From cfa97c0011078c0f673d1025762e8f329002e6f5 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 3 Aug 2020 08:21:11 -0700 Subject: [PATCH 01/66] Edit pass: provisioning-create-package Changes coming, do not review/merge yet. --- .../provisioning-packages/provisioning-create-package.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index 035bdf4010..3c75f63d1f 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -21,12 +21,12 @@ manager: dansimp - Windows 10 - Windows 10 Mobile -You use Windows Configuration Designer to create a provisioning package (.ppkg) that contains customization settings. You can apply the provisioning package to a device running Windows 10 or Windows 10 Mobile. +You can use Windows Configuration Designer to create a provisioning package (.ppkg) that contains customization settings, and then apply the provisioning package to a device running Windows 10 or Windows 10 Mobile. >[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md) ->[!TIP] ->We recommend creating a local admin account when developing and testing your provisioning package. We also recommend using a “least privileged” domain user account to join devices to the Active Directory domain. +> [!TIP] +> We recommend creating a local admin account when developing and testing your provisioning package. We also recommend using a “least privileged” domain user account to join devices to the Active Directory domain. ## Start a new project From a75c6ecfffa08ea71fe6c5ddfb10ff6a4267ad4d Mon Sep 17 00:00:00 2001 From: Adam Gross Date: Wed, 5 Aug 2020 10:36:42 -0500 Subject: [PATCH 02/66] Updated several app names that have changed I have updated the names of several apps. Can someone also update this list for Windows 10 2004? --- .../application-management/apps-in-windows-10.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index c27ad32063..9d150d9583 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -51,13 +51,13 @@ Here are the provisioned Windows apps in Windows 10 versions 1803, 1809, 1903, a | Microsoft.HEIFImageExtension | [HEIF Image Extensions](ms-windows-store://pdp/?PFN=Microsoft.HEIFImageExtension_8wekyb3d8bbwe) | | x | x | x | No | | Microsoft.Messaging | [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.Microsoft3DViewer | [Mixed Reality Viewer](ms-windows-store://pdp/?PFN=Microsoft.Microsoft3DViewer_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.MicrosoftOfficeHub | [My Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | x | x | x | x | Yes | +| Microsoft.MicrosoftOfficeHub | [Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | x | x | x | x | Yes | | Microsoft.MicrosoftSolitaireCollection | [Microsoft Solitaire Collection](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) | x | x | x | x | Yes | | Microsoft.MicrosoftStickyNotes | [Microsoft Sticky Notes](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.MixedReality.Portal | [Mixed Reality Portal](ms-windows-store://pdp/?PFN=Microsoft.MixedReality.Portal_8wekyb3d8bbwe) | | x | x | x | No | | Microsoft.MSPaint | [Paint 3D](ms-windows-store://pdp/?PFN=Microsoft.MSPaint_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Office.OneNote | [OneNote](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | x | x | x | x | Yes | -| Microsoft.OneConnect | [Paid Wi-Fi & Cellular](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | No | +| Microsoft.Office.OneNote | [OneNote for Windows 10](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | x | x | x | x | Yes | +| Microsoft.OneConnect | [Mobile Plans](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.Outlook.DesktopIntegrationServices | | | | | x | | | Microsoft.People | [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.Print3D | [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | x | x | x | x | No | @@ -77,10 +77,10 @@ Here are the provisioned Windows apps in Windows 10 versions 1803, 1809, 1903, a | Microsoft.WindowsMaps | [Windows Maps](ms-windows-store://pdp/?PFN=Microsoft.WindowsMaps_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.WindowsSoundRecorder | [Windows Voice Recorder](ms-windows-store://pdp/?PFN=Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.WindowsStore | [Microsoft Store](ms-windows-store://pdp/?PFN=Microsoft.WindowsStore_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Xbox.TCUI | [Xbox TCUI](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxApp | [Xbox](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxGameOverlay | [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxGamingOverlay | [Xbox Gaming Overlay](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | x | x | x | x | No | +| Microsoft.Xbox.TCUI | [Xbox Live in-game experience](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | x | x | x | x | No | +| Microsoft.XboxApp | [Xbox Console Companion](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | x | x | x | x | No | +| Microsoft.XboxGameOverlay | [Xbox Game Bar Plugin](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | x | x | x | x | No | +| Microsoft.XboxGamingOverlay | [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.XboxIdentityProvider | [Xbox Identity Provider](ms-windows-store://pdp/?PFN=Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.XboxSpeechToTextOverlay | | x | x | x | x | No | | Microsoft.YourPhone | [Your Phone](ms-windows-store://pdp/?PFN=Microsoft.YourPhone_8wekyb3d8bbwe) | | x | x | x | No | From e401b14fa5746aabd67000c2180a87ef70b3b772 Mon Sep 17 00:00:00 2001 From: Russ Rimmerman Date: Sat, 8 Aug 2020 19:56:12 -0500 Subject: [PATCH 03/66] Update open-the-group-policy-management-console-to-windows-firewall.md This heading doesn't seem to make sense and it's lacking sufficient wording in the navigation pane --- ...e-group-policy-management-console-to-windows-firewall.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md index bce220a506..134a6bb928 100644 --- a/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md +++ b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md @@ -1,6 +1,6 @@ --- -title: Open a GPO to Windows Defender Firewall (Windows 10) -description: Open the Group Policy Management Console to Windows Defender Firewall with Advanced Security +title: Group Policy Management of Windows Defender Firewall (Windows 10) +description: Group Policy Management of Windows Defender Firewall with Advanced Security ms.assetid: 5090b2c8-e038-4905-b238-19ecf8227760 ms.reviewer: ms.author: dansimp @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 04/02/2017 --- -# Open the Group Policy Management Console to Windows Defender Firewall +# Group Policy Management of Windows Defender Firewall **Applies to** - Windows 10 From 0556754e06163a59cb6327d134f90fa04f54ce34 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 12 Aug 2020 09:39:45 +0500 Subject: [PATCH 04/66] Update bitlocker-to-go-faq.md --- .../information-protection/bitlocker/bitlocker-to-go-faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md index e8bd11f12b..275443414a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md @@ -24,7 +24,7 @@ ms.date: 07/10/2018 ## What is BitLocker To Go? -BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. +BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. Drive partitioning must meet the [BitLocker Drive Encryption Partitioning Requirements](https://docs.microsoft.com/windows-hardware/manufacture/desktop/bitlocker-drive-encryption#bitlocker-drive-encryption-partitioning-requirements). As with BitLocker, drives that are encrypted using BitLocker To Go can be opened with a password or smart card on another computer by using **BitLocker Drive Encryption** in Control Panel. From 6a3aabb8663ecefec0c988147f4beea056cd1ac4 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 12 Aug 2020 17:13:42 +0500 Subject: [PATCH 05/66] Update network-access-restrict-clients-allowed-to-make-remote-sam-calls.md --- ...ccess-restrict-clients-allowed-to-make-remote-sam-calls.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md index f5a0e5c08f..ed9022b411 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md @@ -91,9 +91,9 @@ In other words, the hotfix in each KB article provides the necessary code and fu | |Default SDDL |Translated SDDL| Comments |---|---|---|---| -|Windows Server 2016 domain controller (reading Active Directory)|“”|-|Everyone has read permissions to preserve compatibility.| +|Windows Server 2016 (or later) domain controller (reading Active Directory)|“”|-|Everyone has read permissions to preserve compatibility.| |Earlier domain controller |-|-|No access check is performed by default.| -|Windows 10, version 1607 non-domain controller|O:SYG:SYD:(A;;RC;;;BA)| Owner: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
Primary group: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
DACL:
• Revision: 0x02
• Size: 0x0020
• Ace Count: 0x001
• Ace[00]-------------------------
  AceType:0x00
  (ACCESS\_ALLOWED_ACE_TYPE)
  AceSize:0x0018
  InheritFlags:0x00
  Access Mask:0x00020000
  AceSid: BUILTIN\Administrators (Alias) (S-1-5-32-544)

  SACL: Not present |Grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group. | +|Windows 10, version 1607 (or later) non-domain controller|O:SYG:SYD:(A;;RC;;;BA)| Owner: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
Primary group: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
DACL:
• Revision: 0x02
• Size: 0x0020
• Ace Count: 0x001
• Ace[00]-------------------------
  AceType:0x00
  (ACCESS\_ALLOWED_ACE_TYPE)
  AceSize:0x0018
  InheritFlags:0x00
  Access Mask:0x00020000
  AceSid: BUILTIN\Administrators (Alias) (S-1-5-32-544)

  SACL: Not present |Grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group. | |Earlier non-domain controller |-|-|No access check is performed by default.| ## Policy management From 69428242703c27f768b02fcd5b8845563324f56a Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Wed, 12 Aug 2020 14:26:33 -0700 Subject: [PATCH 06/66] adding topic, started formatting --- .../troubleshooting-uwp-firewall.md | 2074 +++++++++++++++++ 1 file changed, 2074 insertions(+) create mode 100644 windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md new file mode 100644 index 0000000000..dbc2f8af22 --- /dev/null +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -0,0 +1,2074 @@ +--- +title: Troubleshooting UWP App Connectivity Issues in Windows Firewall +description: Troubleshooting UWP App Connectivity Issues in Windows Firewall + +ms.reviewer: +ms.author: dansimp +ms.prod: w10 +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: dansimp +manager: dansimp +ms.collection: M365-security-compliance +ms.topic: troubleshooting +--- + +# Troubleshooting UWP App Connectivity Issues + +This document is intended to help network admins, support engineers, and developers to +investigate UWP app network connectivity issues. + +# Introduction + +This document guides you through steps to debug different Universal Windows Platform (UWP) app network connectivity issues by providing practical case examples. + +UWP app network connectivity issues typically stem from one of the following causes: + +1. The UWP app was not permitted to receive loopback traffic (this must be configured as, by default, a UWP app is not allowed to receive loopback traffic). +2. The UWP app is missing the proper capability tokens. +3. The private range is configured incorrectly (i.e. set incorrectly through GP/MDM policies, etc.) + +To understand these causes more thoroughly, there are several concepts that should be reviewed. + +The traffic of network packets (e.g. what's permitted and what’s not) on Windows is ultimately determined by the Windows Filtering Platform (WFP). When a UWP app +or the private range is configured incorrectly, it affects how the UWP app’s network traffic will be processed by WFP. + +When a packet is processed by WFP, the characteristics of that packet must explicitly match all the conditions of a filter to either be permitted or dropped to its target address. Connectivity issues typically happen when the packet does not match the filter conditions of any filters, leading the packet to be dropped by a default block filter. The presence of the default block +filters ensures network isolation for UWP applications. Specifically, it guarantees a network drop for a packet that does not have the correct capabilities for the resource it is trying to reach, ensuring the application’s granular access to each resource type and preventing the application from “escaping” its environment. + +For more information on the filter arbitration algorithm and network isolation, +please read [Filter +Arbitration](https://docs.microsoft.com/en-us/windows/win32/fwp/filter-arbitration) +and +[Isolation](https://docs.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation). + +The next sections will cover debugging case examples for loopback and +non-loopback UWP app network connectivity issues. + +> [!NOTE] +> As improvements to debugging and diagnostics around the Windows Filtering Platform are made, the trace examples in this document may not exactly match the +traces collected on an older Windows build. + +# Debugging UWP App Loopback scenarios + +If you have a scenario where you are establishing a TCP/IP connection between two processes on the same host where one of them is a UWP app, you must enable loopback. + +To enable loopback for client outbound connections, run the following in a command prompt: + +`CheckNetIsolation.exe LoopbackExempt -a -n=\` + +To enable loopback for server inbound connections, please run the following in a +command prompt: + +`CheckNetIsolation.exe LoopbackExempt -is -n=\` + +You can ensure loopback is enabled by checking the appx manifests of both the +sender and receiver. + +For more information about loopback scenarios, please read [Communicating with +localhost +(loopback)](https://docs.microsoft.com/en-us/windows/iot-core/develop-your-app/loopback) + +# Debugging Live Drops + +If the issue happened recently, but you find you are not able to reproduce the +issue, go to Debugging Past Drops for the appropriate trace commands. + +If you can consistently reproduce the issue, then you can run the following in +an admin command prompt to gather a fresh trace: + +``` +Netsh wfp capture start keywords=19 +\ +Netsh wfp capture stop +``` + +The above commands will generate a wfpdiag.cab. Inside the .cab exists a +wfpdiag.xml, which contains any allow or drop netEvents and filters that existed +during that repro. Without “keywords=19”, the trace will only collect drop +netEvents. + +Inside the wfpdiag.xml, search for netEvents which have +FWPM_NET_EVENT_TYPE_CLASSIFY_DROP as the netEvent type. To find the relevant +drop events, search for the drop events with matching destination IP address, +package SID, or application ID name. The characters in the application ID name +will be separated by periods: +``` +(ex) + +\ + +\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.w.i.n.d.o.w.s.\\.s.y.s.t.e.m.3.2.\\.s.v.c.h.o.s.t...e.x.e... + +\ +``` +The netEvent will have more information about the packet that was dropped +including information about its capabilities, the filter that dropped the +packet, and much more. + +## Case 1: UWP app connects to Internet target address with all capabilities + +In this example, the UWP app successfully connects to bing.com +[2620:1ec:c11::200]. + +A packet from a UWP app needs the correct networking capability token for the +resource it is trying to reach. + +In this scenario, the app could successfully send a packet to the Internet +target because it had an Internet capability token. + +The following shows the allow netEvent of the app connecting to the target IP. +The netEvent contains information about the packet including its local address, +remote address, capabilities, etc. + +```**Classify Allow netEvent, Wfpdiag-Case-1.xml** + +\ +\ +> \2020-05-21T17:25:59.070Z\ +> \ +> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ +> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ +> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ +> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ +> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ +> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ +> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ +> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ +> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ +> \ +> \FWP_IP_VERSION_V6\ +> \6\ +> \2001:4898:30:3:256c:e5ba:12f3:beb1\ \2620:1ec:c11::200\ +\52127\ +\443\ +\0\ +\ +> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ +> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ +\ +\S-1-5-21-2993214446-1947230185-131795049-1000\ +\FWP_AF_INET6\ +\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ +\ +\0\ +\ +\ +\FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ +\ +> \125918\ +> \50\ +> \0\ +> \1\ +> \1\ +\ +\ +\ +\0000000000000000\ +\ +> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ +> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ +\ +\0\ +\ +\ +> \ + \125918\ +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + \FWP_ACTION_PERMIT\ +> \ +> \ + \121167\ + \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + \FWP_ACTION_PERMIT\ + \ +\ +\ +\ +``` + +The following is the filter that permitted the packet to be sent to the target +address according to the terminatingFiltersInfo in the netEvent. This packet was +allowed by Filter \#125918 which is from the InternetClient Default Rule. + +**InternetClient Default Rule Filter \#125918, Wfpdiag-Case-1.xml** +``` +\ + +> \{3389708e-f7ae-4ebc-a61a-f659065ab24e}\ + +> \ + +> \InternetClient Default Rule\ + +> \InternetClient Default Rule\ + +> \ + +> \ + +> \FWPM_PROVIDER_MPSSVC_WSH\ + +> \ + +> \ad2b000000000000\ + +> \.+......\ + +> \ + +> \FWPM_LAYER_ALE_AUTH_CONNECT_V6\ + +> \FWPM_SUBLAYER_MPSSVC_WSH\ + +> \ + +> \FWP_EMPTY\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_PACKAGE_ID\ + +> \FWP_MATCH_NOT_EQUAL\ + +> \ + +> \FWP_SID\ + +> \S-1-0-0\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ + +> \FWP_MATCH_RANGE\ + +> \ + +> \FWP_RANGE_TYPE\ + +> \ + +> \ + +> \FWP_BYTE_ARRAY16_TYPE\ + +> \::\ + +> \ + +> \ + +> \FWP_BYTE_ARRAY16_TYPE\ + +> \ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff\ + +> \ + +> \ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_CURRENT_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_USER_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_SECURITY_DESCRIPTOR_TYPE\ + +> \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ + +> \ + +> \ + +> \ + +> \ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \0\ + +> \ + +> \125918\ + +> \ + +> \FWP_UINT64\ + +> \103079219136\ + +> \ + +\ +``` +One condition is + +**Capabilities Condition in Filter \#125918, Wfpdiag-Case-1.xml** +``` +\ + +> \FWPM_CONDITION_ALE_USER_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_SECURITY_DESCRIPTOR_TYPE\ + +> \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ + +> \ + +\ +``` +which is the condition for checking capabilities in this filter. + +The important part of this condition is S-1-15-3-1, which is the capability SID +for INTERNET_CLIENT privileges. + +From the netEvent’s capabilities section, +``` +Capabilities from netEvent, Wfpdiag-Case-1.xml + +\ + +> **\FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\** \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ + +\FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ + +\ +``` +it shows the packet came from an app with an Internet client token +(FWP_CAPABILITIES_FLAG_INTERNET_CLIENT) which matches the capability SID in the +filter. All the other conditions are also met for the filter, so the packet is +allowed. + +Something to note is that the only capability token required for the packet to +reach bing.com was the Internet client token, even though this example showed +the packet having all capabilities. + +## Case 2: UWP APP cannot reach Internet target address and has no capabilities + +In this example, the UWP app is unable to connect to bing.com +[2620:1ec:c11::200]. + +The following is a drop netEvent that was captured in the traces during this +repro. + +**Classify Drop netEvent, Wfpdiag-Case-2.xml** +``` +\ +\ +\2020-03-30T23:53:09.720Z\ +\ +\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ +\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ +\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ +\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ +\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ +\FWPM_NET_EVENT_FLAG_APP_ID_SET\ +\FWPM_NET_EVENT_FLAG_USER_ID_SET\ +\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ +\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ +\ +\FWP_IP_VERSION_V6\ +\6\ +\2001:4898:1a:1045:8469:3351:e6e2:543\ +\2620:1ec:c11::200\ +\63187\ +\443\ +\0\ +\ +\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0034002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ +\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...4...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ +\ +\S-1-5-21-2788718703-1626973220-3690764900-1000\ +\FWP_AF_INET6\ +\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ +\ +\0\ +\ +\ +\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ +\ +\68893\ +\50\ +\0\ +\1\ +\1\ +\MS_FWP_DIRECTION_OUT\ +\false\ +\ +\0\ +\0\ +\ +\ +\ +\0000000000000000\ +\ +\0\ +\ +\ +\ +\68893\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ +\FWP_ACTION_BLOCK\ +\ +\ +\68879\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ +\FWP_ACTION_PERMIT\ +\ +\ +\ +\ +``` +The first thing that should be checked in the netEvent is the capabilities +field\*. In this example, the capabilities field is empty, indicating that the +UWP app was not configured with any capability tokens to allow it to connect to +a network. + +**Internal Fields from netEvent, Wfpdiag-Case-2.xml** +``` +\ +\ +\0000000000000000\ +**\** +\0\ +\ +\ +\ +\68893\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ +\FWP_ACTION_BLOCK\ +\ +\ +\68879\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ +\FWP_ACTION_PERMIT\ +\ +\ +\ +``` +The netEvent also gives us information about the filter that explicitly dropped +this packet, like the FilterId, listed under classify drop + +**Classify Drop from netEvent, Wfpdiag-Case-2.xml** +``` +\ +**\68893\** +\50\ +\0\ +\1\ +\1\ +\MS_FWP_DIRECTION_OUT\ +\false\ +\ +\0\ +\0\ +\ +``` +If we search for that filter, \#68893, in Wfpdiag-Case2.xml, we will see that +the packet was dropped by a Block Outbound Default Rule filter. + +**Block Outbound Default Rule Filter \#68893, Wfpdiag-Case-2.xml** + +``` +\ +> \{6d51582f-bcf8-42c4-afc9-e2ce7155c11b}\ +> \ +> \**Block Outbound Default Rule**\ +> \Block Outbound Default Rule\ +> \ +> \ +> \{4b153735-1049-4480-aab4-d1b9bdc03710}\ +> \ +> \b001000000000000\ +> \........