end::: + +### Known Issues +No known issues +
+ +
+ January-2020 (Platform: 4.18.2001.10 | Engine: 1.1.16700.2) - Released: **March 26, 2020** + Security intelligence update version: **1.309.32.0** + Released: **January 30, 2020** Platform/Client: **4.18.2001.10** - Engine: **1.1.16700.2** - - ### What´s new - * fix1 - * fix2 - * fix3 - - ### Known Issues - * New file path - Because of a change in the file path location in the update, many downloads are blocked when AppLocker is enabled. -To work around this issue, open Group Policy, and then change the setting to Allow for the following path: + Engine: **1.1.16700.2** + Support phase: **Technical upgrade Support (Only)** + +### What's new -%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\* +:::row::: + :::column::: + **Platform** + * fix1 + * fix2 + :::column-end::: + :::column::: + **Engine** + * fix1 + * fix2 + :::column-end::: +:::row-end::: + +### Known Issues +No known issues
+
+ November-2019 (Platform: 4.18.1911.2 | Engine: 1.1.16600.7) +Security intelligence update version: **1.307.13.0** +Released: **December 7, 2019** +Platform: **4.18.1911.2** +Engine: **1.1.17000.7** +Support phase: **No support** + +### What's new + +:::row::: + :::column::: + **Platform** + * fix1 + * fix2 + + :::column-end::: + :::column::: + **Engine** + * fix1 + * fix2 + :::column-end::: +:::row-end::: + +### Known Issues +No known issues +
+ +## Windows Defender Antivirus platform support +As stated above, platform and engine updates are provided on a monthly cadence. +Customers must stay current with the latest platform update to be fully supported. Our support structure is now dynamic, evolving into two phases depending on the availability of the latest platform version. + + +* **Security and Critical Updates servicing phase** - When running the latest platform version, you will be eligible to receive both Security and Critical updates to the anti-malware platform. + + +* **Technical Support (Only) phase** - After a new platform version is released, support for older versions (N-2) will reduce to technical support only. Platform versions older than N-2 will no longer be supported.* + +*Technical support will continue to be provided for upgrades from the Windows 10 release version (see [Platform version included with Windows 10 releases](#platform-version-included-with-windows-10-releases)) to the latest platform version. + +During the technical support (only) phase, commercially reasonable support incidents will be provided through Microsoft Customer Service & Support and Microsoft’s managed support offerings (such as Premier Support). If a support incident requires escalation to development for further guidance, requires a non-security update, or requires a security update, customers will be asked to upgrade to the latest platform version or an intermediate update(*). + +### Platform version included with Windows 10 releases +The below table provides the Windows Defender Antivirus platform and engine versions that are shipped with the latest Windows 10 releases: + +|Windows 10 release |Platform version |Engine version |Support phase | +|-|-|-|-| +|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade Support (Only) +|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade Support (Only) +|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade Support (Only) +|1803 (RS4) |4.13.17134.1 |1.1.14600.4 | Technical upgrade Support (Only) +|1709 (RS3) |4.12.16299.15 |1.1.14104.0 | Technical upgrade Support (Only) +|1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) +|1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) +Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet) ## In this section From 7400f912325a02f8341dbc790b016060669caf33 Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Tue, 28 Apr 2020 10:05:49 -0700 Subject: [PATCH 3/9] Update manage-updates-baselines-windows-defender-antivirus.md fixing table --- ...es-baselines-windows-defender-antivirus.md | 25 ++++++++++--------- 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 9cbd8b642a..057ae2c994 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Manage Microsoft Defender Antivirus updates and apply baselines -description: Manage how Microsoft Defender Antivirus receives protection and product updates. +title: Manage Windows Defender Antivirus updates and apply baselines +description: Manage how Windows Defender Antivirus receives protection and product updates. keywords: updates, security baselines, protection, schedule updates, force updates, mobile updates, wsus search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -17,7 +17,7 @@ ms.reviewer: manager: dansimp --- -# Manage Microsoft Defender Antivirus updates and apply baselines +# Manage Windows Defender Antivirus updates and apply baselines **Applies to:** @@ -32,7 +32,7 @@ There are two types of updates related to keeping Windows Defender Antivirus up ## Security intelligence updates -Microsoft Defender Antivirus uses [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloads Security intelligence updates to provide protection. +Windows Defender Antivirus uses [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloads Security intelligence updates to provide protection. The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the Security intelligence updates occur on a scheduled cadence (configurable via policy). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection. @@ -213,15 +213,16 @@ During the technical support (only) phase, commercially reasonable support incid ### Platform version included with Windows 10 releases The below table provides the Windows Defender Antivirus platform and engine versions that are shipped with the latest Windows 10 releases: -|Windows 10 release |Platform version |Engine version |Support phase | +|Windows 10 release |Platform version |Engine version |Support phase | |-|-|-|-| -|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade Support (Only) -|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade Support (Only) -|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade Support (Only) -|1803 (RS4) |4.13.17134.1 |1.1.14600.4 | Technical upgrade Support (Only) -|1709 (RS3) |4.12.16299.15 |1.1.14104.0 | Technical upgrade Support (Only) -|1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) -|1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) +|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade