From 0af8eccb266c6b12eb7ab82e01a1a126f06d2737 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 19 Sep 2018 10:15:01 -0700 Subject: [PATCH 01/11] added slider table --- .../how-user-account-control-works.md | 100 +++++++++++++----- 1 file changed, 71 insertions(+), 29 deletions(-) diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 6d29481a6a..4625ced951 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -7,7 +7,7 @@ ms.mktglfcycl: operate ms.sitesec: library ms.pagetype: security author: brianlic-msft -ms.date: 04/19/2017 +ms.date: 09/19/2018 --- # How User Account Control works @@ -156,37 +156,79 @@ To better understand each component, review the table below:

Check UAC slider level

-

UAC has four levels of notification to choose from and a slider to use to select the notification level:

- -

Recommended if you often install new software or visit unfamiliar websites.

+

Recommended if you often install new software or visit unfamiliar websites.


  • Notify me only when programs try to make changes to my computer will:

      @@ -172,7 +172,7 @@ To better understand each component, review the table below:
    • Not notify you when you make changes to Windows settings.
    • Freeze other tasks until you respond.
    -

    Recommended if you do not often install apps or visit unfamiliar websites.

    +

    Recommended if you do not often install apps or visit unfamiliar websites.


  • Notify me only when programs try to make changes to my computer (do not dim my desktop) will:

      @@ -180,7 +180,7 @@ To better understand each component, review the table below:
    • Not notify you when you make changes to Windows settings.
    • Not freeze other tasks until you respond.
    -

    Not recommended. Choose this only if it takes a long time to dim the desktop on your computer.

    +

    Not recommended. Choose this only if it takes a long time to dim the desktop on your computer.


  • Never notify (Disable UAC) will:

      From 68d1ed43b9d692125877b25b23ad5f7ea7ecb3a8 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Wed, 19 Sep 2018 19:51:06 +0000 Subject: [PATCH 09/11] Updated safety-scanner-download.md Changing loc priority --- .../threat-protection/intelligence/safety-scanner-download.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/intelligence/safety-scanner-download.md b/windows/security/threat-protection/intelligence/safety-scanner-download.md index 46d99ff069..907f9c9a3a 100644 --- a/windows/security/threat-protection/intelligence/safety-scanner-download.md +++ b/windows/security/threat-protection/intelligence/safety-scanner-download.md @@ -5,7 +5,7 @@ keywords: security, malware ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library -ms.localizationpriority: high +ms.localizationpriority: medium ms.author: dansimp author: dansimp ms.date: 08/01/2018 From bcf8594b573710def82e149a20ee3df8b1c7f218 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 19 Sep 2018 13:15:05 -0700 Subject: [PATCH 10/11] removed classic intune and policies --- ...ows-defender-advanced-threat-protection.md | 85 +------------------ 1 file changed, 1 insertion(+), 84 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index 4d35506749..c9a8e4b1b1 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: medium -ms.date: 04/24/2018 +ms.date: 09/19/2018 --- # Onboard Windows 10 machines using Mobile Device Management tools @@ -55,82 +55,9 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre 7. Select **OK**, and **Create** to save your changes, which creates the profile. - - -### Onboard and monitor machines using the classic Intune console - -1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Windows Defender Security Center](https://securitycenter.windows.com/): - - a. In the navigation pane, select **Settings** > **Onboarding**. - - b. Select Windows 10 as the operating system. - - c. In the **Deployment method** field, select **Mobile Device Management / Microsoft Intune**. - - d. Click **Download package**, and save the .zip file. - -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP.onboarding*. - -3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). - - a. Select **Policy** > **Configuration Policies** > **Add**. - ![Microsoft Intune Configuration Policies](images/atp-add-intune-policy.png) - - b. Under **Windows**, select **Custom Configuration (Windows 10 Desktop and Mobile and later)** > **Create and Deploy a Custom Policy** > **Create Policy**.
      - ![Microsoft Intune Configuration Policies](images/atp-intune-new-policy.png) - - c. Type a name and description for the policy.
      - - ![Microsoft Intune Create Policy](images/atp-intune-policy-name.png) - - d. Under OMA-URI settings, select **Add...**.
      - - ![Microsoft Intune add OMC-URI](images/atp-intune-add-oma.png) - - e. Type the following values then select **OK**: - - ![Microsoft Intune save policy](images/atp-intune-oma-uri-setting.png) - - - **Setting name**: Type a name for the setting. - - **Setting description**: Type a description for the setting. - - **Data type**: Select **String**. - - **OMA-URI**: *./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding* - - **Value**: Copy and paste the contents of the *WindowsDefenderATP.onboarding* file you downloaded. - - - f. Save the policy. - - ![Microsoft Intune save policy](images/atp-intune-save-policy.png) - - g. Deploy the policy. - - ![Microsoft Intune deploy policy](images/atp-intune-deploy-policy.png) - - h. Select the device group to deploy the policy to: - - ![Microsoft Intune manage deployment](images/atp-intune-manage-deployment.png) - -When the policy is deployed and is propagated, machines will be shown in the **Machines list**. - -You can use the following onboarding policies to deploy configuration settings on machines. These policies can be sub-categorized to: -- Onboarding -- Health Status for onboarded machines -- Configuration for onboarded machines - -> [!div class="mx-tableFixed"] -Policy | OMA-URI | Type | Value | Description -:---|:---|:---|:---|:--- -Onboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding | String | Copy content from onboarding MDM file | Onboarding -Health Status for onboarded machines: Sense Is Running | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | TRUE | Windows Defender ATP service is running -Health Status for onboarded machines: Onboarding State | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 1 | Onboarded to Windows Defender ATP -Health Status for onboarded machines: Organization ID | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OrgId | String | Use OrgID from onboarding file | Onboarded to Organization ID -Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | 0 or 1
      Default value: 1 | Windows Defender ATP Sample sharing is enabled -Configuration for onboarded machines: diagnostic data reporting frequency | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/TelemetryReportingFrequency | Integer | 1 or 2
      1: Normal (default)