\ +> \ +> \FWPM_LAYER_ALE_AUTH_CONNECT_V6\ +> \{b3cdd441-af90-41ba-a745-7c6008ff2300}\ +> \ +> \FWP_EMPTY\ +> \ +> \ +> \ +> \FWPM_CONDITION_ALE_PACKAGE_ID\ +> \FWP_MATCH_NOT_EQUAL\ +> \ +> \FWP_SID\ +> \S-1-0-0\ +> \ +> \ +> \ +> \ +> \FWP_ACTION_BLOCK\ +> \ +> \ +> \0\ +> \ +> \68893\ +> \ +> \FWP_UINT64\ +> \68719476736\ +> \ +\ +``` + +A packet will reach a default block filter if the packet was unable to match any of the conditions of other filters, and thus not allowed by the other filters in +the same sublayer. + +If the packet had the correct capability token, +FWP_CAPABILITIES_FLAG_INTERNET_CLIENT, it would have matched a condition for a +non-default block filter and would have been permitted to reach bing.com. +Without the correct capability tokens, the packet will be explicitly dropped by +a default block outbound filter. + +## Case 3: UWP app cannot reach Internet target address without Internet Client capability + +In this example, the app is unable to connect to bing.com [2620:1ec:c11::200]. + +The app in this scenario only has private network capabilities (Client and +Server). The app is trying to connect to an Internet resource (bing.com), but +only has a private network token. Therefore, the packet will be dropped. + +**Classify Drop netEvent, Wfpdiag-Case-3.xml** +``` +\ +\ +\2020-03-31T16:57:18.570Z\ +\ +\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ +\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ +\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ +\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ +\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ +\FWPM_NET_EVENT_FLAG_APP_ID_SET\ +\FWPM_NET_EVENT_FLAG_USER_ID_SET\ +\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ +\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ +\ +\FWP_IP_VERSION_V6\ +\6\ +\2001:4898:1a:1045:9c65:7805:dd4a:cc4b\ +\2620:1ec:c11::200\ +\64086\ +\443\ +\0\ +\ +\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0035002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ +\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...5...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ +\ +\S-1-5-21-2788718703-1626973220-3690764900-1000\ +\FWP_AF_INET6\ +\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ +\ +\0\ +\ +\ +\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ +\ +\68893\ +\50\ +\0\ +\1\ +\1\ +\MS_FWP_DIRECTION_OUT\ +\false\ +\ +\0\ +\0\ +\ +\ +\ +\0000000000000000\ +**\** +**\FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\** +**\** +\0\ +\ +\ +\ +\68893\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ +\FWP_ACTION_BLOCK\ +\ +\ +\68879\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ +\FWP_ACTION_PERMIT\ +\ +\ +\ +\ +``` + +## Case 4: UWP app cannot reach Intranet target address without Private Network capability + +In this example, the UWP app is unable to reach the Intranet target address, +10.50.50.50, because it does not have a Private Network capability. + +**Classify Drop netEvent, Wfpdiag-Case-4.xml** + +\ + +\ + +> \2020-05-22T21:29:28.601Z\ + +> \ + +> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ + +> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ + +> \ + +> \FWP_IP_VERSION_V4\ + +> \6\ + +> \10.216.117.17\ + +> \10.50.50.50\ + +> \52998\ + +> \53\ + +> \0\ + +> \ + +> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310031002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ + +> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.1...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ + +> \ + +> \S-1-5-21-2993214446-1947230185-131795049-1000\ + +> \FWP_AF_INET\ + +> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ + +> \ + +> \0\ + +> \ + +\ + +> \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ + +> \ + +> \121180\ + +> \48\ + +> \0\ + +> \1\ + +> \1\ + +> \MS_FWP_DIRECTION_OUT\ + +> \false\ + +> \ + +> \0\ + +> \0\ + +\ + +\ + +> \ + +> \0000000000000000\ + +> \ + +> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ + +> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ + +> \ + +> \0\ + +> \ + +> \ + +> \ + +> \121180\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + +> \FWP_ACTION_BLOCK\ + +> \ + +> \ + +> \121165\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +\ + +\ + +## Case 5: UWP app cannot reach “Intranet” target address with Private Network capability + +In this example, the UWP app is unable to reach the Intranet target address, +10.1.1.1, even though it has a Private Network capability token. + +**Classify Drop netEvent, Wfpdiag-Case-5.xml** + +\ + +> \ + +> \2020-05-22T20:54:53.499Z\ + +> \ + +> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ + +> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ + +> \ + +> \FWP_IP_VERSION_V4\ + +> \6\ + +> \10.216.117.17\ + +> \10.1.1.1\ + +> \52956\ + +> \53\ + +> \0\ + +> \ + +> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310033002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ + +> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.3...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ + +> \ + +> \S-1-5-21-2993214446-1947230185-131795049-1000\ + +> \FWP_AF_INET\ + +> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ + +> \ + +> \0\ + +> \ + +\ + +> \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ + +> \ + +> \121180\ + +> \48\ + +> \0\ + +> \1\ + +> \1\ + +> \MS_FWP_DIRECTION_OUT\ + +> \false\ + +> \ + +> \0\ + +> \0\ + +> \ + +> \ + +> \ + +> \0000000000000000\ + +> \ + +> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ + +> \ + +> \0\ + +> \ + +> \ + +> \ + +> \121180\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + +> \FWP_ACTION_BLOCK\ + +> \ + +> \ + +> \121165\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \ + +\ + +The following shows the filter that blocked the event: + +**Block Outbound Default Rule Filter \#121180, Wfpdiag-Case-5.xml** + +\ + +> \{e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6}\ + +> \ + +> \Block Outbound Default Rule\ + +> \Block Outbound Default Rule\ + +> \ + +> \ + +> \FWPM_PROVIDER_MPSSVC_WSH\ + +> \ + +> \c029000000000000\ + +> \.)......\ + +> \ + +> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + +> \FWPM_SUBLAYER_MPSSVC_WSH\ + +> \ + +> \FWP_EMPTY\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_PACKAGE_ID\ + +> \FWP_MATCH_NOT_EQUAL\ + +> \ + +> \FWP_SID\ + +> \S-1-0-0\ + +> \ + +> \ + +> \ + +> \ + +> \FWP_ACTION_BLOCK\ + +> \ + +> \ + +> \0\ + +> \ + +> \121180\ + +> \ + +> \FWP_UINT64\ + +> \274877906944\ + +> \ + +\ + +If the target was in the private range, then it should have been allowed by a +PrivateNetwork Outbound Default Rule filter. + +The following PrivateNetwork Outbound Default Rule filters have conditions for +matching Intranet IP addresses. Since the expected Intranet target address, +10.1.1.1, is not included in these filters it becomes clear that the address is +not in the private range. Check the policies which configure the private range +on the machine (MDM, GP, etc) and make sure it includes the private target +address you wanted to reach. + +**PrivateNetwork Outbound Default Rule Filters, Wfpdiag-Case-5.xml** + +\ + +> \{fd65507b-e356-4e2f-966f-0c9f9c1c6e78}\ + +> \ + +> \PrivateNetwork Outbound Default Rule\ + +> \PrivateNetwork Outbound Default Rule\ + +> \ + +> \ + +> \FWPM_PROVIDER_MPSSVC_WSH\ + +> \ + +> \f22d000000000000\ + +> \.-......\ + +> \ + +> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + +> \FWPM_SUBLAYER_MPSSVC_WSH\ + +> \ + +> \FWP_EMPTY\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_PACKAGE_ID\ + +> \FWP_MATCH_NOT_EQUAL\ + +> \ + +> \FWP_SID\ + +> \S-1-0-0\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1.1.1.1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_CURRENT_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_USER_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_SECURITY_DESCRIPTOR_TYPE\ + +> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ + +> \ + +> \ + +> \ + +> \ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \0\ + +> \ + +> \129656\ + +> \ + +> \FWP_UINT64\ + +> \144115600392724416\ + +> \ + +> \ + +> \ + +> \{b11b4f8a-222e-49d6-8d69-02728681d8bc}\ + +> \ + +> \PrivateNetwork Outbound Default Rule\ + +> \PrivateNetwork Outbound Default Rule\ + +> \ + +> \ + +> \FWPM_PROVIDER_MPSSVC_WSH\ + +> \ + +> \f22d000000000000\ + +> \.-......\ + +> \ + +> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + +> \FWPM_SUBLAYER_MPSSVC_WSH\ + +> \ + +> \FWP_EMPTY\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_PACKAGE_ID\ + +> \FWP_MATCH_NOT_EQUAL\ + +> \ + +> \FWP_SID\ + +> \S-1-0-0\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ + +> \FWP_MATCH_RANGE\ + +> \ + +> \FWP_RANGE_TYPE\ + +> \ + +> \ + +> \FWP_UINT32\ + +> \172.16.0.0\ + +> \ + +> \ + +> \FWP_UINT32\ + +> \172.31.255.255\ + +> \ + +> \ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_CURRENT_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_USER_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_SECURITY_DESCRIPTOR_TYPE\ + +> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ + +> \ + +> \ + +> \ + +> \ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \0\ + +> \ + +> \129657\ + +> \ + +> \FWP_UINT64\ + +> \36029209335832512\ + +> \ + +\ + +\ + +> \{21cd82bc-6077-4069-94bf-750e5a43ca23}\ + +> \ + +> \PrivateNetwork Outbound Default Rule\ + +> \PrivateNetwork Outbound Default Rule\ + +> \ + +> \ + +> \FWPM_PROVIDER_MPSSVC_WSH\ + +> \ + +> \f22d000000000000\ + +> \.-......\ + +> \ + +> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + +> \FWPM_SUBLAYER_MPSSVC_WSH\ + +> \ + +> \FWP_EMPTY\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_PACKAGE_ID\ + +> \FWP_MATCH_NOT_EQUAL\ + +> \ + +> \FWP_SID\ + +> \S-1-0-0\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ + +> \FWP_MATCH_RANGE\ + +> \ + +> \FWP_RANGE_TYPE\ + +> \ + +> \ + +> \FWP_UINT32\ + +> \192.168.0.0\ + +> \ + +> \ + +> \FWP_UINT32\ + +> \192.168.255.255\ + +> \ + +> \ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_CURRENT_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_USER_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_SECURITY_DESCRIPTOR_TYPE\ + +> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ + +> \ + +> \ + +> \ + +> \ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \0\ + +> \ + +> \129658\ + +> \ + +> \FWP_UINT64\ + +> \36029209335832512\ + +> \ + +\ + +# Debugging Past Drops + +If you are debugging a network drop from the past or from a remote machine, you +may have traces already collected from Feedback Hub, such as nettrace.etl and +wfpstate.xml. Once nettrace.etl is converted, nettrace.txt will have the +netEvents of the reproduced event, and wfpstate.xml will contain the filters +that were present on the machine at the time. + +If you **do not** have a live repro or traces already collected, you can still +collect traces after the UWP network connectivity issue has happened by running +these commands in an Admin command prompt + +> \ + +> Netsh wfp show netevents + +> Netsh wfp show state + +“Netsh wfp show netevents” will generate netevents.xml, which contains the past +net events. “Netsh wfp show state” will generate wfpstate.xml, which contains +the current filters present on the machine. + +Unfortunately, collecting traces after the UWP network connectivity issue is not +always reliable. + +NetEvents on the machine are stored in a buffer. Once that buffer has reached +max capacity, the buffer will overwrite older net events. Due to the buffer +overwrite, it is possible that the collected netevents.xml will not contain the +net event associated with the UWP network connectivity issue if it was +overwritten. Additionally, filters on the machine can get deleted and re-added +with different filterIds due to miscellaneous events on the machine. Because of +this, a filterId from “netsh wfp show netevents” may not necessarily match any +filter in “netsh wfp show state” because that filterId may be outdated. + +If you can reproduce the UWP network connectivity issue consistently, we would +recommend using the commands from Debugging Live Drops instead. + +Additionally, you can still follow the examples from Debugging Live Drops +section using the trace commands in this section, even if you do not have a live +repro. The netEvents and filters are stored in one file in Debugging Live Drops +as opposed to two separate files in the following Debugging Past Drops examples. + +## Case 7: Debugging Past Drop - UWP app cannot reach Internet target address and has no capabilities + +In this example, the UWP app is unable to connect to bing.com. + +Classify Drop Net Event, NetEvents-Case-7.xml + +\ + +\ + +\2020-05-04T22:04:07.039Z\ + +\ + +\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ + +\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ + +\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ + +\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ + +\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ + +\FWPM_NET_EVENT_FLAG_APP_ID_SET\ + +\FWPM_NET_EVENT_FLAG_USER_ID_SET\ + +\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ + +\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ + +\ + +\FWP_IP_VERSION_V4\ + +\6\ + +\10.195.36.30\ + +\204.79.197.200\ + +\57062\ + +\443\ + +\0\ + +\ + +\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310032002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ + +\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.2...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ + +\ + +\S-1-5-21-1578316205-4060061518-881547182-1000\ + +\FWP_AF_INET\ + +\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ + +\ + +\0\ + +\ + +\ + +\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ + +\ + +\206064\ + +\48\ + +\0\ + +\1\ + +\1\ + +\MS_FWP_DIRECTION_OUT\ + +\false\ + +\ + +\0\ + +\0\ + +\ + +\ + +\ + +\0000000000000000\ + +\ + +\0\ + +\ + +\ + +\ + +\206064\ + +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + +\FWP_ACTION_BLOCK\ + +\ + +\ + +\206049\ + +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + +\FWP_ACTION_PERMIT\ + +\ + +\ + +\ + +\ + +The Internal fields lists no active capabilities, and the packet is dropped at +filter 206064. + +This is a default block rule filter, meaning the packet passed through every +filter that could have allowed it, but because conditions didn’t match for any +those filters, the packet fell to the filter which blocks any packet that the +Security Descriptor doesn’t match. + +**Block Outbound Default Rule Filter \#206064, FilterState-Case-7.xml** + +\ + +\{f138d1ad-9293-478f-8519-c3368e796711}\ + +\ + +\Block Outbound Default Rule\ + +\Block Outbound Default Rule\ + +\ + +\ + +\FWPM_PROVIDER_MPSSVC_WSH\ + +\ + +\2e65000000000000\ + +\.e......\ + +\ + +\FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + +\FWPM_SUBLAYER_MPSSVC_WSH\ + +\ + +\FWP_EMPTY\ + +\ + +\ + +\ + +\FWPM_CONDITION_ALE_PACKAGE_ID\ + +\FWP_MATCH_NOT_EQUAL\ + +\ + +\FWP_SID\ + +\S-1-0-0\ + +\ + +\ + +\ + +\ + +\FWP_ACTION_BLOCK\ + +\ + +\ + +\0\ + +\ + +\206064\ + +\ + +\FWP_UINT64\ + +\274877906944\ + +\ + +\ + +## Case 8: Debugging Past Drop - UWP app connects to Internet target address with all capabilities + +In this example, the UWP app successfully connects to bing.com [204.79.197.200]. + +**Classify Allow Net Event, NetEvents-Case-8.xml** + +\ + +> \ + +> \2020-05-04T18:49:55.101Z\ + +> \ + +> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ + +> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ + +> \ + +> \FWP_IP_VERSION_V4\ + +> \6\ + +> \10.195.36.30\ + +> \204.79.197.200\ + +> \61673\ + +> \443\ + +> \0\ + +> \ + +> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ + +> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ + +> \ + +> \S-1-5-21-1578316205-4060061518-881547182-1000\ + +> \FWP_AF_INET\ + +> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ + +> \ + +> \0\ + +> \ + +> \ + +> \FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ + +> \ + +> \208757\ + +> \48\ + +> \0\ + +> \1\ + +> \1\ + +> \ + +> \ + +> \ + +> \0000000000000000\ + +> \ + +> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ + +> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ + +> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ + +> \ + +> \0\ + +> \ + +> \ + +> \ + +> \208757\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \206049\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \ + +\ + +Important things to note: all capabilities are enabled and the resulting filter +determining the flow of the packet is 208757. + +The filter stated above with action permit: + +**InternetClient Default Rule Filter \#208757, FilterState-Case-8.xml** + + \ + + \{e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5}\ + + \ + + \InternetClient Default Rule\ + + \InternetClient Default Rule\ + + \ + + \ + + \FWPM_PROVIDER_MPSSVC_WSH\ + + \ + + \e167000000000000\ + + \.g......\ + + \ + + \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + + \FWPM_SUBLAYER_MPSSVC_WSH\ + + \ + + \FWP_EMPTY\ + + \ + + \ + + \ + + \FWPM_CONDITION_ALE_PACKAGE_ID\ + + \FWP_MATCH_NOT_EQUAL\ + + \ + + \FWP_SID\ + + \S-1-0-0\ + + \ + + \ + + \ + + \FWPM_CONDITION_IP_REMOTE_ADDRESS\ + + \FWP_MATCH_RANGE\ + + \ + + \FWP_RANGE_TYPE\ + + \ + + \ + + \FWP_UINT32\ + + \0.0.0.0\ + + \ + + \ + + \FWP_UINT32\ + + \255.255.255.255\ + + \ + + \ + + \ + + \ + + \ + + \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ + + \FWP_MATCH_EQUAL\ + + \ + + \FWP_UINT32\ + + \1\ + + \ + + \ + + \ + + \FWPM_CONDITION_CURRENT_PROFILE_ID\ + + \FWP_MATCH_EQUAL\ + + \ + + \FWP_UINT32\ + + \1\ + + \ + + \ + + \ + + \FWPM_CONDITION_ALE_USER_ID\ + + \FWP_MATCH_EQUAL\ + + \ + + \FWP_SECURITY_DESCRIPTOR_TYPE\ + + \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ + + \ + + \ + + \ + + \ + + \FWP_ACTION_PERMIT\ + + \ + + \ + + \0\ + + \ + + \208757\ + + \ + + \FWP_UINT64\ + + \412316868544\ + + \ + + \ + +\*The capabilities field in a netEvent was added to the traces in the Windows 10 +May 2019 Update From db87b515c2506dbf18ccf4aa6a60c9bb97527579 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 12 Aug 2020 16:11:04 -0700 Subject: [PATCH 07/66] move topics in toc --- .../threat-protection/windows-firewall/TOC.md | 99 ++++++++++++++----- 1 file changed, 77 insertions(+), 22 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index e3271818c1..791aa26a20 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -1,44 +1,54 @@ # [Windows Firewall with Advanced Security](windows-firewall-with-advanced-security.md) -## [Isolating Microsoft Store Apps on Your Network](isolating-apps-on-your-network.md) -## [Securing IPsec](securing-end-to-end-ipsec-connections-by-using-ikev2.md) -## [PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md) -## [Design Guide](windows-firewall-with-advanced-security-design-guide.md) + +## [Plan/Design]() + +### [Design Guide](windows-firewall-with-advanced-security-design-guide.md) + ### [Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) ### [Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) #### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) #### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) #### [Require Encryption](require-encryption-when-accessing-sensitive-network-resources.md) #### [Restrict Access](restrict-access-to-only-specified-users-or-devices.md) + ### [Mapping Goals to a Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) #### [Basic Design](basic-firewall-policy-design.md) #### [Domain Isolation Design](domain-isolation-policy-design.md) #### [Server Isolation Design](server-isolation-policy-design.md) #### [Certificate-based Isolation Design](certificate-based-isolation-policy-design.md) + ### [Evaluating Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md) #### [Basic Design Example](firewall-policy-design-example.md) #### [Domain Isolation Design Example](domain-isolation-policy-design-example.md) #### [Server Isolation Design Example](server-isolation-policy-design-example.md) #### [Certificate-based Isolation Design Example](certificate-based-isolation-policy-design-example.md) + ### [Designing a Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) + #### [Gathering the Info You Need](gathering-the-information-you-need.md) ##### [Network](gathering-information-about-your-current-network-infrastructure.md) ##### [Active Directory](gathering-information-about-your-active-directory-deployment.md) ##### [Computers](gathering-information-about-your-devices.md) ##### [Other Relevant Information](gathering-other-relevant-information.md) #### [Determining the Trusted State of Your Computers](determining-the-trusted-state-of-your-devices.md) + ### [Planning Your Design](planning-your-windows-firewall-with-advanced-security-design.md) #### [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) + #### [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) ##### [Exemption List](exemption-list.md) ##### [Isolated Domain](isolated-domain.md) ##### [Boundary Zone](boundary-zone.md) ##### [Encryption Zone](encryption-zone.md) #### [Planning Server Isolation Zones](planning-server-isolation-zones.md) + #### [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) ##### [Documenting the Zones](documenting-the-zones.md) + ##### [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) ###### [Planning Isolation Groups for the Zones](planning-isolation-groups-for-the-zones.md) ###### [Planning Network Access Groups](planning-network-access-groups.md) + ###### [Planning the GPOs](planning-the-gpos.md) ####### [Firewall GPOs](firewall-gpos.md) ######## [GPO_DOMISO_Firewall](gpo-domiso-firewall.md) @@ -50,25 +60,29 @@ ####### [Encryption Zone GPOs](encryption-zone-gpos.md) ######## [GPO_DOMISO_Encryption](gpo-domiso-encryption.md) ####### [Server Isolation GPOs](server-isolation-gpos.md) + ###### [Planning GPO Deployment](planning-gpo-deployment.md) -### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) -## [Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) -### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) -### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) -### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md) -### [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) -### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) -### [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md) -### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md) -### [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) -#### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md) -#### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md) -#### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md) -#### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md) -### [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) -#### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) -#### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) -### [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) + + +## [Deployment guide]() +### [Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) +#### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) +#### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) + + + + +## [Best practices]() +### [Securing IPsec](securing-end-to-end-ipsec-connections-by-using-ikev2.md) +### [PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md) +### [Isolating Microsoft Store Apps on Your Network](isolating-apps-on-your-network.md) + + + + + + +## [How-to]() ### [Procedures Used in This Guide](procedures-used-in-this-guide.md) #### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) #### [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) @@ -108,3 +122,44 @@ #### [Restrict Server Access](restrict-server-access-to-members-of-a-group-only.md) #### [Enable Windows Firewall](turn-on-windows-firewall-and-configure-default-behavior.md) #### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) +#### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) + + + + +## [References]() +### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md) +### [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) +### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) +### [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md) +### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md) +### [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) +#### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md) +#### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md) +#### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md) +#### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md) +### [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) +#### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) +#### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) + +### [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) + +### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) + + + +## [Troubleshooting]() + + + + + + + + + + + + + + From 847ebd5a2f280aa41bb1bfaac54ff7f143879238 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Wed, 12 Aug 2020 16:25:33 -0700 Subject: [PATCH 08/66] checking in formatting --- .../troubleshooting-uwp-firewall.md | 518 +----------------- 1 file changed, 13 insertions(+), 505 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index dbc2f8af22..4874e16c5e 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -196,163 +196,84 @@ allowed by Filter \#125918 which is from the InternetClient Default Rule. **InternetClient Default Rule Filter \#125918, Wfpdiag-Case-1.xml** ``` \ - > \{3389708e-f7ae-4ebc-a61a-f659065ab24e}\ - > \ - > \InternetClient Default Rule\ - > \InternetClient Default Rule\ - > \ - > \ - > \FWPM_PROVIDER_MPSSVC_WSH\ - > \ - > \ad2b000000000000\ - > \.