Support (Only) | +|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade Support (Only) | +|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade Support (Only) | +|1803 (RS4) |4.13.17134.1 |1.1.14600.4 | Technical upgrade Support (Only) | +|1709 (RS3) |4.12.16299.15 |1.1.14104.0 | Technical upgrade Support (Only) | +|1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) | +|1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) | + Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet) ## In this section From 3487798189a01355c9d2a9ac2fce8b64062f5ade Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Tue, 28 Apr 2020 12:55:33 -0700 Subject: [PATCH 4/9] Update manage-updates-baselines-windows-defender-antivirus.md update according to feedback --- ...es-baselines-windows-defender-antivirus.md | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index b05fb44dc0..8b55207b8c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -27,7 +27,9 @@ There are two types of updates related to keeping Windows Defender Antivirus up 1. Security intelligence updates 2. Product updates - +> [!IMPORTANT] +> Keeping Windows Defender Antivirus up to date is crucial to assure your devices have the latest technology and features needed to protect against new malware and attack techniques. +> This also applies to devices where Windows Defender Antivirus is running in [passive mode](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility). ## Security intelligence updates @@ -39,9 +41,10 @@ Engine updates are included with the Security intelligence updates and are relea ## Product updates -Windows Defender Antivirus requires [monthly updates](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases. +Windows Defender Antivirus requires [monthly updates (KB4052623)](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases. -You can manage the distribution of updates through Windows Server Update Service (WSUS), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. +You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. +For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) ## Released platform and engine versions @@ -138,13 +141,14 @@ No known issues
- January-2020 (Platform: 4.18.2001.10 | Engine: 1.1.16700.2) + January-2020 (Platform: 4.18.2001.10 | Engine: 1.1.16700.2) - Security intelligence update version: **1.309.32.0** - Released: **January 30, 2020** - Platform/Client: **4.18.2001.10** - Engine: **1.1.16700.2** - Support phase: **Technical upgrade Support (Only)** + +Security intelligence update version: **1.309.32.0** +Released: **January 30, 2020** +Platform/Client: **4.18.2001.10** +Engine: **1.1.16700.2** +Support phase: **Technical upgrade Support (Only)** ### What's new From a5df7f867caba3d907691f97da8201cb3a7b866c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 28 Apr 2020 14:14:32 -0700 Subject: [PATCH 5/9] Update manage-updates-baselines-windows-defender-antivirus.md --- ...manage-updates-baselines-windows-defender-antivirus.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 8b55207b8c..fe28605d32 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -43,13 +43,13 @@ Engine updates are included with the Security intelligence updates and are relea Windows Defender Antivirus requires [monthly updates (KB4052623)](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases. -You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. -For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) +You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. +For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) ## Released platform and engine versions ### Monthly platform and engine releases -For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform) +For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform)
April-2020 (Platform: 4.18.2004.5 | Engine: 1.1.17000.2) @@ -226,7 +226,7 @@ The below table provides the Windows Defender Antivirus platform and engine vers |1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) | |1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) | -Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet) +Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) ## In this section From 36f12fb400506adea0d6b7dbf0f96f19b9ff5b8a Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Wed, 29 Apr 2020 16:40:40 -0700 Subject: [PATCH 6/9] Update manage-updates-baselines-windows-defender-antivirus.md Final draft --- ...es-baselines-windows-defender-antivirus.md | 140 +++++++----------- 1 file changed, 55 insertions(+), 85 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 8b55207b8c..2a8874766c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -28,8 +28,8 @@ There are two types of updates related to keeping Windows Defender Antivirus up 2. Product updates > [!IMPORTANT] -> Keeping Windows Defender Antivirus up to date is crucial to assure your devices have the latest technology and features needed to protect against new malware and attack techniques. -> This also applies to devices where Windows Defender Antivirus is running in [passive mode](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility). +> Keeping Windows Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques. +> This also applies to devices where Windows Defender Antivirus is running in [passive mode](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility). ## Security intelligence updates @@ -43,70 +43,64 @@ Engine updates are included with the Security intelligence updates and are relea Windows Defender Antivirus requires [monthly updates (KB4052623)](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases. -You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. -For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) +You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. +For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) ## Released platform and engine versions ### Monthly platform and engine releases -For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform) +For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) + +All our updates contain: +* performance improvements +* serviceability improvements +* Integration improvements (Cloud, MTP) +