      2: Expedite | Windows Defender ATP diagnostic data reporting - > [!NOTE] > - The **Health Status for onboarded machines** policy uses read-only properties and can't be remediated. > - Configuration of diagnostic data reporting frequency is only available for machines on Windows 10, version 1703. -> - Using the Expedite mode might have an impact on the machine's battery usage and actual bandwidth used for sensor data. You should consider this when these measures are critical. >[!TIP] @@ -156,16 +83,6 @@ For security reasons, the package used to Offboard machines will expire 30 days 3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). -Offboarding - Use the offboarding policies to remove configuration settings on machines. These policies can be sub-categorized to: -- Offboarding -- Health Status for offboarded machines -- Configuration for offboarded machines - -Policy | OMA-URI | Type | Value | Description -:---|:---|:---|:---|:--- -Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | String | Copy content from offboarding MDM file | Offboarding - Health Status for offboarded machines: Sense Is Running | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | FALSE |Windows Defender ATP service is not running -Health Status for offboarded machines: Onboarding State | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 0 | Offboarded from Windows Defender ATP > [!NOTE] > The **Health Status for offboarded machines** policy uses read-only properties and can't be remediated. From ce8fe5e77ab86244a910d56ff9d0d7959175395f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 19 Sep 2018 13:37:51 -0700 Subject: [PATCH 11/11] add E5 license to cas topic --- .../microsoft-cloud-app-security-config.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md b/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md index 77af2ccba3..b37cd582c8 100644 --- a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md +++ b/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: medium -ms.date: 09/03/2018 +ms.date: 09/19/2018 --- @@ -23,6 +23,10 @@ ms.date: 09/03/2018 To benefit from Windows Defender Advanced Threat Protection (ATP) cloud app discovery signals, turn on Microsoft Cloud App Security integration. + +>[!NOTE] +>This feature is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10 version 1809 or later. + 1. In the navigation pane, select **Preferences setup** > **Advanced features**. 2. Select **Microsoft Cloud App Security** and switch the toggle to **On**. 3. Click **Save preferences**.