+......\ - > \ - > \FWPM_LAYER_ALE_AUTH_CONNECT_V6\ - > \FWPM_SUBLAYER_MPSSVC_WSH\ - > \ - > \FWP_EMPTY\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_PACKAGE_ID\ - > \FWP_MATCH_NOT_EQUAL\ - > \ - > \FWP_SID\ - > \S-1-0-0\ - > \ - > \ - > \ - > \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - > \FWP_MATCH_RANGE\ - > \ - > \FWP_RANGE_TYPE\ - > \ - > \ - > \FWP_BYTE_ARRAY16_TYPE\ - > \::\ - > \ - > \ - > \FWP_BYTE_ARRAY16_TYPE\ - > \ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff\ - > \ - > \ - > \ - > \ - > \ - > \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_CURRENT_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_USER_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_SECURITY_DESCRIPTOR_TYPE\ - > \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ - > \ - > \ - > \ - > \ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \0\ - > \ - > \125918\ - > \ - > \FWP_UINT64\ - > \103079219136\ - > \ - \ ``` One condition is @@ -360,19 +281,12 @@ One condition is **Capabilities Condition in Filter \#125918, Wfpdiag-Case-1.xml** ``` \ - > \FWPM_CONDITION_ALE_USER_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_SECURITY_DESCRIPTOR_TYPE\ - > \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ - > \ - \ ``` which is the condition for checking capabilities in this filter. @@ -381,15 +295,12 @@ The important part of this condition is S-1-15-3-1, which is the capability SID for INTERNET_CLIENT privileges. From the netEvent’s capabilities section, -``` + Capabilities from netEvent, Wfpdiag-Case-1.xml - +``` \ - > **\FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\** \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ - \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ - \ ``` it shows the packet came from an app with an Internet client token @@ -665,842 +576,439 @@ In this example, the UWP app is unable to reach the Intranet target address, 10.50.50.50, because it does not have a Private Network capability. **Classify Drop netEvent, Wfpdiag-Case-4.xml** - +``` \ - \ - > \2020-05-22T21:29:28.601Z\ - > \ - > \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_APP_ID_SET\ - > \FWPM_NET_EVENT_FLAG_USER_ID_SET\ - > \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ - > \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ - > \ - > \FWP_IP_VERSION_V4\ - > \6\ - > \10.216.117.17\ - > \10.50.50.50\ - > \52998\ - > \53\ - > \0\ - > \ - > \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310031002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ - > \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. > .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.1...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ - > \ - > \S-1-5-21-2993214446-1947230185-131795049-1000\ - > \FWP_AF_INET\ - > \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ - > \ - > \0\ - > \ - \ - > \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ - > \ - > \121180\ - > \48\ - > \0\ - > \1\ - > \1\ - > \MS_FWP_DIRECTION_OUT\ - > \false\ - > \ - > \0\ - > \0\ - \ - \ - > \ - > \0000000000000000\ - > \ - > \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ - > \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ - > \ - > \0\ - > \ - > \ - > \ - > \121180\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - > \FWP_ACTION_BLOCK\ - > \ - > \ - > \121165\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - > \FWP_ACTION_PERMIT\ - > \ - > \ - \ - \ - +``` ## Case 5: UWP app cannot reach “Intranet” target address with Private Network capability In this example, the UWP app is unable to reach the Intranet target address, 10.1.1.1, even though it has a Private Network capability token. **Classify Drop netEvent, Wfpdiag-Case-5.xml** - +``` \ - > \ - > \2020-05-22T20:54:53.499Z\ - > \ - > \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_APP_ID_SET\ - > \FWPM_NET_EVENT_FLAG_USER_ID_SET\ - > \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ - > \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ - > \ - > \FWP_IP_VERSION_V4\ - > \6\ - > \10.216.117.17\ - > \10.1.1.1\ - > \52956\ - > \53\ - > \0\ - > \ - > \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310033002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ - > \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. > .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.3...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ - > \ - > \S-1-5-21-2993214446-1947230185-131795049-1000\ - > \FWP_AF_INET\ - > \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ - > \ - > \0\ - > \ - \ - > \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ - > \ - > \121180\ - > \48\ - > \0\ - > \1\ - > \1\ - > \MS_FWP_DIRECTION_OUT\ - > \false\ - > \ - > \0\ - > \0\ - > \ - > \ - > \ - > \0000000000000000\ - > \ - > \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ - > \ - > \0\ - > \ - > \ - > \ - > \121180\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - > \FWP_ACTION_BLOCK\ - > \ - > \ - > \121165\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \ - \ - +``` The following shows the filter that blocked the event: **Block Outbound Default Rule Filter \#121180, Wfpdiag-Case-5.xml** +``` \ - > \{e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6}\ - > \ - > \Block Outbound Default Rule\ - > \Block Outbound Default Rule\ - > \ - > \ - > \FWPM_PROVIDER_MPSSVC_WSH\ - > \ - > \c029000000000000\ - > \.)......\ - > \ - > \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - > \FWPM_SUBLAYER_MPSSVC_WSH\ - > \ - > \FWP_EMPTY\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_PACKAGE_ID\ - > \FWP_MATCH_NOT_EQUAL\ - > \ - > \FWP_SID\ - > \S-1-0-0\ - > \ - > \ - > \ - > \ - > \FWP_ACTION_BLOCK\ - > \ - > \ - > \0\ - > \ - > \121180\ - > \ - > \FWP_UINT64\ - > \274877906944\ - > \ - \ - +``` If the target was in the private range, then it should have been allowed by a PrivateNetwork Outbound Default Rule filter. -The following PrivateNetwork Outbound Default Rule filters have conditions for -matching Intranet IP addresses. Since the expected Intranet target address, -10.1.1.1, is not included in these filters it becomes clear that the address is -not in the private range. Check the policies which configure the private range -on the machine (MDM, GP, etc) and make sure it includes the private target -address you wanted to reach. +The following PrivateNetwork Outbound Default Rule filters have conditions for matching Intranet IP addresses. Since the expected Intranet target address, +10.1.1.1, is not included in these filters it becomes clear that the address isnot in the private range. Check the policies which configure the private range +on the machine (MDM, GP, etc) and make sure it includes the private targetaddress you wanted to reach. **PrivateNetwork Outbound Default Rule Filters, Wfpdiag-Case-5.xml** - +``` \ - > \{fd65507b-e356-4e2f-966f-0c9f9c1c6e78}\ - > \ - > \PrivateNetwork Outbound Default Rule\ - > \PrivateNetwork Outbound Default Rule\ - > \ - > \ - > \FWPM_PROVIDER_MPSSVC_WSH\ - > \ - > \f22d000000000000\ - > \.-......\ - > \ - > \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - > \FWPM_SUBLAYER_MPSSVC_WSH\ - > \ - > \FWP_EMPTY\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_PACKAGE_ID\ - > \FWP_MATCH_NOT_EQUAL\ - > \ - > \FWP_SID\ - > \S-1-0-0\ - > \ - > \ - > \ - > \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1.1.1.1\ - > \ - > \ - > \ - > \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_CURRENT_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_USER_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_SECURITY_DESCRIPTOR_TYPE\ - > \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ - > \ - > \ - > \ - > \ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \0\ - > \ - > \129656\ - > \ - > \FWP_UINT64\ - > \144115600392724416\ - > \ - > \ - > \ - > \{b11b4f8a-222e-49d6-8d69-02728681d8bc}\ - > \ - > \PrivateNetwork Outbound Default Rule\ - > \PrivateNetwork Outbound Default Rule\ - > \ - > \ - > \FWPM_PROVIDER_MPSSVC_WSH\ - > \ - > \f22d000000000000\ - > \.-......\ - > \ - > \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - > \FWPM_SUBLAYER_MPSSVC_WSH\ - > \ - > \FWP_EMPTY\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_PACKAGE_ID\ - > \FWP_MATCH_NOT_EQUAL\ - > \ - > \FWP_SID\ - > \S-1-0-0\ - > \ - > \ - > \ - > \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - > \FWP_MATCH_RANGE\ - > \ - > \FWP_RANGE_TYPE\ - > \ - > \ - > \FWP_UINT32\ - > \172.16.0.0\ - > \ - > \ - > \FWP_UINT32\ - > \172.31.255.255\ - > \ - > \ - > \ - > \ - > \ - > \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_CURRENT_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_USER_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_SECURITY_DESCRIPTOR_TYPE\ - > \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ - > \ - > \ - > \ - > \ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \0\ - > \ - > \129657\ - > \ - > \FWP_UINT64\ - > \36029209335832512\ - > \ - \ - \ - > \{21cd82bc-6077-4069-94bf-750e5a43ca23}\ - > \ - > \PrivateNetwork Outbound Default Rule\ - > \PrivateNetwork Outbound Default Rule\ - > \ - > \ - > \FWPM_PROVIDER_MPSSVC_WSH\ - > \ - > \f22d000000000000\ - > \.-......\ - > \ - > \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - > \FWPM_SUBLAYER_MPSSVC_WSH\ - > \ - > \FWP_EMPTY\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_PACKAGE_ID\ - > \FWP_MATCH_NOT_EQUAL\ - > \ - > \FWP_SID\ - > \S-1-0-0\ - > \ - > \ - > \ - > \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - > \FWP_MATCH_RANGE\ - > \ - > \FWP_RANGE_TYPE\ - > \ - > \ - > \FWP_UINT32\ - > \192.168.0.0\ - > \ - > \ - > \FWP_UINT32\ - > \192.168.255.255\ - > \ - > \ - > \ - > \ - > \ - > \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_CURRENT_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_USER_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_SECURITY_DESCRIPTOR_TYPE\ - > \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ - > \ - > \ - > \ - > \ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \0\ - > \ - > \129658\ - > \ - > \FWP_UINT64\ - > \36029209335832512\ - > \ - \ - +``` # Debugging Past Drops If you are debugging a network drop from the past or from a remote machine, you From 8771fdd2ae4e44ffc834f3afca8252328b3a5f9b Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Wed, 12 Aug 2020 17:03:33 -0700 Subject: [PATCH 09/66] more formatting --- .../troubleshooting-uwp-firewall.md | 300 ++---------------- 1 file changed, 30 insertions(+), 270 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index 4874e16c5e..fc7c29c60d 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -122,8 +122,8 @@ The following shows the allow netEvent of the app connecting to the target IP. The netEvent contains information about the packet including its local address, remote address, capabilities, etc. -```**Classify Allow netEvent, Wfpdiag-Case-1.xml** - +**Classify Allow netEvent, Wfpdiag-Case-1.xml** +```xml \ \ > \2020-05-21T17:25:59.070Z\ @@ -194,7 +194,7 @@ address according to the terminatingFiltersInfo in the netEvent. This packet was allowed by Filter \#125918 which is from the InternetClient Default Rule. **InternetClient Default Rule Filter \#125918, Wfpdiag-Case-1.xml** -``` +```xml \ > \{3389708e-f7ae-4ebc-a61a-f659065ab24e}\ > \ @@ -279,7 +279,7 @@ allowed by Filter \#125918 which is from the InternetClient Default Rule. One condition is **Capabilities Condition in Filter \#125918, Wfpdiag-Case-1.xml** -``` +```xml \ > \FWPM_CONDITION_ALE_USER_ID\ > \FWP_MATCH_EQUAL\ @@ -297,7 +297,7 @@ for INTERNET_CLIENT privileges. From the netEvent’s capabilities section, Capabilities from netEvent, Wfpdiag-Case-1.xml -``` +```xml \ > **\FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\** \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ @@ -321,7 +321,7 @@ The following is a drop netEvent that was captured in the traces during this repro. **Classify Drop netEvent, Wfpdiag-Case-2.xml** -``` +```xml \ \ \2020-03-30T23:53:09.720Z\ @@ -395,7 +395,7 @@ UWP app was not configured with any capability tokens to allow it to connect to a network. **Internal Fields from netEvent, Wfpdiag-Case-2.xml** -``` +```xml \ \ \0000000000000000\ @@ -420,7 +420,7 @@ The netEvent also gives us information about the filter that explicitly dropped this packet, like the FilterId, listed under classify drop **Classify Drop from netEvent, Wfpdiag-Case-2.xml** -``` +```xml \ **\68893\** \50\ @@ -439,7 +439,7 @@ the packet was dropped by a Block Outbound Default Rule filter. **Block Outbound Default Rule Filter \#68893, Wfpdiag-Case-2.xml** -``` +```xml \ > \{6d51582f-bcf8-42c4-afc9-e2ce7155c11b}\ > \ @@ -499,7 +499,7 @@ Server). The app is trying to connect to an Internet resource (bing.com), but only has a private network token. Therefore, the packet will be dropped. **Classify Drop netEvent, Wfpdiag-Case-3.xml** -``` +```xml \ \ \2020-03-31T16:57:18.570Z\ @@ -576,7 +576,7 @@ In this example, the UWP app is unable to reach the Intranet target address, 10.50.50.50, because it does not have a Private Network capability. **Classify Drop netEvent, Wfpdiag-Case-4.xml** -``` +```xml \ \ > \2020-05-22T21:29:28.601Z\ @@ -653,7 +653,7 @@ In this example, the UWP app is unable to reach the Intranet target address, 10.1.1.1, even though it has a Private Network capability token. **Classify Drop netEvent, Wfpdiag-Case-5.xml** -``` +```xml \ > \ > \2020-05-22T20:54:53.499Z\ @@ -727,7 +727,7 @@ The following shows the filter that blocked the event: **Block Outbound Default Rule Filter \#121180, Wfpdiag-Case-5.xml** -``` +```xml \ > \{e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6}\ > \ @@ -776,7 +776,7 @@ The following PrivateNetwork Outbound Default Rule filters have conditions for m on the machine (MDM, GP, etc) and make sure it includes the private targetaddress you wanted to reach. **PrivateNetwork Outbound Default Rule Filters, Wfpdiag-Case-5.xml** -``` +```xml \ > \{fd65507b-e356-4e2f-966f-0c9f9c1c6e78}\ > \ @@ -1021,11 +1021,11 @@ If you **do not** have a live repro or traces already collected, you can still collect traces after the UWP network connectivity issue has happened by running these commands in an Admin command prompt +```xml > \ - > Netsh wfp show netevents - > Netsh wfp show state +``` “Netsh wfp show netevents” will generate netevents.xml, which contains the past net events. “Netsh wfp show state” will generate wfpstate.xml, which contains @@ -1057,136 +1057,74 @@ In this example, the UWP app is unable to connect to bing.com. Classify Drop Net Event, NetEvents-Case-7.xml +```xml \ - \ - \2020-05-04T22:04:07.039Z\ - \ - \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ - \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ - \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ - \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ - \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ - \FWPM_NET_EVENT_FLAG_APP_ID_SET\ - \FWPM_NET_EVENT_FLAG_USER_ID_SET\ - \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ - \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ - \ - \FWP_IP_VERSION_V4\ - \6\ - \10.195.36.30\ - \204.79.197.200\ - \57062\ - \443\ - \0\ - \ - \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310032002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ - \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.2...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ - \ - \S-1-5-21-1578316205-4060061518-881547182-1000\ - \FWP_AF_INET\ - \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ - \ - \0\ - \ - \ - \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ - \ - \206064\ - \48\ - \0\ - \1\ - \1\ - \MS_FWP_DIRECTION_OUT\ - \false\ - \ - \0\ - \0\ - \ - \ - \ - \0000000000000000\ - \ - \0\ - \ - \ - \ - \206064\ - \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - \FWP_ACTION_BLOCK\ - \ - \ - \206049\ - \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - \FWP_ACTION_PERMIT\ - \ - \ - \ - \ +``` The Internal fields lists no active capabilities, and the packet is dropped at filter 206064. @@ -1198,385 +1136,207 @@ Security Descriptor doesn’t match. **Block Outbound Default Rule Filter \#206064, FilterState-Case-7.xml** +```xml \ - \{f138d1ad-9293-478f-8519-c3368e796711}\ - \ - \Block Outbound Default Rule\ - \Block Outbound Default Rule\ - \ - \ - \FWPM_PROVIDER_MPSSVC_WSH\ - \ - \2e65000000000000\ - \.e......\ - \ - \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - \FWPM_SUBLAYER_MPSSVC_WSH\ - \ - \FWP_EMPTY\ - \ - \ - \ - \FWPM_CONDITION_ALE_PACKAGE_ID\ - \FWP_MATCH_NOT_EQUAL\ - \ - \FWP_SID\ - \S-1-0-0\ - \ - \ - \ - \ - \FWP_ACTION_BLOCK\ - \ - \ - \0\ - \ - \206064\ - \ - \FWP_UINT64\ - \274877906944\ - \ - \ - +``` ## Case 8: Debugging Past Drop - UWP app connects to Internet target address with all capabilities In this example, the UWP app successfully connects to bing.com [204.79.197.200]. **Classify Allow Net Event, NetEvents-Case-8.xml** +```xml \ - > \ - > \2020-05-04T18:49:55.101Z\ - > \ - > \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_APP_ID_SET\ - > \FWPM_NET_EVENT_FLAG_USER_ID_SET\ - > \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ - > \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ - > \ - > \FWP_IP_VERSION_V4\ - > \6\ - > \10.195.36.30\ - > \204.79.197.200\ - > \61673\ - > \443\ - > \0\ - > \ - > \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ - > \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. > .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ - > \ - > \S-1-5-21-1578316205-4060061518-881547182-1000\ - > \FWP_AF_INET\ - > \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ - > \ - > \0\ - > \ - > \ - > \FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ - > \ - > \208757\ - > \48\ - > \0\ - > \1\ - > \1\ - > \ - > \ - > \ - > \0000000000000000\ - > \ - > \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ - > \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ - > \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ - > \ - > \0\ - > \ - > \ - > \ - > \208757\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \206049\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \ - \ - +``` Important things to note: all capabilities are enabled and the resulting filter determining the flow of the packet is 208757. The filter stated above with action permit: **InternetClient Default Rule Filter \#208757, FilterState-Case-8.xml** - - \ - - \{e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5}\ - - \ - - \InternetClient Default Rule\ - - \InternetClient Default Rule\ - +```xml +\ + \{e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5}\ + \ + \InternetClient Default Rule\ + \InternetClient Default Rule\ \ - \ - \FWPM_PROVIDER_MPSSVC_WSH\ - \ - \e167000000000000\ - \.g......\ - \ - \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - \FWPM_SUBLAYER_MPSSVC_WSH\ - \ - \FWP_EMPTY\ - \ - \ - \ - \FWPM_CONDITION_ALE_PACKAGE_ID\ - \FWP_MATCH_NOT_EQUAL\ - \ - \FWP_SID\ - \S-1-0-0\ - \ - \ - \ - \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - \FWP_MATCH_RANGE\ - \ - \FWP_RANGE_TYPE\ - \ - \ - \FWP_UINT32\ - \0.0.0.0\ - \ - \ - \FWP_UINT32\ - \255.255.255.255\ - \ - \ - \ - \ - \ - \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_UINT32\ - \1\ - \ - \ - \ - \FWPM_CONDITION_CURRENT_PROFILE_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_UINT32\ - \1\ - \ - \ - \ - \FWPM_CONDITION_ALE_USER_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_SECURITY_DESCRIPTOR_TYPE\ - \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ - \ - \ - \ - \ - \FWP_ACTION_PERMIT\ - \ - \ - \0\ - \ - \208757\ - \ - \FWP_UINT64\ - \412316868544\ - \ - \ - -\*The capabilities field in a netEvent was added to the traces in the Windows 10 +``` +The capabilities field in a netEvent was added to the traces in the Windows 10 May 2019 Update From 8b2e9e237b9759ffa14b7df3cd3ab8dd1c0c2e08 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 12 Aug 2020 20:58:58 -0700 Subject: [PATCH 10/66] update --- windows/security/threat-protection/windows-firewall/TOC.