April-2020 (Platform: 4.18.2004.5 | Engine: 1.1.17000.2) -Security intelligence update version: **TBD** -Released: **April 30, 2020** -Platform: **4.18.2004.5** -Engine: **1.1.17000.2** -Support phase: **Security and Critical Updates** + Security intelligence update version: **TBD** + Released: **April 30, 2020** + Platform: **4.18.2004.5** + Engine: **1.1.17000.2** + Support phase: **Security and Critical Updates** ### What's new +* WDfilter improvements +* Add more actionable event data to ASR detection events +* Fixed version information in diagnostic data and WMI +* Fixed incorrect platform version in UI after platform update +* Dynamic URL intel for Fileless threat protection +* UEFI scan capability +* Extend logging for updates -:::row::: - :::column::: - **Platform** - * fix1 - * fix2 - - :::column-end::: - :::column::: - **Engine** - * fix1 - * fix2 - :::column-end::: -:::row-end::: - ### Known Issues No known issues +
March-2020 (Platform: 4.18.2003.8 | Engine: 1.1.16900.2) -Security intelligence update version: **1.313.8.0** -Released: **March 24, 2020** -Platform: **4.18.2003.8** -Engine: **1.1.16900.4** -Support phase: **Technical upgrade Support (Only)** + Security intelligence update version: **1.313.8.0** + Released: **March 24, 2020** + Platform: **4.18.2003.8** + Engine: **1.1.16900.4** + Support phase: **Technical upgrade Support (Only)** ### What's new -:::row::: - :::column::: - **Platform** - * fix1 - * fix2 - - :::column-end::: - :::column::: - **Engine** - * fix1 - * fix2 - :::column-end::: -:::row-end::: +* CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus) +* Improve diagnostic capability +* reduce Security intelligence timeout (5min) +* Extend AMSI engine internal log capability +* Improve notification for process blocking ### Known Issues -No known issues +[**Fixed**] Windows Defender Antivirus is skipping files when running a scan. + +
@@ -122,22 +116,10 @@ No known issues ### What's new -:::row::: - :::column::: - **Platform** - * fix1 - * fix2 - - :::column-end::: - :::column::: - **Engine** - * fix1 - * fix2 - :::column-end::: -:::row-end::: - + ### Known Issues No known issues +
@@ -152,22 +134,18 @@ Support phase: **Technical upgrade Support (Only)** ### What's new -:::row::: - :::column::: - **Platform** - * fix1 - * fix2 - - :::column-end::: - :::column::: - **Engine** - * fix1 - * fix2 - :::column-end::: -:::row-end::: +* Fixed BSOD on WS2016 with Exchange +* Support platform updates when TMP is redirected to network path +* Platform and engine versions are added to [WDSI](https://www.microsoft.com/wdsi/defenderupdates) +* extend Emergency signature update to [passive mode](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility) +* Fix 4.18.1911.10 hang ### Known Issues -No known issues +[**Fixed**] devices utilizing [modern standby mode](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby) may experience a hang with the Windows Defender filter driver that results in a gap of protection. Affected machines appear to the customer as having not updated to the latest antimalware platform. +
+> [!IMPORTANT] +> This updates is needed by RS1 devices running lower version of the platform to support SHA2.
This update has reboot flag for systems that are experiencing the hang issue.
the This update is re-released in April 2020 and will not be superseded by newer updates to keep future availability. +
@@ -181,22 +159,14 @@ Support phase: **No support** ### What's new -:::row::: - :::column::: - **Platform** - * fix1 - * fix2 - - :::column-end::: - :::column::: - **Engine** - * fix1 - * fix2 - :::column-end::: -:::row-end::: +* Fixed MpCmdRun tracing level +* Fixed WDFilter version info +* Improve notifications (PUA) +* add MRT logs to support files ### Known Issues No known issues +
## Windows Defender Antivirus platform support @@ -226,7 +196,7 @@ The below table provides the Windows Defender Antivirus platform and engine vers |1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) | |1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) | -Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet) +Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) ## In this section From d7e05c006158fe6981e900372de1f7d5445d291d Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Thu, 30 Apr 2020 09:07:41 -0700 Subject: [PATCH 7/9] Update manage-updates-baselines-windows-defender-antivirus.md final --- .../manage-updates-baselines-windows-defender-antivirus.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 2a8874766c..4b1cb37db3 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -46,9 +46,11 @@ Windows Defender Antivirus requires [monthly updates (KB4052623)](https://suppor You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) -## Released platform and engine versions +> [!NOTE] +> We release these monthly updates in phases (aka rings). This result in multiple packages showing up in your WSUS server. + +## Monthly platform and engine versions -### Monthly platform and engine releases For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) All our updates contain: From 5a0b42a25433558621cbcbfbd2cc8227b206e728 Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Thu, 30 Apr 2020 09:38:18 -0700 Subject: [PATCH 8/9] Update manage-updates-baselines-windows-defender-antivirus.md remove rings and typo --- .../manage-updates-baselines-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 4b1cb37db3..8146772e45 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -47,7 +47,7 @@ You can manage the distribution of updates through [Windows Server Update Servic For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) > [!NOTE] -> We release these monthly updates in phases (aka rings). This result in multiple packages showing up in your WSUS server. +> We release these monthly updates in phases. This results in multiple packages showing up in your WSUS server. ## Monthly platform and engine versions From 0ab5e0a75c4871ed93427e78f644922da32977e5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 30 Apr 2020 10:30:47 -0700 Subject: [PATCH 9/9] Update manage-updates-baselines-windows-defender-antivirus.md --- .../manage-updates-baselines-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 8146772e45..26af9d3642 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -93,7 +93,7 @@ No known issues ### What's new -* CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus) +* CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus) * Improve diagnostic capability * reduce Security intelligence timeout (5min) * Extend AMSI engine internal log capability