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 791aa26a20..69bd3c156c 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -71,17 +71,12 @@ - ## [Best practices]() ### [Securing IPsec](securing-end-to-end-ipsec-connections-by-using-ikev2.md) ### [PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md) ### [Isolating Microsoft Store Apps on Your Network](isolating-apps-on-your-network.md) - - - - ## [How-to]() ### [Procedures Used in This Guide](procedures-used-in-this-guide.md) #### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) From ae4db0dc4a240e2f2fc0a57dbea10d49b0fcf769 Mon Sep 17 00:00:00 2001 From: schmurky Date: Thu, 13 Aug 2020 12:47:29 +0800 Subject: [PATCH 11/66] Updated TOC --- .../threat-protection/windows-firewall/TOC.md | 120 +++++++++--------- 1 file changed, 57 insertions(+), 63 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 69bd3c156c..17d730be02 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -5,41 +5,36 @@ ### [Design Guide](windows-firewall-with-advanced-security-design-guide.md) ### [Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) -### [Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) + +### [Deployment Goals]() + +#### [Identify deployment goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) #### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) #### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) #### [Require Encryption](require-encryption-when-accessing-sensitive-network-resources.md) #### [Restrict Access](restrict-access-to-only-specified-users-or-devices.md) -### [Mapping Goals to a Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) +### [Deployment designs]() + +#### [Mapping Goals to a Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) #### [Basic Design](basic-firewall-policy-design.md) #### [Domain Isolation Design](domain-isolation-policy-design.md) #### [Server Isolation Design](server-isolation-policy-design.md) #### [Certificate-based Isolation Design](certificate-based-isolation-policy-design.md) -### [Evaluating Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md) -#### [Basic Design Example](firewall-policy-design-example.md) -#### [Domain Isolation Design Example](domain-isolation-policy-design-example.md) -#### [Server Isolation Design Example](server-isolation-policy-design-example.md) -#### [Certificate-based Isolation Design Example](certificate-based-isolation-policy-design-example.md) +### [Design plans]() -### [Designing a Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) - -#### [Gathering the Info You Need](gathering-the-information-you-need.md) -##### [Network](gathering-information-about-your-current-network-infrastructure.md) -##### [Active Directory](gathering-information-about-your-active-directory-deployment.md) -##### [Computers](gathering-information-about-your-devices.md) -##### [Other Relevant Information](gathering-other-relevant-information.md) -#### [Determining the Trusted State of Your Computers](determining-the-trusted-state-of-your-devices.md) - -### [Planning Your Design](planning-your-windows-firewall-with-advanced-security-design.md) +#### [Planning Your Design](planning-your-windows-firewall-with-advanced-security-design.md) #### [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) -#### [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) -##### [Exemption List](exemption-list.md) -##### [Isolated Domain](isolated-domain.md) -##### [Boundary Zone](boundary-zone.md) -##### [Encryption Zone](encryption-zone.md) +##### [Planning Domain Isolation Zones]() + +###### [Domain Isolation Zones](planning-domain-isolation-zones.md) +###### [Exemption List](exemption-list.md) +###### [Isolated Domain](isolated-domain.md) +###### [Boundary Zone](boundary-zone.md) +###### [Encryption Zone](encryption-zone.md) + #### [Planning Server Isolation Zones](planning-server-isolation-zones.md) #### [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) @@ -65,7 +60,7 @@ ## [Deployment guide]() -### [Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) + #### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) #### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) @@ -78,46 +73,45 @@ ## [How-to]() -### [Procedures Used in This Guide](procedures-used-in-this-guide.md) -#### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) -#### [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) -#### [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md) -#### [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md) -#### [Configure Authentication Methods](configure-authentication-methods.md) -#### [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md) -#### [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md) -#### [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md) -#### [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md) -#### [Configure the Windows Firewall Log](configure-the-windows-firewall-log.md) -#### [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md) -#### [Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) -#### [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md) -#### [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md) -#### [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md) -#### [Create a Group Policy Object](create-a-group-policy-object.md) -#### [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md) -#### [Create an Authentication Request Rule](create-an-authentication-request-rule.md) -#### [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md) -#### [Create an Inbound Port Rule](create-an-inbound-port-rule.md) -#### [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md) -#### [Create an Outbound Port Rule](create-an-outbound-port-rule.md) -#### [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md) -#### [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md) -#### [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) -#### [Create Windows Firewall rules in Intune](create-windows-firewall-rules-in-intune.md) -#### [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md) -#### [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md) -#### [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md) -#### [Link the GPO to the Domain](link-the-gpo-to-the-domain.md) -#### [Modify GPO Filters](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) -#### [Open IP Security Policies](open-the-group-policy-management-console-to-ip-security-policies.md) -#### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall.md) -#### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) -#### [Open Windows Firewall](open-windows-firewall-with-advanced-security.md) -#### [Restrict Server Access](restrict-server-access-to-members-of-a-group-only.md) -#### [Enable Windows Firewall](turn-on-windows-firewall-and-configure-default-behavior.md) -#### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) -#### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) +### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) +### [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) +### [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md) +### [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md) +### [Configure Authentication Methods](configure-authentication-methods.md) +### [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md) +### [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md) +### [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md) +### [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md) +### [Configure the Windows Firewall Log](configure-the-windows-firewall-log.md) +### [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md) +### [Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) +### [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md) +### [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md) +### [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md) +### [Create a Group Policy Object](create-a-group-policy-object.md) +### [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md) +### [Create an Authentication Request Rule](create-an-authentication-request-rule.md) +### [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md) +### [Create an Inbound Port Rule](create-an-inbound-port-rule.md) +### [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md) +### [Create an Outbound Port Rule](create-an-outbound-port-rule.md) +### [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md) +### [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md) +### [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) +### [Create Windows Firewall rules in Intune](create-windows-firewall-rules-in-intune.md) +### [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md) +### [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md) +### [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md) +### [Link the GPO to the Domain](link-the-gpo-to-the-domain.md) +### [Modify GPO Filters](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) +### [Open IP Security Policies](open-the-group-policy-management-console-to-ip-security-policies.md) +### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall.md) +### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) +### [Open Windows Firewall](open-windows-firewall-with-advanced-security.md) +### [Restrict Server Access](restrict-server-access-to-members-of-a-group-only.md) +### [Enable Windows Firewall](turn-on-windows-firewall-and-configure-default-behavior.md) +### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) +### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) From e8ad1713f727f4c34790d78dd11b12b9f22a4f42 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Thu, 13 Aug 2020 10:03:26 +0500 Subject: [PATCH 12/66] Update dg-readiness-tool.md --- .../identity-protection/credential-guard/dg-readiness-tool.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md index ae96f09ed1..e609c9469d 100644 --- a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md +++ b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md @@ -657,7 +657,7 @@ function PrintHardwareReq { LogAndConsole "###########################################################################" LogAndConsole "OS and Hardware requirements for enabling Device Guard and Credential Guard" - LogAndConsole " 1. OS SKUs: Available only on these OS Skus - Enterprise, Server, Education, Enterprise IoT, Pro, and Home" + LogAndConsole " 1. OS SKUs: Available only on these OS Skus - Enterprise, Server, Education and Enterprise IoT" LogAndConsole " 2. Hardware: Recent hardware that supports virtualization extension with SLAT" LogAndConsole "To learn more please visit: https://aka.ms/dgwhcr" LogAndConsole "########################################################################### `n" @@ -735,7 +735,7 @@ function CheckOSSKU $osname = $((gwmi win32_operatingsystem).Name).ToLower() $_SKUSupported = 0 Log "OSNAME:$osname" - $SKUarray = @("Enterprise", "Education", "IoT", "Windows Server", "Pro", "Home") + $SKUarray = @("Enterprise", "Education", "IoT", "Windows Server") $HLKAllowed = @("microsoft windows 10 pro") foreach ($SKUent in $SKUarray) { From 6c6bb06926cb69a77e32d97bd6bc5e3f41302084 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 13 Aug 2020 13:12:40 -0700 Subject: [PATCH 13/66] Update TOC.md --- .../security/threat-protection/windows-firewall/TOC.md | 9 --------- 1 file changed, 9 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 17d730be02..00296d4b2d 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -7,7 +7,6 @@ ### [Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) ### [Deployment Goals]() - #### [Identify deployment goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) #### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) #### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) @@ -15,7 +14,6 @@ #### [Restrict Access](restrict-access-to-only-specified-users-or-devices.md) ### [Deployment designs]() - #### [Mapping Goals to a Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) #### [Basic Design](basic-firewall-policy-design.md) #### [Domain Isolation Design](domain-isolation-policy-design.md) @@ -23,12 +21,9 @@ #### [Certificate-based Isolation Design](certificate-based-isolation-policy-design.md) ### [Design plans]() - #### [Planning Your Design](planning-your-windows-firewall-with-advanced-security-design.md) #### [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) - ##### [Planning Domain Isolation Zones]() - ###### [Domain Isolation Zones](planning-domain-isolation-zones.md) ###### [Exemption List](exemption-list.md) ###### [Isolated Domain](isolated-domain.md) @@ -60,7 +55,6 @@ ## [Deployment guide]() - #### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) #### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) @@ -113,9 +107,6 @@ ### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) ### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) - - - ## [References]() ### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md) ### [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) From 58cadb1af5084f78fcf02dea9cd36c8d1b989fb8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 13 Aug 2020 13:16:19 -0700 Subject: [PATCH 14/66] fix lines --- windows/security/threat-protection/windows-firewall/TOC.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 00296d4b2d..7861f11250 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -55,8 +55,8 @@ ## [Deployment guide]() -#### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) -#### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) +### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) +### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) From cef561ea53b63153a87c18d7bb65c9810df0cc74 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 13 Aug 2020 16:23:35 -0700 Subject: [PATCH 15/66] more fixin --- .../troubleshooting-uwp-firewall.md | 210 +++++++++--------- 1 file changed, 100 insertions(+), 110 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index fc7c29c60d..bc17fd0a75 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -19,174 +19,164 @@ ms.topic: troubleshooting This document is intended to help network admins, support engineers, and developers to investigate UWP app network connectivity issues. -# Introduction +This document guides you through steps to debug Universal Windows Platform (UWP) app network connectivity issues by providing practical examples. -This document guides you through steps to debug different Universal Windows Platform (UWP) app network connectivity issues by providing practical case examples. +## Typical causes of connectivity issues -UWP app network connectivity issues typically stem from one of the following causes: +UWP app network connectivity issues are typically caused by: -1. The UWP app was not permitted to receive loopback traffic (this must be configured as, by default, a UWP app is not allowed to receive loopback traffic). +1. The UWP app was not permitted to receive loopback traffic. This must be configured. By default, UWP apps are not allowed to receive loopback traffic. 2. The UWP app is missing the proper capability tokens. -3. The private range is configured incorrectly (i.e. set incorrectly through GP/MDM policies, etc.) +3. The private range is configured incorrectly. For example, the private ranges is set incorrectly through GP/MDM policies, etc. -To understand these causes more thoroughly, there are several concepts that should be reviewed. +To understand these causes more thoroughly, there are several concepts to review. -The traffic of network packets (e.g. what's permitted and what’s not) on Windows is ultimately determined by the Windows Filtering Platform (WFP). When a UWP app +The traffic of network packets (what's permitted and what’s not) on Windows is determined by the Windows Filtering Platform (WFP). When a UWP app or the private range is configured incorrectly, it affects how the UWP app’s network traffic will be processed by WFP. -When a packet is processed by WFP, the characteristics of that packet must explicitly match all the conditions of a filter to either be permitted or dropped to its target address. Connectivity issues typically happen when the packet does not match the filter conditions of any filters, leading the packet to be dropped by a default block filter. The presence of the default block -filters ensures network isolation for UWP applications. Specifically, it guarantees a network drop for a packet that does not have the correct capabilities for the resource it is trying to reach, ensuring the application’s granular access to each resource type and preventing the application from “escaping” its environment. +When a packet is processed by WFP, the characteristics of that packet must explicitly match all the conditions of a filter to either be permitted or dropped to its target address. Connectivity issues typically happen when the packet does not match any of the filter conditions, leading the packet to be dropped by a default block filter. The presence of the default block +filters ensures network isolation for UWP applications. Specifically, it guarantees a network drop for a packet that does not have the correct capabilities for the resource it is trying to reach. This ensures the application’s granular access to each resource type and preventing the application from escaping its environment. For more information on the filter arbitration algorithm and network isolation, -please read [Filter +see [Filter Arbitration](https://docs.microsoft.com/en-us/windows/win32/fwp/filter-arbitration) and [Isolation](https://docs.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation). -The next sections will cover debugging case examples for loopback and -non-loopback UWP app network connectivity issues. +The following sections cover debugging case examples for loopback and non-loopback UWP app network connectivity issues. > [!NOTE] -> As improvements to debugging and diagnostics around the Windows Filtering Platform are made, the trace examples in this document may not exactly match the -traces collected on an older Windows build. +> As improvements to debugging and diagnostics in the Windows Filtering Platform are made, the trace examples in this document may not exactly match the +traces collected on previous releases of Windows. # Debugging UWP App Loopback scenarios -If you have a scenario where you are establishing a TCP/IP connection between two processes on the same host where one of them is a UWP app, you must enable loopback. +If you need to establis a TCP/IP connection between two processes on the same host where one of them is a UWP app, you must enable loopback. -To enable loopback for client outbound connections, run the following in a command prompt: +To enable loopback for client outbound connections, run the following at a command prompt: -`CheckNetIsolation.exe LoopbackExempt -a -n=\` +```dos +CheckNetIsolation.exe LoopbackExempt -a -n=\ +``` -To enable loopback for server inbound connections, please run the following in a +To enable loopback for server inbound connections, run the following at a command prompt: +```dos +CheckNetIsolation.exe LoopbackExempt -is -n=\ +``` +You can ensure loopback is enabled by checking the appx manifests of both the sender and receiver. -`CheckNetIsolation.exe LoopbackExempt -is -n=\` - -You can ensure loopback is enabled by checking the appx manifests of both the -sender and receiver. - -For more information about loopback scenarios, please read [Communicating with +For more information about loopback scenarios, see [Communicating with localhost (loopback)](https://docs.microsoft.com/en-us/windows/iot-core/develop-your-app/loopback) # Debugging Live Drops -If the issue happened recently, but you find you are not able to reproduce the -issue, go to Debugging Past Drops for the appropriate trace commands. +If the issue happened recently, but you find you are not able to reproduce the issue, go to Debugging Past Drops for the appropriate trace commands. -If you can consistently reproduce the issue, then you can run the following in -an admin command prompt to gather a fresh trace: +If you can consistently reproduce the issue, then you can run the following in an admin command prompt to gather a fresh trace: -``` +```DOS Netsh wfp capture start keywords=19 \ Netsh wfp capture stop ``` -The above commands will generate a wfpdiag.cab. Inside the .cab exists a -wfpdiag.xml, which contains any allow or drop netEvents and filters that existed -during that repro. Without “keywords=19”, the trace will only collect drop -netEvents. +These commands generate a wfpdiag.cab. Inside the .cab exists a wfpdiag.xml, which contains any allow or drop netEvents and filters that existed during that repro. Without “keywords=19”, the trace will only collect drop netEvents. Inside the wfpdiag.xml, search for netEvents which have -FWPM_NET_EVENT_TYPE_CLASSIFY_DROP as the netEvent type. To find the relevant -drop events, search for the drop events with matching destination IP address, +FWPM_NET_EVENT_TYPE_CLASSIFY_DROP as the netEvent type. To find the relevant drop events, search for the drop events with matching destination IP address, package SID, or application ID name. The characters in the application ID name will be separated by periods: -``` + +```XML (ex) -\ - + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.w.i.n.d.o.w.s.\\.s.y.s.t.e.m.3.2.\\.s.v.c.h.o.s.t...e.x.e... \ ``` -The netEvent will have more information about the packet that was dropped -including information about its capabilities, the filter that dropped the -packet, and much more. + +The netEvent will have more information about the packet that was dropped including information about its capabilities, the filter that dropped the packet, and much more. ## Case 1: UWP app connects to Internet target address with all capabilities In this example, the UWP app successfully connects to bing.com [2620:1ec:c11::200]. -A packet from a UWP app needs the correct networking capability token for the -resource it is trying to reach. +A packet from a UWP app needs the correct networking capability token for the resource it is trying to reach. -In this scenario, the app could successfully send a packet to the Internet -target because it had an Internet capability token. +In this scenario, the app could successfully send a packet to the Internet target because it had an Internet capability token. -The following shows the allow netEvent of the app connecting to the target IP. -The netEvent contains information about the packet including its local address, +The following shows the allow netEvent of the app connecting to the target IP. The netEvent contains information about the packet including its local address, remote address, capabilities, etc. **Classify Allow netEvent, Wfpdiag-Case-1.xml** ```xml -\ -\ -> \2020-05-21T17:25:59.070Z\ -> \ -> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ -> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ -> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -> \ -> \FWP_IP_VERSION_V6\ -> \6\ -> \2001:4898:30:3:256c:e5ba:12f3:beb1\ \2620:1ec:c11::200\ -\52127\ -\443\ -\0\ -\ -> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -\ -\S-1-5-21-2993214446-1947230185-131795049-1000\ -\FWP_AF_INET6\ -\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -\ -\0\ -\ -\ -\FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ -\ -> \125918\ -> \50\ -> \0\ -> \1\ -> \1\ -\ -\ -\ -\0000000000000000\ -\ -> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ -> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ -\ -\0\ -\ -\ -> \ - \125918\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - \FWP_ACTION_PERMIT\ -> \ -> \ - \121167\ - \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - \FWP_ACTION_PERMIT\ - \ -\ -\ -\ + + + 2020-05-21T17:25:59.070Z\ + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ + FWPM_NET_EVENT_FLAG_APP_ID_SET\ + FWPM_NET_EVENT_FLAG_USER_ID_SET\ + FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ + + FWP_IP_VERSION_V6\ + 6\ + 2001:4898:30:3:256c:e5ba:12f3:beb1\ \2620:1ec:c11::200\ +52127\ +443\ +0\ + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ + +S-1-5-21-2993214446-1947230185-131795049-1000\ +FWP_AF_INET6\ +S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ + +0\ + + +FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ + + 125918\ + 50\ + 0\ + 1\ + 1\ + + + +0000000000000000\ + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ + +0\ + + + + 125918\ + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + FWP_ACTION_PERMIT\ + + + 121167\ + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + FWP_ACTION_PERMIT\ + + + + ``` The following is the filter that permitted the packet to be sent to the target From 9aba80f3de8d2ec83e443b30afe63184a793c404 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 13 Aug 2020 18:09:28 -0700 Subject: [PATCH 16/66] so many --- .../troubleshooting-uwp-firewall.md | 2124 ++++++++--------- 1 file changed, 1060 insertions(+), 1064 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index bc17fd0a75..fd79a67511 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -56,13 +56,13 @@ If you need to establis a TCP/IP connection between two processes on the same ho To enable loopback for client outbound connections, run the following at a command prompt: ```dos -CheckNetIsolation.exe LoopbackExempt -a -n=\ +CheckNetIsolation.exe LoopbackExempt -a -n= ``` To enable loopback for server inbound connections, run the following at a command prompt: ```dos -CheckNetIsolation.exe LoopbackExempt -is -n=\ +CheckNetIsolation.exe LoopbackExempt -is -n= ``` You can ensure loopback is enabled by checking the appx manifests of both the sender and receiver. @@ -78,7 +78,7 @@ If you can consistently reproduce the issue, then you can run the following in a ```DOS Netsh wfp capture start keywords=19 -\ + Netsh wfp capture stop ``` @@ -92,10 +92,10 @@ will be separated by periods: ```XML (ex) - + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.w.i.n.d.o.w.s.\\.s.y.s.t.e.m.3.2.\\.s.v.c.h.o.s.t...e.x.e... -\ + ``` The netEvent will have more information about the packet that was dropped including information about its capabilities, the filter that dropped the packet, and much more. @@ -114,187 +114,186 @@ remote address, capabilities, etc. **Classify Allow netEvent, Wfpdiag-Case-1.xml** ```xml - - - 2020-05-21T17:25:59.070Z\ - - FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ - FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ - FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ - FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ - FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ - FWPM_NET_EVENT_FLAG_APP_ID_SET\ - FWPM_NET_EVENT_FLAG_USER_ID_SET\ - FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ - FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ - - FWP_IP_VERSION_V6\ - 6\ - 2001:4898:30:3:256c:e5ba:12f3:beb1\ \2620:1ec:c11::200\ -52127\ -443\ -0\ - - 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ - \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. - .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ - -S-1-5-21-2993214446-1947230185-131795049-1000\ -FWP_AF_INET6\ -S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ - -0\ - - -FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ - - 125918\ - 50\ - 0\ - 1\ - 1\ - - - -0000000000000000\ - - FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ - FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ - -0\ - - - - 125918\ - FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - FWP_ACTION_PERMIT\ - - - 121167\ - FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - FWP_ACTION_PERMIT\ - - - - + +
+ 2020-05-21T17:25:59.070Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + + FWP_IP_VERSION_V6 + 6 + 2001:4898:30:3:256c:e5ba:12f3:beb1 + 2620:1ec:c11::200 +52127 +443 +0 + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + +S-1-5-21-2993214446-1947230185-131795049-1000 +FWP_AF_INET6 +S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + +0 + +
+FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW + + 125918 + 50 + 0 + 1 + 1 + + + +0000000000000000 + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK + +0 + + + + 125918 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH + FWP_ACTION_PERMIT + + + 121167 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT + + + + ``` The following is the filter that permitted the packet to be sent to the target -address according to the terminatingFiltersInfo in the netEvent. This packet was -allowed by Filter \#125918 which is from the InternetClient Default Rule. +address according to the **terminatingFiltersInfo** in the **netEvent**. This packet was +allowed by Filter #125918, from the InternetClient Default Rule. -**InternetClient Default Rule Filter \#125918, Wfpdiag-Case-1.xml** +**InternetClient Default Rule Filter #125918, Wfpdiag-Case-1.xml** ```xml -\ -> \{3389708e-f7ae-4ebc-a61a-f659065ab24e}\ -> \ -> \InternetClient Default Rule\ -> \InternetClient Default Rule\ -> \ -> \ -> \FWPM_PROVIDER_MPSSVC_WSH\ -> \ -> \ad2b000000000000\ -> \.+......\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V6\ -> \FWPM_SUBLAYER_MPSSVC_WSH\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ -> \FWP_MATCH_RANGE\ -> \ -> \FWP_RANGE_TYPE\ -> \ -> \ -> \FWP_BYTE_ARRAY16_TYPE\ -> \::\ -> \ -> \ -> \FWP_BYTE_ARRAY16_TYPE\ -> \ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff\ -> \ -> \ -> \ -> \ -> \ -> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_CURRENT_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_USER_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_SECURITY_DESCRIPTOR_TYPE\ -> \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \0\ -> \ -> \125918\ -> \ -> \FWP_UINT64\ -> \103079219136\ -> \ -\ + + {3389708e-f7ae-4ebc-a61a-f659065ab24e} + + InternetClient Default Rule + InternetClient Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + ad2b000000000000 + .+...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + :: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 125918 + + FWP_UINT64 + 103079219136 + + ``` -One condition is **Capabilities Condition in Filter \#125918, Wfpdiag-Case-1.xml** ```xml -\ -> \FWPM_CONDITION_ALE_USER_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_SECURITY_DESCRIPTOR_TYPE\ -> \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ -> \ -\ + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) + + ``` -which is the condition for checking capabilities in this filter. +This is the condition for checking capabilities in this filter. -The important part of this condition is S-1-15-3-1, which is the capability SID -for INTERNET_CLIENT privileges. +The important part of this condition is **S-1-15-3-1**, which is the capability SID +for **INTERNET_CLIENT** privileges. -From the netEvent’s capabilities section, - -Capabilities from netEvent, Wfpdiag-Case-1.xml +From the **netEvent** capabilities section, +capabilities from netEvent, Wfpdiag-Case-1.xml. ```xml -\ -> **\FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\** \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ -\FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ -\ + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK + ``` -it shows the packet came from an app with an Internet client token -(FWP_CAPABILITIES_FLAG_INTERNET_CLIENT) which matches the capability SID in the +This shows the packet came from an app with an Internet client token (**FWP_CAPABILITIES_FLAG_INTERNET_CLIENT**) which matches the capability SID in the filter. All the other conditions are also met for the filter, so the packet is allowed. @@ -307,175 +306,173 @@ the packet having all capabilities. In this example, the UWP app is unable to connect to bing.com [2620:1ec:c11::200]. -The following is a drop netEvent that was captured in the traces during this -repro. +The following is a drop netEvent that was captured in the trace. **Classify Drop netEvent, Wfpdiag-Case-2.xml** ```xml -\ -\ -\2020-03-30T23:53:09.720Z\ -\ -\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -\FWPM_NET_EVENT_FLAG_APP_ID_SET\ -\FWPM_NET_EVENT_FLAG_USER_ID_SET\ -\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -\ -\FWP_IP_VERSION_V6\ -\6\ -\2001:4898:1a:1045:8469:3351:e6e2:543\ -\2620:1ec:c11::200\ -\63187\ -\443\ -\0\ -\ -\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0034002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...4...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -\ -\S-1-5-21-2788718703-1626973220-3690764900-1000\ -\FWP_AF_INET6\ -\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -\ -\0\ -\ -\ -\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ -\ -\68893\ -\50\ -\0\ -\1\ -\1\ -\MS_FWP_DIRECTION_OUT\ -\false\ -\ -\0\ -\0\ -\ -\ -\ -\0000000000000000\ -\ -\0\ -\ -\ -\ -\68893\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -\FWP_ACTION_BLOCK\ -\ -\ -\68879\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -\FWP_ACTION_PERMIT\ -\ -\ -\ -\ + +
+2020-03-30T23:53:09.720Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + +FWP_IP_VERSION_V6 +6 +2001:4898:1a:1045:8469:3351:e6e2:543 +2620:1ec:c11::200 +63187 +443 +0 + +5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0034002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 +\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...4...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + +S-1-5-21-2788718703-1626973220-3690764900-1000 +FWP_AF_INET6 +S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + +0 + +
+FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + +68893 +50 +0 +1 +1 +MS_FWP_DIRECTION_OUT +false + +0 +0 + + + +0000000000000000 + +0 + + + +68893 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH +FWP_ACTION_BLOCK + + +68879 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WF +FWP_ACTION_PERMIT + + + + ``` -The first thing that should be checked in the netEvent is the capabilities -field\*. In this example, the capabilities field is empty, indicating that the +The first thing that you should check in the **netEvent** is the capabilities +field. In this example, the capabilities field is empty, indicating that the UWP app was not configured with any capability tokens to allow it to connect to a network. **Internal Fields from netEvent, Wfpdiag-Case-2.xml** ```xml -\ -\ -\0000000000000000\ -**\** -\0\ -\ -\ -\ -\68893\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -\FWP_ACTION_BLOCK\ -\ -\ -\68879\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -\FWP_ACTION_PERMIT\ -\ -\ -\ + + +0000000000000000 + +0 + + + +68893 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH +FWP_ACTION_BLOCK + + +68879 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WF +FWP_ACTION_PERMIT + + + ``` -The netEvent also gives us information about the filter that explicitly dropped -this packet, like the FilterId, listed under classify drop +The **netEvent** also shows information about the filter that explicitly dropped this packet, like the **FilterId**, listed under classify drop. **Classify Drop from netEvent, Wfpdiag-Case-2.xml** ```xml -\ -**\68893\** -\50\ -\0\ -\1\ -\1\ -\MS_FWP_DIRECTION_OUT\ -\false\ -\ -\0\ -\0\ -\ + +68893 +50 +0 +1 +1 +MS_FWP_DIRECTION_OUT +false + +0 +0 + ``` -If we search for that filter, \#68893, in Wfpdiag-Case2.xml, we will see that +If you search for the filter #68893 in Wfpdiag-Case2.xml, you'll see that the packet was dropped by a Block Outbound Default Rule filter. -**Block Outbound Default Rule Filter \#68893, Wfpdiag-Case-2.xml** +**Block Outbound Default Rule Filter #68893, Wfpdiag-Case-2.xml** ```xml -\ -> \{6d51582f-bcf8-42c4-afc9-e2ce7155c11b}\ -> \ -> \**Block Outbound Default Rule**\ -> \Block Outbound Default Rule\ -> \ -> \ -> \{4b153735-1049-4480-aab4-d1b9bdc03710}\ -> \ -> \b001000000000000\ -> \........\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V6\ -> \{b3cdd441-af90-41ba-a745-7c6008ff2300}\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_BLOCK\ -> \ -> \ -> \0\ -> \ -> \68893\ -> \ -> \FWP_UINT64\ -> \68719476736\ -> \ -\ + + {6d51582f-bcf8-42c4-afc9-e2ce7155c11b} +/t + **Block Outbound Default Rule** + Block Outbound Default Rule + + + {4b153735-1049-4480-aab4-d1b9bdc03710} + + b001000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + {b3cdd441-af90-41ba-a745-7c6008ff2300} + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_BLOCK + + + 0 + + 68893 + + FWP_UINT64 + 68719476736 + + ``` -A packet will reach a default block filter if the packet was unable to match any of the conditions of other filters, and thus not allowed by the other filters in +A packet will reach a default block filter if the packet was unable to match any of the conditions of other filters, and not allowed by the other filters in the same sublayer. If the packet had the correct capability token, -FWP_CAPABILITIES_FLAG_INTERNET_CLIENT, it would have matched a condition for a +**FWP_CAPABILITIES_FLAG_INTERNET_CLIENT**, it would have matched a condition for a non-default block filter and would have been permitted to reach bing.com. Without the correct capability tokens, the packet will be explicitly dropped by a default block outbound filter. @@ -490,74 +487,74 @@ only has a private network token. Therefore, the packet will be dropped. **Classify Drop netEvent, Wfpdiag-Case-3.xml** ```xml -\ -\ -\2020-03-31T16:57:18.570Z\ -\ -\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -\FWPM_NET_EVENT_FLAG_APP_ID_SET\ -\FWPM_NET_EVENT_FLAG_USER_ID_SET\ -\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -\ -\FWP_IP_VERSION_V6\ -\6\ -\2001:4898:1a:1045:9c65:7805:dd4a:cc4b\ -\2620:1ec:c11::200\ -\64086\ -\443\ -\0\ -\ -\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0035002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...5...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -\ -\S-1-5-21-2788718703-1626973220-3690764900-1000\ -\FWP_AF_INET6\ -\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -\ -\0\ -\ -\ -\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ -\ -\68893\ -\50\ -\0\ -\1\ -\1\ -\MS_FWP_DIRECTION_OUT\ -\false\ -\ -\0\ -\0\ -\ -\ -\ -\0000000000000000\ -**\** -**\FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\** -**\** -\0\ -\ -\ -\ -\68893\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -\FWP_ACTION_BLOCK\ -\ -\ -\68879\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -\FWP_ACTION_PERMIT\ -\ -\ -\ -\ + +
+2020-03-31T16:57:18.570Z + +FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET +FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET +FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET +FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET +FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET +FWPM_NET_EVENT_FLAG_APP_ID_SET +FWPM_NET_EVENT_FLAG_USER_ID_SET +FWPM_NET_EVENT_FLAG_IP_VERSION_SET +FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + +FWP_IP_VERSION_V6 +6 +2001:4898:1a:1045:9c65:7805:dd4a:cc4b +2620:1ec:c11::200 +64086 +443 +0 + +5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0035002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 +\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...5...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + +S-1-5-21-2788718703-1626973220-3690764900-1000 +FWP_AF_INET6 +S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + +0 + +
+FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + +68893 +50 +0 +1 +1 +MS_FWP_DIRECTION_OUT +false + +0 +0 + + + +0000000000000000 +**** +**FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK** +**** +0 + + + +68893 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH +FWP_ACTION_BLOCK + + +68879 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WF +FWP_ACTION_PERMIT + + + + ``` ## Case 4: UWP app cannot reach Intranet target address without Private Network capability @@ -567,75 +564,75 @@ In this example, the UWP app is unable to reach the Intranet target address, **Classify Drop netEvent, Wfpdiag-Case-4.xml** ```xml -\ -\ -> \2020-05-22T21:29:28.601Z\ -> \ -> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ -> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ -> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -> \ -> \FWP_IP_VERSION_V4\ -> \6\ -> \10.216.117.17\ -> \10.50.50.50\ -> \52998\ -> \53\ -> \0\ -> \ -> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310031002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.1...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -> \ -> \S-1-5-21-2993214446-1947230185-131795049-1000\ -> \FWP_AF_INET\ -> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -> \ -> \0\ -> \ -\ -> \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ -> \ -> \121180\ -> \48\ -> \0\ -> \1\ -> \1\ -> \MS_FWP_DIRECTION_OUT\ -> \false\ -> \ -> \0\ -> \0\ -\ -\ -> \ -> \0000000000000000\ -> \ -> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ -> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ -> \ -> \0\ -> \ -> \ -> \ -> \121180\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -> \FWP_ACTION_BLOCK\ -> \ -> \ -> \121165\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -> \FWP_ACTION_PERMIT\ -> \ -> \ -\ -\ + +
+ 2020-05-22T21:29:28.601Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + + FWP_IP_VERSION_V4 + 6 + 10.216.117.17 + 10.50.50.50 + 52998 + 53 + 0 + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310031002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.1...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + + S-1-5-21-2993214446-1947230185-131795049-1000 + FWP_AF_INET + S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + + 0 + +
+ FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + + 121180 + 48 + 0 + 1 + 1 + MS_FWP_DIRECTION_OUT + false + + 0 + 0 + + + + 0000000000000000 + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER + + 0 + + + + 121180 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH + FWP_ACTION_BLOCK + + + 121165 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT + + + + ``` ## Case 5: UWP app cannot reach “Intranet” target address with Private Network capability @@ -644,360 +641,360 @@ In this example, the UWP app is unable to reach the Intranet target address, **Classify Drop netEvent, Wfpdiag-Case-5.xml** ```xml -\ -> \ -> \2020-05-22T20:54:53.499Z\ -> \ -> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ -> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ -> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -> \ -> \FWP_IP_VERSION_V4\ -> \6\ -> \10.216.117.17\ -> \10.1.1.1\ -> \52956\ -> \53\ -> \0\ -> \ -> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310033002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.3...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -> \ -> \S-1-5-21-2993214446-1947230185-131795049-1000\ -> \FWP_AF_INET\ -> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -> \ -> \0\ -> \ -\ -> \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ -> \ -> \121180\ -> \48\ -> \0\ -> \1\ -> \1\ -> \MS_FWP_DIRECTION_OUT\ -> \false\ -> \ -> \0\ -> \0\ -> \ -> \ -> \ -> \0000000000000000\ -> \ -> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ -> \ -> \0\ -> \ -> \ -> \ -> \121180\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -> \FWP_ACTION_BLOCK\ -> \ -> \ -> \121165\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \ -\ + +
+ 2020-05-22T20:54:53.499Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + + FWP_IP_VERSION_V4 + 6 + 10.216.117.17 + 10.1.1.1 + 52956 + 53 + 0 + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310033002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.3...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + + S-1-5-21-2993214446-1947230185-131795049-1000 + FWP_AF_INET + S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + + 0 + +
+ FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + + 121180 + 48 + 0 + 1 + 1 + MS_FWP_DIRECTION_OUT + false + + 0 + 0 + + + + 0000000000000000 + + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK + + 0 + + + + 121180 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH + FWP_ACTION_BLOCK + + + 121165 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT + + + + ``` The following shows the filter that blocked the event: **Block Outbound Default Rule Filter \#121180, Wfpdiag-Case-5.xml** ```xml -\ -> \{e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6}\ -> \ -> \Block Outbound Default Rule\ -> \Block Outbound Default Rule\ -> \ -> \ -> \FWPM_PROVIDER_MPSSVC_WSH\ -> \ -> \c029000000000000\ -> \.)......\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ -> \FWPM_SUBLAYER_MPSSVC_WSH\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_BLOCK\ -> \ -> \ -> \0\ -> \ -> \121180\ -> \ -> \FWP_UINT64\ -> \274877906944\ -> \ -\ + + {e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6} + + Block Outbound Default Rule + Block Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + c029000000000000 + .)...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_BLOCK + + + 0 + + 121180 + + FWP_UINT64 + 274877906944 + + ``` If the target was in the private range, then it should have been allowed by a PrivateNetwork Outbound Default Rule filter. The following PrivateNetwork Outbound Default Rule filters have conditions for matching Intranet IP addresses. Since the expected Intranet target address, -10.1.1.1, is not included in these filters it becomes clear that the address isnot in the private range. Check the policies which configure the private range -on the machine (MDM, GP, etc) and make sure it includes the private targetaddress you wanted to reach. +10.1.1.1, is not included in these filters it becomes clear that the address is not in the private range. Check the policies that configure the private range +on the device (MDM, Group Policy, etc) and make sure it includes the private targetaddress you wanted to reach. **PrivateNetwork Outbound Default Rule Filters, Wfpdiag-Case-5.xml** ```xml -\ -> \{fd65507b-e356-4e2f-966f-0c9f9c1c6e78}\ -> \ -> \PrivateNetwork Outbound Default Rule\ -> \PrivateNetwork Outbound Default Rule\ -> \ -> \ -> \FWPM_PROVIDER_MPSSVC_WSH\ -> \ -> \f22d000000000000\ -> \.-......\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ -> \FWPM_SUBLAYER_MPSSVC_WSH\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1.1.1.1\ -> \ -> \ -> \ -> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_CURRENT_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_USER_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_SECURITY_DESCRIPTOR_TYPE\ -> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \0\ -> \ -> \129656\ -> \ -> \FWP_UINT64\ -> \144115600392724416\ -> \ -> \ -> \ -> \{b11b4f8a-222e-49d6-8d69-02728681d8bc}\ -> \ -> \PrivateNetwork Outbound Default Rule\ -> \PrivateNetwork Outbound Default Rule\ -> \ -> \ -> \FWPM_PROVIDER_MPSSVC_WSH\ -> \ -> \f22d000000000000\ -> \.-......\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ -> \FWPM_SUBLAYER_MPSSVC_WSH\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ -> \FWP_MATCH_RANGE\ -> \ -> \FWP_RANGE_TYPE\ -> \ -> \ -> \FWP_UINT32\ -> \172.16.0.0\ -> \ -> \ -> \FWP_UINT32\ -> \172.31.255.255\ -> \ -> \ -> \ -> \ -> \ -> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_CURRENT_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_USER_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_SECURITY_DESCRIPTOR_TYPE\ -> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \0\ -> \ -> \129657\ -> \ -> \FWP_UINT64\ -> \36029209335832512\ -> \ -\ -\ -> \{21cd82bc-6077-4069-94bf-750e5a43ca23}\ -> \ -> \PrivateNetwork Outbound Default Rule\ -> \PrivateNetwork Outbound Default Rule\ -> \ -> \ -> \FWPM_PROVIDER_MPSSVC_WSH\ -> \ -> \f22d000000000000\ -> \.-......\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ -> \FWPM_SUBLAYER_MPSSVC_WSH\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ -> \FWP_MATCH_RANGE\ -> \ -> \FWP_RANGE_TYPE\ -> \ -> \ -> \FWP_UINT32\ -> \192.168.0.0\ -> \ -> \ -> \FWP_UINT32\ -> \192.168.255.255\ -> \ -> \ -> \ -> \ -> \ -> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_CURRENT_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_USER_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_SECURITY_DESCRIPTOR_TYPE\ -> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \0\ -> \ -> \129658\ -> \ -> \FWP_UINT64\ -> \36029209335832512\ -> \ -\ + + {fd65507b-e356-4e2f-966f-0c9f9c1c6e78} + + PrivateNetwork Outbound Default Rule + PrivateNetwork Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + f22d000000000000 + .-...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_EQUAL + + FWP_UINT32 + 1.1.1.1 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 129656 + + FWP_UINT64 + 144115600392724416 + + + + {b11b4f8a-222e-49d6-8d69-02728681d8bc} + + PrivateNetwork Outbound Default Rule + PrivateNetwork Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + f22d000000000000 + .-...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 172.16.0.0 + + + FWP_UINT32 + 172.31.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 129657 + + FWP_UINT64 + 36029209335832512 + + + + {21cd82bc-6077-4069-94bf-750e5a43ca23} + + PrivateNetwork Outbound Default Rule + PrivateNetwork Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + f22d000000000000 + .-...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 192.168.0.0 + + + FWP_UINT32 + 192.168.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 129658 + + FWP_UINT64 + 36029209335832512 + + ``` # Debugging Past Drops @@ -1007,38 +1004,38 @@ wfpstate.xml. Once nettrace.etl is converted, nettrace.txt will have the netEvents of the reproduced event, and wfpstate.xml will contain the filters that were present on the machine at the time. -If you **do not** have a live repro or traces already collected, you can still +If you do not have a live repro or traces already collected, you can still collect traces after the UWP network connectivity issue has happened by running -these commands in an Admin command prompt +these commands in an admin command prompt ```xml -> \ -> Netsh wfp show netevents -> Netsh wfp show state + + Netsh wfp show netevents + Netsh wfp show state ``` -“Netsh wfp show netevents” will generate netevents.xml, which contains the past -net events. “Netsh wfp show state” will generate wfpstate.xml, which contains +**Netsh wfp show netevents** creates netevents.xml, which contains the past +net events. **Netsh wfp show state** creates wfpstate.xml, which contains the current filters present on the machine. Unfortunately, collecting traces after the UWP network connectivity issue is not always reliable. -NetEvents on the machine are stored in a buffer. Once that buffer has reached -max capacity, the buffer will overwrite older net events. Due to the buffer +NetEvents on the device are stored in a buffer. Once that buffer has reached +maximum capacity, the buffer will overwrite older net events. Due to the buffer overwrite, it is possible that the collected netevents.xml will not contain the -net event associated with the UWP network connectivity issue if it was -overwritten. Additionally, filters on the machine can get deleted and re-added -with different filterIds due to miscellaneous events on the machine. Because of -this, a filterId from “netsh wfp show netevents” may not necessarily match any -filter in “netsh wfp show state” because that filterId may be outdated. +net event associated with the UWP network connectivity issue. It could have been ov +overwritten. Additionally, filters on the device can get deleted and re-added +with different filterIds due to miscellaneous events on the device. Because of +this, a **filterId** from **netsh wfp show netevents** may not necessarily match any +filter in **netsh wfp show state** because that **filterId** may be outdated. -If you can reproduce the UWP network connectivity issue consistently, we would +If you can reproduce the UWP network connectivity issue consistently, we recommend using the commands from Debugging Live Drops instead. Additionally, you can still follow the examples from Debugging Live Drops section using the trace commands in this section, even if you do not have a live -repro. The netEvents and filters are stored in one file in Debugging Live Drops +repro. The **netEvents** and filters are stored in one file in Debugging Live Drops as opposed to two separate files in the following Debugging Past Drops examples. ## Case 7: Debugging Past Drop - UWP app cannot reach Internet target address and has no capabilities @@ -1048,72 +1045,72 @@ In this example, the UWP app is unable to connect to bing.com. Classify Drop Net Event, NetEvents-Case-7.xml ```xml -\ -\ -\2020-05-04T22:04:07.039Z\ -\ -\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -\FWPM_NET_EVENT_FLAG_APP_ID_SET\ -\FWPM_NET_EVENT_FLAG_USER_ID_SET\ -\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -\ -\FWP_IP_VERSION_V4\ -\6\ -\10.195.36.30\ -\204.79.197.200\ -\57062\ -\443\ -\0\ -\ -\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310032002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.2...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -\ -\S-1-5-21-1578316205-4060061518-881547182-1000\ -\FWP_AF_INET\ -\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -\ -\0\ -\ -\ -\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ -\ -\206064\ -\48\ -\0\ -\1\ -\1\ -\MS_FWP_DIRECTION_OUT\ -\false\ -\ -\0\ -\0\ -\ -\ -\ -\0000000000000000\ -\ -\0\ -\ -\ -\ -\206064\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -\FWP_ACTION_BLOCK\ -\ -\ -\206049\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -\FWP_ACTION_PERMIT\ -\ -\ -\ -\ + +
+2020-05-04T22:04:07.039Z + +FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET +FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET +FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET +FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET +FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET +FWPM_NET_EVENT_FLAG_APP_ID_SET +FWPM_NET_EVENT_FLAG_USER_ID_SET +FWPM_NET_EVENT_FLAG_IP_VERSION_SET +FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + +FWP_IP_VERSION_V4 +6 +10.195.36.30 +204.79.197.200 +57062 +443 +0 + +5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310032002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 +\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.2...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + +S-1-5-21-1578316205-4060061518-881547182-1000 +FWP_AF_INET +S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + +0 + +
+FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + +206064 +48 +0 +1 +1 +MS_FWP_DIRECTION_OUT +false + +0 +0 + + + +0000000000000000 + +0 + + + +206064 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH +FWP_ACTION_BLOCK + + +206049 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WF +FWP_ACTION_PERMIT + + + + ``` The Internal fields lists no active capabilities, and the packet is dropped at @@ -1127,45 +1124,45 @@ Security Descriptor doesn’t match. **Block Outbound Default Rule Filter \#206064, FilterState-Case-7.xml** ```xml -\ -\{f138d1ad-9293-478f-8519-c3368e796711}\ -\ -\Block Outbound Default Rule\ -\Block Outbound Default Rule\ -\ -\ -\FWPM_PROVIDER_MPSSVC_WSH\ -\ -\2e65000000000000\ -\.e......\ -\ -\FWPM_LAYER_ALE_AUTH_CONNECT_V4\ -\FWPM_SUBLAYER_MPSSVC_WSH\ -\ -\FWP_EMPTY\ -\ -\ -\ -\FWPM_CONDITION_ALE_PACKAGE_ID\ -\FWP_MATCH_NOT_EQUAL\ -\ -\FWP_SID\ -\S-1-0-0\ -\ -\ -\ -\ -\FWP_ACTION_BLOCK\ -\ -\ -\0\ -\ -\206064\ -\ -\FWP_UINT64\ -\274877906944\ -\ -\ + +{f138d1ad-9293-478f-8519-c3368e796711} + +Block Outbound Default Rule +Block Outbound Default Rule + + +FWPM_PROVIDER_MPSSVC_WSH + +2e65000000000000 +.e...... + +FWPM_LAYER_ALE_AUTH_CONNECT_V4 +FWPM_SUBLAYER_MPSSVC_WSH + +FWP_EMPTY + + + +FWPM_CONDITION_ALE_PACKAGE_ID +FWP_MATCH_NOT_EQUAL + +FWP_SID +S-1-0-0 + + + + +FWP_ACTION_BLOCK + + +0 + +206064 + +FWP_UINT64 +274877906944 + + ``` ## Case 8: Debugging Past Drop - UWP app connects to Internet target address with all capabilities @@ -1174,159 +1171,158 @@ In this example, the UWP app successfully connects to bing.com [204.79.197.200]. **Classify Allow Net Event, NetEvents-Case-8.xml** ```xml -\ -> \ -> \2020-05-04T18:49:55.101Z\ -> \ -> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ -> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ -> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -> \ -> \FWP_IP_VERSION_V4\ -> \6\ -> \10.195.36.30\ -> \204.79.197.200\ -> \61673\ -> \443\ -> \0\ -> \ -> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -> \ -> \S-1-5-21-1578316205-4060061518-881547182-1000\ -> \FWP_AF_INET\ -> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -> \ -> \0\ -> \ -> \ -> \FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ -> \ -> \208757\ -> \48\ -> \0\ -> \1\ -> \1\ -> \ -> \ -> \ -> \0000000000000000\ -> \ -> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ -> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ -> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ -> \ -> \0\ -> \ -> \ -> \ -> \208757\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \206049\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \ -\ + +
+ 2020-05-04T18:49:55.101Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + + FWP_IP_VERSION_V4 + 6 + 10.195.36.30 + 204.79.197.200 + 61673 + 443 + 0 + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + + S-1-5-21-1578316205-4060061518-881547182-1000 + FWP_AF_INET + S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + + 0 + +
+ FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW + + 208757 + 48 + 0 + 1 + 1 + + + + 0000000000000000 + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK + + 0 + + + + 208757 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH + FWP_ACTION_PERMIT + + + 206049 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT + + + + ``` -Important things to note: all capabilities are enabled and the resulting filter -determining the flow of the packet is 208757. +All capabilities are enabled and the resulting filter determining the flow of the packet is 208757. The filter stated above with action permit: **InternetClient Default Rule Filter \#208757, FilterState-Case-8.xml** ```xml -\ - \{e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5}\ - \ - \InternetClient Default Rule\ - \InternetClient Default Rule\ - \ - \ - \FWPM_PROVIDER_MPSSVC_WSH\ - \ - \e167000000000000\ - \.g......\ - \ - \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - \FWPM_SUBLAYER_MPSSVC_WSH\ - \ - \FWP_EMPTY\ - \ - \ - \ - \FWPM_CONDITION_ALE_PACKAGE_ID\ - \FWP_MATCH_NOT_EQUAL\ - \ - \FWP_SID\ - \S-1-0-0\ - \ - \ - \ - \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - \FWP_MATCH_RANGE\ - \ - \FWP_RANGE_TYPE\ - \ - \ - \FWP_UINT32\ - \0.0.0.0\ - \ - \ - \FWP_UINT32\ - \255.255.255.255\ - \ - \ - \ - \ - \ - \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_UINT32\ - \1\ - \ - \ - \ - \FWPM_CONDITION_CURRENT_PROFILE_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_UINT32\ - \1\ - \ - \ - \ - \FWPM_CONDITION_ALE_USER_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_SECURITY_DESCRIPTOR_TYPE\ - \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ - \ - \ - \ - \ - \FWP_ACTION_PERMIT\ - \ - \ - \0\ - \ - \208757\ - \ - \FWP_UINT64\ - \412316868544\ - \ - \ + + {e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5} + + InternetClient Default Rule + InternetClient Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + e167000000000000 + .g...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 0.0.0.0 + + + FWP_UINT32 + 255.255.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 208757 + + FWP_UINT64 + 412316868544 + + ``` The capabilities field in a netEvent was added to the traces in the Windows 10 -May 2019 Update +May 2019 Update. From 4fc5bf0a7578056c563da078292ac7791fe903f8 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 13 Aug 2020 18:19:38 -0700 Subject: [PATCH 17/66] fixing H1s --- .../windows-firewall/troubleshooting-uwp-firewall.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index fd79a67511..1ea6cce448 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -39,9 +39,9 @@ filters ensures network isolation for UWP applications. Specifically, it guarant For more information on the filter arbitration algorithm and network isolation, see [Filter -Arbitration](https://docs.microsoft.com/en-us/windows/win32/fwp/filter-arbitration) +Arbitration](https://docs.microsoft.com/windows/win32/fwp/filter-arbitration) and -[Isolation](https://docs.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation). +[Isolation](https://docs.microsoft.com/windows/win32/secauthz/appcontainer-isolation). The following sections cover debugging case examples for loopback and non-loopback UWP app network connectivity issues. @@ -49,7 +49,7 @@ The following sections cover debugging case examples for loopback and non-loopba > As improvements to debugging and diagnostics in the Windows Filtering Platform are made, the trace examples in this document may not exactly match the traces collected on previous releases of Windows. -# Debugging UWP App Loopback scenarios +## Debugging UWP App Loopback scenarios If you need to establis a TCP/IP connection between two processes on the same host where one of them is a UWP app, you must enable loopback. @@ -68,9 +68,9 @@ You can ensure loopback is enabled by checking the appx manifests of both the se For more information about loopback scenarios, see [Communicating with localhost -(loopback)](https://docs.microsoft.com/en-us/windows/iot-core/develop-your-app/loopback) +(loopback)](https://docs.microsoft.com/windows/iot-core/develop-your-app/loopback) -# Debugging Live Drops +## Debugging Live Drops If the issue happened recently, but you find you are not able to reproduce the issue, go to Debugging Past Drops for the appropriate trace commands. @@ -996,7 +996,7 @@ on the device (MDM, Group Policy, etc) and make sure it includes the private tar ``` -# Debugging Past Drops +## Debugging Past Drops If you are debugging a network drop from the past or from a remote machine, you may have traces already collected from Feedback Hub, such as nettrace.etl and From ee0509798aa1fd5162d5f1967ff8503fe3515d6f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 14 Aug 2020 12:32:45 -0700 Subject: [PATCH 18/66] update toc add back topics --- .../threat-protection/windows-firewall/TOC.md | 104 ++++++++++++------ .../firewall-policy-design-example.md | 4 +- ...wall-with-advanced-security-design-plan.md | 2 +- ...with-advanced-security-deployment-guide.md | 12 +- ...windows-firewall-with-advanced-security.md | 19 ++-- 5 files changed, 84 insertions(+), 57 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 7861f11250..038232e7da 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -1,38 +1,51 @@ # [Windows Firewall with Advanced Security](windows-firewall-with-advanced-security.md) -## [Plan/Design]() +## [Plan deployment]() -### [Design Guide](windows-firewall-with-advanced-security-design-guide.md) +### [Design guide](windows-firewall-with-advanced-security-design-guide.md) -### [Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) +### [Design process](understanding-the-windows-firewall-with-advanced-security-design-process.md) -### [Deployment Goals]() -#### [Identify deployment goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) +### [Implementation goals]() +#### [Identify implementation goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) #### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) #### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) #### [Require Encryption](require-encryption-when-accessing-sensitive-network-resources.md) #### [Restrict Access](restrict-access-to-only-specified-users-or-devices.md) -### [Deployment designs]() -#### [Mapping Goals to a Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) -#### [Basic Design](basic-firewall-policy-design.md) -#### [Domain Isolation Design](domain-isolation-policy-design.md) -#### [Server Isolation Design](server-isolation-policy-design.md) -#### [Certificate-based Isolation Design](certificate-based-isolation-policy-design.md) +### [Implementation designs]() +#### [Mapping goals to a design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) -### [Design plans]() -#### [Planning Your Design](planning-your-windows-firewall-with-advanced-security-design.md) -#### [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) -##### [Planning Domain Isolation Zones]() -###### [Domain Isolation Zones](planning-domain-isolation-zones.md) -###### [Exemption List](exemption-list.md) -###### [Isolated Domain](isolated-domain.md) -###### [Boundary Zone](boundary-zone.md) -###### [Encryption Zone](encryption-zone.md) +#### [Basic design](basic-firewall-policy-design.md) +##### [Basic Design Example](firewall-policy-design-example.md) -#### [Planning Server Isolation Zones](planning-server-isolation-zones.md) -#### [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) +#### [Domain isolation design](domain-isolation-policy-design.md) +##### [Domain Isolation Design Example](domain-isolation-policy-design-example.md) + + +#### [Server isolation design](server-isolation-policy-design.md) +##### [Server Isolation Design Example](server-isolation-policy-design-example.md) + + +#### [Certificate-based isolation design](certificate-based-isolation-policy-design.md) +##### [Certificate-based Isolation Design Example](certificate-based-isolation-policy-design-example.md) + +### [Design planning]() +#### [Planning your design](planning-your-windows-firewall-with-advanced-security-design.md) + +#### [Planning settings for a basic firewall policy](planning-settings-for-a-basic-firewall-policy.md) + +#### [Planning domain isolation zones]() +##### [Domain isolation zones](planning-domain-isolation-zones.md) +##### [Exemption list](exemption-list.md) +##### [Isolated domain](isolated-domain.md) +##### [Boundary zone](boundary-zone.md) +##### [Encryption zone](encryption-zone.md) + +#### [Planning server isolation zones](planning-server-isolation-zones.md) + +#### [Planning certificate-based authentication](planning-certificate-based-authentication.md) ##### [Documenting the Zones](documenting-the-zones.md) ##### [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) @@ -54,9 +67,31 @@ ###### [Planning GPO Deployment](planning-gpo-deployment.md) +### [Planning to deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) + + ## [Deployment guide]() -### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) -### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) +### [Deployment overview](windows-firewall-with-advanced-security-deployment-guide.md) + +### [Implementing your plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) + +### [Basic firewall deployment]() +#### [Checklist: Implementing a basic firewall policy design](checklist-implementing-a-basic-firewall-policy-design.md) + + + +### [Domain isolation deployment]() +#### [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) + + + +### [Server isolation deployment]() +#### [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) + + + +### [Certificate-based authentication]() +#### [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) @@ -109,20 +144,19 @@ ## [References]() ### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md) -### [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) -### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) ### [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md) ### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md) -### [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) -#### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md) -#### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md) -#### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md) -#### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md) -### [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) -#### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) -#### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) +### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) + + +### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md) +### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md) +### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md) +### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md) + +### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) +### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) -### [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) ### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) diff --git a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md index 5127569bc4..ef30c1a5cd 100644 --- a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md @@ -1,5 +1,5 @@ --- -title: Firewall Policy Design Example (Windows 10) +title: Basic Firewall Policy Design Example (Windows 10) description: Firewall Policy Design Example ms.assetid: 0dc3bcfe-7a4d-4a15-93a9-64b13bd775a7 ms.reviewer: @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 08/17/2017 --- -# Firewall Policy Design Example +# Basic Firewall Policy Design Example **Applies to** - Windows 10 diff --git a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md index c56fd15494..841c88ae5d 100644 --- a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md +++ b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md @@ -48,7 +48,7 @@ Use the following parent checklists in this section of the guide to become famil - [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) -- [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) +- [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) - [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md index d91723c3d2..dbfd48ddf6 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md @@ -1,6 +1,6 @@ --- -title: Deploy Windows Defender Firewall with Advanced Security (Windows 10) -description: Windows Defender Firewall with Advanced Security Deployment Guide +title: Windows Defender Firewall with Advanced Security deployment overview (Windows 10) +description: Windows Defender Firewall with Advanced Security deployment overview ms.assetid: 56b51b97-1c38-481e-bbda-540f1216ad56 ms.reviewer: ms.author: dansimp @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 08/17/2017 --- -# Windows Defender Firewall with Advanced Security Deployment Guide +# Windows Defender Firewall with Advanced Security deployment overview **Applies to** - Windows 10 @@ -61,10 +61,4 @@ This guide does not provide: - Guidance for setting up certification authorities (CAs) to create certificates for certificate-based authentication. -## Overview of Windows Defender Firewall with Advanced Security - -Windows Defender Firewall in Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that cannot be authenticated as a trusted device cannot communicate with your device. You can also use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by a malicious user. - -The Windows Defender Firewall with Advanced Security MMC snap-in is more flexible and provides much more functionality than the consumer-friendly Windows Defender Firewall interface found in the Control Panel. Both interfaces interact with the same underlying services, but provide different levels of control over those services. While the Windows Defender Firewall Control Panel program can protect a single device in a home environment, it does not provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment. - For more information about Windows Defender Firewall with Advanced Security, see [Windows Defender Firewall with Advanced Security Overview](windows-firewall-with-advanced-security.md). diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md index 3261e0545f..37d4d64de1 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md @@ -25,10 +25,17 @@ ms.custom: asr This is an overview of the Windows Defender Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features. +## Overview of Windows Defender Firewall with Advanced Security + +Windows Defender Firewall in Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that cannot be authenticated as a trusted device cannot communicate with your device. You can also use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by a malicious user. + +The Windows Defender Firewall with Advanced Security MMC snap-in is more flexible and provides much more functionality than the consumer-friendly Windows Defender Firewall interface found in the Control Panel. Both interfaces interact with the same underlying services, but provide different levels of control over those services. While the Windows Defender Firewall Control Panel program can protect a single device in a home environment, it does not provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment. + + + ## Feature description -Windows Defender Firewall with Advanced Security -is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Defender Firewall blocks unauthorized network traffic flowing into or out of the local device. Windows Defender Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. Windows Defender Firewall and Internet Protocol Security (IPsec) configuration settings are integrated into a single Microsoft Management Console (MMC) named Windows Defender Firewall, so Windows Defender Firewall is also an important part of your network’s isolation strategy. +Windows Defender Firewall with Advanced Security is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Defender Firewall blocks unauthorized network traffic flowing into or out of the local device. Windows Defender Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. Windows Defender Firewall and Internet Protocol Security (IPsec) configuration settings are integrated into a single Microsoft Management Console (MMC) named Windows Defender Firewall, so Windows Defender Firewall is also an important part of your network’s isolation strategy. ## Practical applications @@ -41,12 +48,4 @@ To help address your organizational network security challenges, Windows Defende - **Extends the value of existing investments.**  Because Windows Defender Firewall is a host-based firewall that is included with the operating system, there is no additional hardware or software required. Windows Defender Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). -## In this section -| Topic | Description -| - | - | -| [Isolating Microsoft Store Apps on Your Network](isolating-apps-on-your-network.md) | You can customize your Windows Defender Firewall configuration to isolate the network access of Microsoft Store apps that run on devices. | -| [Securing End-to-End IPsec Connections by Using IKEv2](securing-end-to-end-ipsec-connections-by-using-ikev2.md) | You can use IKEv2 to help secure your end-to-end IPSec connections. | -| [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md) | Learn more about using Windows PowerShell to manage the Windows Defender Firewall. | -| [Windows Defender Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md) | Learn how to create a design for deploying Windows Defender Firewall with Advanced Security. | -| [Windows Defender Firewall with Advanced Security Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) | Learn how to deploy Windows Defender Firewall with Advanced Security. | From 110213ea267937f0ee3c91008021d880f7a9123e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 14 Aug 2020 12:59:10 -0700 Subject: [PATCH 19/66] add troubleshooting topic --- windows/security/threat-protection/windows-firewall/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 038232e7da..874e91f06d 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -163,7 +163,7 @@ ## [Troubleshooting]() - +### [Troubleshooting UWP App Connectivity Issues in Windows Firewall](troubleshooting-uwp-firewall.md) From 774963624d0ed22ce68bc332e8615c39ec7705c3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 14 Aug 2020 13:28:18 -0700 Subject: [PATCH 20/66] cleannnnnnn up --- .../threat-protection/windows-firewall/TOC.md | 98 +++++++++---------- ...with-advanced-security-deployment-goals.md | 17 ++-- ...t-devices-from-unwanted-network-traffic.md | 4 +- ...restrict-access-to-only-trusted-devices.md | 6 +- ...all-with-advanced-security-design-guide.md | 7 +- 5 files changed, 65 insertions(+), 67 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 874e91f06d..e8109bbb5d 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -48,23 +48,23 @@ #### [Planning certificate-based authentication](planning-certificate-based-authentication.md) ##### [Documenting the Zones](documenting-the-zones.md) -##### [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) -###### [Planning Isolation Groups for the Zones](planning-isolation-groups-for-the-zones.md) -###### [Planning Network Access Groups](planning-network-access-groups.md) +##### [Planning group policy deployment for your isolation zones](planning-group-policy-deployment-for-your-isolation-zones.md) +###### [Planning isolation groups for the zones](planning-isolation-groups-for-the-zones.md) +###### [Planning network access groups](planning-network-access-groups.md) ###### [Planning the GPOs](planning-the-gpos.md) ####### [Firewall GPOs](firewall-gpos.md) ######## [GPO_DOMISO_Firewall](gpo-domiso-firewall.md) -####### [Isolated Domain GPOs](isolated-domain-gpos.md) +####### [Isolated domain GPOs](isolated-domain-gpos.md) ######## [GPO_DOMISO_IsolatedDomain_Clients](gpo-domiso-isolateddomain-clients.md) ######## [GPO_DOMISO_IsolatedDomain_Servers](gpo-domiso-isolateddomain-servers.md) -####### [Boundary Zone GPOs](boundary-zone-gpos.md) +####### [Boundary zone GPOs](boundary-zone-gpos.md) ######## [GPO_DOMISO_Boundary](gpo-domiso-boundary.md) -####### [Encryption Zone GPOs](encryption-zone-gpos.md) +####### [Encryption zone GPOs](encryption-zone-gpos.md) ######## [GPO_DOMISO_Encryption](gpo-domiso-encryption.md) -####### [Server Isolation GPOs](server-isolation-gpos.md) +####### [Server isolation GPOs](server-isolation-gpos.md) -###### [Planning GPO Deployment](planning-gpo-deployment.md) +###### [Planning GPO deployment](planning-gpo-deployment.md) ### [Planning to deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) @@ -102,68 +102,68 @@ ## [How-to]() -### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) -### [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) -### [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md) -### [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md) -### [Configure Authentication Methods](configure-authentication-methods.md) -### [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md) -### [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md) -### [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md) -### [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md) -### [Configure the Windows Firewall Log](configure-the-windows-firewall-log.md) -### [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md) -### [Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) -### [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md) -### [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md) +### [Add Production devices to the membership group for a zone](add-production-devices-to-the-membership-group-for-a-zone.md) +### [Add test devices to the membership group for a zone](add-test-devices-to-the-membership-group-for-a-zone.md) +### [Assign security group filters to the GPO](assign-security-group-filters-to-the-gpo.md) +### [Change rules from request to require mode](Change-Rules-From-Request-To-Require-Mode.Md) +### [Configure authentication methods](Configure-authentication-methods.md) +### [Configure data protection (Quick Mode) settings](configure-data-protection-quick-mode-settings.md) +### [Configure Group Policy to autoenroll and deploy certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md) +### [Configure key exchange (main mode) settings](configure-key-exchange-main-mode-settings.md) +### [Configure the rules to require encryption](configure-the-rules-to-require-encryption.md) +### [Configure the Windows Firewall log](configure-the-windows-firewall-log.md) +### [Configure the workstation authentication certificate template](configure-the-workstation-authentication-certificate-template.md) +### [Configure Windows Firewall to suppress notifications when a program is blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) +### [Confirm that certificates are deployed correctly](confirm-that-certificates-are-deployed-correctly.md) +### [Copy a GPO to create a new GPO](copy-a-gpo-to-create-a-new-gpo.md) ### [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md) ### [Create a Group Policy Object](create-a-group-policy-object.md) -### [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md) -### [Create an Authentication Request Rule](create-an-authentication-request-rule.md) -### [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md) -### [Create an Inbound Port Rule](create-an-inbound-port-rule.md) -### [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md) -### [Create an Outbound Port Rule](create-an-outbound-port-rule.md) -### [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md) -### [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md) -### [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) +### [Create an authentication exemption list rule](create-an-authentication-exemption-list-rule.md) +### [Create an authentication request rule](create-an-authentication-request-rule.md) +### [Create an inbound ICMP rule](create-an-inbound-icmp-rule.md) +### [Create an inbound port rule](create-an-inbound-port-rule.md) +### [Create an inbound program or service rule](create-an-inbound-program-or-service-rule.md) +### [Create an outbound port rule](create-an-outbound-port-rule.md) +### [Create an outbound program or service rule](create-an-outbound-program-or-service-rule.md) +### [Create inbound rules to support RPC](create-inbound-rules-to-support-rpc.md) +### [Create WMI filters for the GPO](create-wmi-filters-for-the-gpo.md) ### [Create Windows Firewall rules in Intune](create-windows-firewall-rules-in-intune.md) -### [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md) -### [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md) -### [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md) -### [Link the GPO to the Domain](link-the-gpo-to-the-domain.md) -### [Modify GPO Filters](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) -### [Open IP Security Policies](open-the-group-policy-management-console-to-ip-security-policies.md) +### [Enable predefined inbound rules](enable-predefined-inbound-rules.md) +### [Enable predefined outbound rules](enable-predefined-outbound-rules.md) +### [Exempt ICMP from authentication](exempt-icmp-from-authentication.md) +### [Link the GPO to the domain](link-the-gpo-to-the-domain.md) +### [Modify GPO filters](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) +### [Open IP security policies](open-the-group-policy-management-console-to-ip-security-policies.md) ### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall.md) ### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) ### [Open Windows Firewall](open-windows-firewall-with-advanced-security.md) -### [Restrict Server Access](restrict-server-access-to-members-of-a-group-only.md) +### [Restrict server access](restrict-server-access-to-members-of-a-group-only.md) ### [Enable Windows Firewall](turn-on-windows-firewall-and-configure-default-behavior.md) ### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) -### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) + ## [References]() -### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md) -### [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md) +### [Checklist: Creating Group Policy objects](checklist-creating-group-policy-objects.md) +### [Checklist: Creating inbound firewall rules](checklist-creating-inbound-firewall-rules.md) ### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md) ### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) -### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md) -### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md) -### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md) -### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md) +### [Checklist: Configuring rules for the isolated domain](checklist-configuring-rules-for-the-isolated-domain.md) +### [Checklist: Configuring rules for the boundary zone](checklist-configuring-rules-for-the-boundary-zone.md) +### [Checklist: Configuring rules for the encryption zone](checklist-configuring-rules-for-the-encryption-zone.md) +### [Checklist: Configuring rules for an isolated server zone](checklist-configuring-rules-for-an-isolated-server-zone.md) -### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) -### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) +### [Checklist: Configuring rules for servers in a standalone isolated server zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) +### [Checklist: Creating rules for clients of a standalone isolated server zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) -### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) +### [Appendix A: Sample GPO template files for settings used in this guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) ## [Troubleshooting]() -### [Troubleshooting UWP App Connectivity Issues in Windows Firewall](troubleshooting-uwp-firewall.md) +### [Troubleshooting UWP app connectivity issues in Windows Firewall](troubleshooting-uwp-firewall.md) diff --git a/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md b/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md index 5e3a16c452..96725d8ff3 100644 --- a/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md +++ b/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md @@ -1,6 +1,6 @@ --- -title: Identify Goals for your WFAS Deployment (Windows 10) -description: Identifying Your Windows Defender Firewall with Advanced Security (WFAS) Deployment Goals +title: Identify implementation goals for Windows Defender Firewall with Advanced Security Deployment (Windows 10) +description: Identifying Your Windows Defender Firewall with Advanced Security (WFAS) implementation goals ms.assetid: 598cf45e-2e1c-4947-970f-361dfa264bba ms.reviewer: ms.author: dansimp @@ -17,22 +17,21 @@ ms.topic: conceptual ms.date: 08/17/2017 --- -# Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals - +# Identifying Windows Defender Firewall with Advanced Security implementation goals **Applies to** - Windows 10 - Windows Server 2016 -Correctly identifying your Windows Defender Firewall with Advanced Security deployment goals is essential for the success of your Windows Defender Firewall design project. Form a project team that can clearly articulate deployment issues in a vision statement. When you write your vision statement, identify, clarify, and refine your deployment goals. Prioritize and, if possible, combine your deployment goals so that you can design and deploy Windows Defender Firewall by using an iterative approach. You can take advantage of the predefined Windows Defender Firewall deployment goals presented in this guide that are relevant to your scenarios. +Correctly identifying your Windows Defender Firewall with Advanced Security implementation goals is essential for the success of your Windows Defender Firewall design project. Form a project team that can clearly articulate deployment issues in a vision statement. When you write your vision statement, identify, clarify, and refine your implementation goals. Prioritize and, if possible, combine your implementation goals so that you can design and deploy Windows Defender Firewall by using an iterative approach. You can take advantage of the predefined Windows Defender Firewall implementation goals presented in this guide that are relevant to your scenarios. -The following table lists the three main tasks for articulating, refining, and subsequently documenting your Windows Defender Firewall deployment goals: +The following table lists the three main tasks for articulating, refining, and subsequently documenting your Windows Defender Firewall implementation goals: | Deployment goal tasks | Reference links | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Evaluate predefined Windows Defender Firewall with Advanced Security deployment goals that are provided in this section of the guide, and combine one or more goals to reach your organizational objectives. | Predefined deployment goals:

  • [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md)

  • [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)

  • [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md)

  • [Restrict Access to Sensitive Resources to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md)
| -| Map one goal or a combination of the predefined deployment goals to an existing Windows Defender Firewall with Advanced Security design. |
  • [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md)
| -| Based on the status of your current infrastructure, document your deployment goals for your Windows Defender Firewall with Advanced Security design into a deployment plan. |
  • [Designing A Windows Defender Firewall Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md)

  • [Planning Your Windows Defender Firewall Design with Advanced Security](planning-your-windows-firewall-with-advanced-security-design.md)
| +| Evaluate predefined Windows Defender Firewall with Advanced Security implementation goals that are provided in this section of the guide, and combine one or more goals to reach your organizational objectives. | Predefined implementation goals:

  • [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md)

  • [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)

  • [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md)

  • [Restrict Access to Sensitive Resources to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md)
| +| Map one goal or a combination of the predefined implementation goals to an existing Windows Defender Firewall with Advanced Security design. |
  • [Mapping Your implementation goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md)
| +| Based on the status of your current infrastructure, document your implementation goals for your Windows Defender Firewall with Advanced Security design into a deployment plan. |
  • [Designing A Windows Defender Firewall Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md)

  • [Planning Your Windows Defender Firewall Design with Advanced Security](planning-your-windows-firewall-with-advanced-security-design.md)
|
diff --git a/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md b/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md index a3ca3c4b6e..76364690ae 100644 --- a/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md +++ b/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md @@ -1,5 +1,5 @@ --- -title: Protect Devices from Unwanted Network Traffic (Windows 10) +title: Protect devices from unwanted network traffic (Windows 10) description: Protect Devices from Unwanted Network Traffic ms.assetid: 307d2b38-e8c4-4358-ae16-f2143af965dc ms.reviewer: @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 04/19/2017 --- -# Protect Devices from Unwanted Network Traffic +# Protect devices from unwanted network traffic **Applies to** - Windows 10 diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md index cbdd8e51d9..56b9898e53 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md @@ -1,6 +1,6 @@ --- -title: Restrict Access to Only Trusted Devices (Windows 10) -description: Restrict Access to Only Trusted Devices +title: Restrict access to only trusted devices (Windows 10) +description: estrict access to only trusted devices ms.assetid: bc1f49a4-7d54-4857-8af9-b7c79f47273b ms.reviewer: ms.author: dansimp @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 08/17/2017 --- -# Restrict Access to Only Trusted Devices +# Restrict access to only trusted devices **Applies to** - Windows 10 diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md index 70c8912478..0cda980c2c 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md @@ -1,6 +1,6 @@ --- -title: Windows Defender Firewall with Advanced Security Design Guide (Windows 10) -description: Windows Defender Firewall with Advanced Security Design Guide +title: Windows Defender Firewall with Advanced Security design guide (Windows 10) +description: Windows Defender Firewall with Advanced Security design guide ms.assetid: 5c631389-f232-4b95-9e48-ec02b8677d51 ms.reviewer: ms.author: dansimp @@ -17,8 +17,7 @@ ms.topic: conceptual ms.date: 10/05/2017 --- -# Windows Defender Firewall with Advanced Security -Design Guide +# Windows Defender Firewall with Advanced Security design guide **Applies to** - Windows 10 From d3f75c7897da0ed2e7e2892dc073c42e5fb71e2c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 14 Aug 2020 13:46:54 -0700 Subject: [PATCH 21/66] more clean up --- .../threat-protection/windows-firewall/TOC.md | 22 +++++++++---------- ...rtificate-based-isolation-policy-design.md | 6 ++--- ...rtificate-based-isolation-policy-design.md | 2 +- ...enting-a-domain-isolation-policy-design.md | 2 +- ...andalone-server-isolation-policy-design.md | 2 +- .../domain-isolation-policy-design.md | 2 +- ...-firewall-with-advanced-security-design.md | 10 ++++----- .../server-isolation-policy-design.md | 2 +- ...l-with-advanced-security-design-process.md | 7 +++--- ...all-with-advanced-security-design-guide.md | 7 +++--- 10 files changed, 30 insertions(+), 32 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index e8109bbb5d..e5edff503e 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -8,28 +8,28 @@ ### [Implementation goals]() #### [Identify implementation goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) -#### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) -#### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) -#### [Require Encryption](require-encryption-when-accessing-sensitive-network-resources.md) -#### [Restrict Access](restrict-access-to-only-specified-users-or-devices.md) +#### [Protect devices from unwanted network traffic](protect-devices-from-unwanted-network-traffic.md) +#### [Restrict access to only trusted devices](restrict-access-to-only-trusted-devices.md) +#### [Require encryption](require-encryption-when-accessing-sensitive-network-resources.md) +#### [Restrict access](restrict-access-to-only-specified-users-or-devices.md) ### [Implementation designs]() #### [Mapping goals to a design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) -#### [Basic design](basic-firewall-policy-design.md) -##### [Basic Design Example](firewall-policy-design-example.md) +#### [Basic firewall design](basic-firewall-policy-design.md) +##### [Basic firewall design example](firewall-policy-design-example.md) #### [Domain isolation design](domain-isolation-policy-design.md) -##### [Domain Isolation Design Example](domain-isolation-policy-design-example.md) +##### [Domain isolation design example](domain-isolation-policy-design-example.md) #### [Server isolation design](server-isolation-policy-design.md) -##### [Server Isolation Design Example](server-isolation-policy-design-example.md) +##### [Server Isolation design example](server-isolation-policy-design-example.md) #### [Certificate-based isolation design](certificate-based-isolation-policy-design.md) -##### [Certificate-based Isolation Design Example](certificate-based-isolation-policy-design-example.md) +##### [Certificate-based Isolation design example](certificate-based-isolation-policy-design-example.md) ### [Design planning]() #### [Planning your design](planning-your-windows-firewall-with-advanced-security-design.md) @@ -145,8 +145,8 @@ ## [References]() ### [Checklist: Creating Group Policy objects](checklist-creating-group-policy-objects.md) ### [Checklist: Creating inbound firewall rules](checklist-creating-inbound-firewall-rules.md) -### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md) -### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) +### [Checklist: Creating outbound firewall rules](checklist-creating-outbound-firewall-rules.md) +### [Checklist: Configuring basic firewall settings](checklist-configuring-basic-firewall-settings.md) ### [Checklist: Configuring rules for the isolated domain](checklist-configuring-rules-for-the-isolated-domain.md) diff --git a/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md index 71775ab476..38ec0654bb 100644 --- a/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 08/17/2017 --- -# Certificate-based Isolation Policy Design +# Certificate-based isolation policy design **Applies to** - Windows 10 @@ -35,7 +35,7 @@ For Windows devices that are part of an Active Directory domain, you can use Gro For more info about this design: -- This design coincides with the deployment goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). +- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). - To learn more about this design, see [Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md). @@ -45,4 +45,4 @@ For more info about this design: - For a list of tasks that you can use to deploy your certificate-based policy design, see [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md). -**Next:** [Evaluating Windows Defender Firewall with Advanced Security Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md) + diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md index 4d6b02ef58..573b76aa96 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md @@ -31,7 +31,7 @@ This parent checklist includes cross-reference links to important concepts about | Task | Reference | | - | - | -| Review important concepts and examples for certificate-based authentication to determine if this design meets your deployment goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md)
[Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md)
[Planning Certificate-based Authentication](planning-certificate-based-authentication.md) | +| Review important concepts and examples for certificate-based authentication to determine if this design meets your implementation goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md)
[Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md)
[Planning Certificate-based Authentication](planning-certificate-based-authentication.md) | | Install the Active Directory Certificate Services (AD CS) role as an enterprise root issuing certification authority (CA). This step is required only if you have not already deployed a CA on your network.| | | Configure the certificate template for workstation authentication certificates.| [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md)| | Configure Group Policy to automatically deploy certificates based on your template to workstation devices. | [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md)| diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md index 139618cb53..d946ecab9e 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md @@ -33,7 +33,7 @@ The procedures in this section use the Group Policy MMC snap-ins to configure th | Task | Reference | | - | - | -| Review important concepts and examples for the domain isolation policy design, determine your Windows Defender Firewall with Advanced Security deployment goals, and customize this design to meet the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Domain Isolation Policy Design](domain-isolation-policy-design.md)
[Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md)
[Planning Domain Isolation Zones](planning-domain-isolation-zones.md) | +| Review important concepts and examples for the domain isolation policy design, determine your Windows Defender Firewall with Advanced Security implementation goals, and customize this design to meet the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Domain Isolation Policy Design](domain-isolation-policy-design.md)
[Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md)
[Planning Domain Isolation Zones](planning-domain-isolation-zones.md) | | Create the GPOs and connection security rules for the isolated domain.| [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md)| | Create the GPOs and connection security rules for the boundary zone.| [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md)| | Create the GPOs and connection security rules for the encryption zone.| [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md)| diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md index 05aad0007e..2ed1fd1e5e 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md @@ -33,7 +33,7 @@ This parent checklist includes cross-reference links to important concepts about | Task | Reference | | - | - | -| Review important concepts and examples for the server isolation policy design to determine if this design meets your deployment goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Server Isolation Policy Design](server-isolation-policy-design.md)
[Server Isolation Policy Design Example](server-isolation-policy-design-example.md)
[Planning Server Isolation Zones](planning-server-isolation-zones.md) | +| Review important concepts and examples for the server isolation policy design to determine if this design meets your implementation goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Server Isolation Policy Design](server-isolation-policy-design.md)
[Server Isolation Policy Design Example](server-isolation-policy-design-example.md)
[Planning Server Isolation Zones](planning-server-isolation-zones.md) | | Create the GPOs and connection security rules for isolated servers.| [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)| | Create the GPOs and connection security rules for the client devices that must connect to the isolated servers. | [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)| | Verify that the connection security rules are protecting network traffic on your test devices. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| diff --git a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md index 948932fb53..b618fe6d2d 100644 --- a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md @@ -59,7 +59,7 @@ In order to expand the isolated domain to include Devices that cannot be part of For more info about this design: -- This design coincides with the deployment goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). +- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). - To learn more about this design, see the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md). diff --git a/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md b/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md index 9c73c224b9..6f6cd2d1a1 100644 --- a/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md +++ b/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md @@ -1,6 +1,6 @@ --- -title: Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design (Windows 10) -description: Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design +title: Mapping your implementation goals to a Windows Firewall with Advanced Security design (Windows 10) +description: Mapping your implementation goals to a Windows Firewall with Advanced Security design ms.assetid: 7e68c59e-ba40-49c4-8e47-5de5d6b5eb22 ms.reviewer: ms.author: dansimp @@ -17,17 +17,17 @@ ms.topic: conceptual ms.date: 04/19/2017 --- -# Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design +# Mapping your implementation goals to a Windows Firewall with Advanced Security design **Applies to** - Windows 10 - Windows Server 2016 -After you finish reviewing the existing Windows Firewall with Advanced Security deployment goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Firewall with Advanced Security design. +After you finish reviewing the existing Windows Firewall with Advanced Security implementation goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Firewall with Advanced Security design. >**Important:**  The first three designs presented in this guide build on each other to progress from simpler to more complex. Therefore during deployment, consider implementing them in the order presented. Each deployed design also provides a stable position from which to evaluate your progress, and to make sure that your goals are being met before you continue to the next design. -Use the following table to determine which Windows Firewall with Advanced Security design maps to the appropriate combination of Windows Firewall with Advanced Security deployment goals for your organization. This table refers only to the Windows Firewall with Advanced Security designs as described in this guide. However, you can create a hybrid or custom Windows Firewall with Advanced Security design by using any combination of the Windows Firewall with Advanced Security deployment goals to meet the needs of your organization. +Use the following table to determine which Windows Firewall with Advanced Security design maps to the appropriate combination of Windows Firewall with Advanced Security implementation goals for your organization. This table refers only to the Windows Firewall with Advanced Security designs as described in this guide. However, you can create a hybrid or custom Windows Firewall with Advanced Security design by using any combination of the Windows Firewall with Advanced Security implementation goals to meet the needs of your organization. | Deployment Goals | Basic Firewall Policy Design | Domain Isolation Policy Design | Server Isolation Policy Design | Certificate-based Isolation Policy Design | | - |- | - | - | - | diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md index 1eeea3dc76..23a6808219 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md @@ -49,7 +49,7 @@ This design can be applied to devices that are part of an Active Directory fores For more info about this design: -- This design coincides with the deployment goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md), and [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). +- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md), and [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). - To learn more about this design, see [Server Isolation Policy Design Example](server-isolation-policy-design-example.md). diff --git a/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md b/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md index 26796b6814..0449d6b01f 100644 --- a/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md +++ b/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md @@ -20,13 +20,12 @@ ms.author: dansimp Designing any deployment starts by performing several important tasks: -- [Identifying Your Windows Defender Firewall with Advanced Security Design Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) +- [Identifying your windows defender firewall with advanced security design goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) -- [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) +- [Mapping your implementation goals to a Windows Defender Firewall with Advanced Security design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) -- [Evaluating Windows Defender Firewall with Advanced Security Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md) -After you identify your deployment goals and map them to a Windows Defender Firewall with Advanced Security design, you can begin documenting the design based on the processes that are described in the following topics: +After you identify your implementation goals and map them to a Windows Defender Firewall with Advanced Security design, you can begin documenting the design based on the processes that are described in the following topics: - [Designing A Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md index 0cda980c2c..58bc8e79a9 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md @@ -39,7 +39,7 @@ Windows Defender Firewall should be part of a comprehensive security solution th To successfully use this guide, you need a good understanding of both the capabilities provided by Windows Defender Firewall, and how to deliver configuration settings to your managed devices by using Group Policy in Active Directory. -You can use the deployment goals to form one of these Windows Defender Firewall with Advanced Security designs, or a custom design that combines elements from those presented here: +You can use the implementation goals to form one of these Windows Defender Firewall with Advanced Security designs, or a custom design that combines elements from those presented here: - **Basic firewall policy design**. Restricts network traffic in and out of your devices to only that which is needed and authorized. @@ -67,9 +67,8 @@ Deployment Guide at these locations: | Topic | Description | - | - | | [Understanding the Windows Defender Firewall with Advanced Security Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) | Learn how to get started with the Windows Defender Firewall with Advanced Security design process. | -| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) | Learn how to identify your Windows Defender Firewall with Advanced Security deployment goals. | -| [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) | After you finish reviewing the existing Windows Defender Firewall with Advanced Security deployment goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Defender Firewall with Advanced Security design. | -| [Evaluating Windows Defender Firewall with Advanced Security Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md) | Learn how to use Windows Defender Firewall to improve the security of the computers connected to the network. | +| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) | Learn how to identify your Windows Defender Firewall with Advanced Security implementation goals. | +| [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) | After you finish reviewing the existing Windows Defender Firewall with Advanced Security implementation goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Defender Firewall with Advanced Security design. | | [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) | To select the most effective design for helping to protect the network, you must spend time collecting key information about your current computer environment. | | [Planning Your Windows Defender Firewall with Advanced Security Design](planning-your-windows-firewall-with-advanced-security-design.md) | After you have gathered the relevant information in the previous sections, and understand the basics of the designs as described earlier in this guide, you can select the design (or combination of designs) that meet your needs. | | [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) | You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC). | From 0813a2dd0179ebd2da84f4ed8a409e8ab5773354 Mon Sep 17 00:00:00 2001 From: damabe Date: Fri, 14 Aug 2020 21:15:21 -0700 Subject: [PATCH 22/66] Updated short descriptions for SEO improvement --- windows/client-management/mdm/cm-proxyentries-csp.md | 2 +- windows/client-management/mdm/customdeviceui-csp.md | 2 +- windows/client-management/mdm/customdeviceui-ddf.md | 2 +- windows/client-management/mdm/defender-csp.md | 2 +- windows/client-management/mdm/defender-ddf.md | 2 +- windows/client-management/mdm/devdetail-csp.md | 2 +- windows/client-management/mdm/devdetail-ddf-file.md | 2 +- windows/client-management/mdm/deviceinstanceservice-csp.md | 2 +- windows/client-management/mdm/devicelock-csp.md | 2 +- windows/client-management/mdm/devicelock-ddf-file.md | 2 +- windows/client-management/mdm/devinfo-ddf-file.md | 2 +- windows/client-management/mdm/diagnosticlog-csp.md | 2 +- windows/client-management/mdm/diagnosticlog-ddf.md | 2 +- windows/client-management/mdm/dmacc-csp.md | 2 +- windows/client-management/mdm/dmacc-ddf-file.md | 2 +- windows/client-management/mdm/dmclient-ddf-file.md | 2 +- windows/client-management/mdm/dmprocessconfigxmlfiltered.md | 2 +- windows/client-management/mdm/dmsessionactions-csp.md | 2 +- 18 files changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/client-management/mdm/cm-proxyentries-csp.md b/windows/client-management/mdm/cm-proxyentries-csp.md index 828700b85a..816b5c188b 100644 --- a/windows/client-management/mdm/cm-proxyentries-csp.md +++ b/windows/client-management/mdm/cm-proxyentries-csp.md @@ -1,6 +1,6 @@ --- title: CM\_ProxyEntries CSP -description: Configure proxy connections on mobile devices using CM\_ProxyEntries CSP. +description: Learn how the CM\_ProxyEntries configuration service provider is used to configure proxy connections on the mobile device. ms.assetid: f4c3dc71-c85a-4c68-9ce9-19f408ff7a0a ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 05add93e6a..17b165ed51 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -1,6 +1,6 @@ --- title: CustomDeviceUI CSP -description: CustomDeviceUI CSP +description: Learn how the CustomDeviceUI configuration service provider (CSP) allows OEMs to implement their custom foreground application. ms.assetid: 20ED1867-7B9E-4455-B397-53B8B15C95A3 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/customdeviceui-ddf.md b/windows/client-management/mdm/customdeviceui-ddf.md index 12b590ef8c..7623b155f2 100644 --- a/windows/client-management/mdm/customdeviceui-ddf.md +++ b/windows/client-management/mdm/customdeviceui-ddf.md @@ -1,6 +1,6 @@ --- title: CustomDeviceUI DDF -description: CustomDeviceUI DDF +description: Learn about the OMA DM device description framework (DDF) for the CustomDeviceUI configuration service provider. ms.assetid: E6D6B902-C57C-48A6-9654-CCBA3898455E ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index cb96fa1fb1..da9959c0a2 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -1,6 +1,6 @@ --- title: Defender CSP -description: See how the Windows Defender configuration service provider is used to configure various Windows Defender actions across the enterprise. +description: Learn how the Windows Defender configuration service provider is used to configure various Windows Defender actions across the enterprise. ms.assetid: 481AA74F-08B2-4A32-B95D-5A3FD05B335C ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index 508d2f5d0d..a63f4dec92 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -1,6 +1,6 @@ --- title: Defender DDF file -description: See how the OMA DM device description framework (DDF) for the **Defender** configuration service provider is used. +description: Learn how the OMA DM device description framework (DDF) for the Defender configuration service provider is used. ms.assetid: 39B9E6CF-4857-4199-B3C3-EC740A439F65 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devdetail-csp.md b/windows/client-management/mdm/devdetail-csp.md index 285d96ddf8..11ab51bf9e 100644 --- a/windows/client-management/mdm/devdetail-csp.md +++ b/windows/client-management/mdm/devdetail-csp.md @@ -1,6 +1,6 @@ --- title: DevDetail CSP -description: DevDetail CSP +description: Learn how the DevDetail configuration service provider handles the management object which provides device-specific parameters to the OMA DM server. ms.assetid: 719bbd2d-508d-439b-b175-0874c7e6c360 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index 0ab07220b6..25be11c21b 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -1,6 +1,6 @@ --- title: DevDetail DDF file -description: DevDetail DDF file +description: Learn about the OMA DM device description framework (DDF) for the DevDetail configuration service provider. ms.assetid: 645fc2b5-2d2c-43b1-9058-26bedbe9f00d ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/deviceinstanceservice-csp.md b/windows/client-management/mdm/deviceinstanceservice-csp.md index 09d6af05e4..d7b8e34afb 100644 --- a/windows/client-management/mdm/deviceinstanceservice-csp.md +++ b/windows/client-management/mdm/deviceinstanceservice-csp.md @@ -1,6 +1,6 @@ --- title: DeviceInstanceService CSP -description: DeviceInstanceService CSP +description: Learn how the he DeviceInstanceService configuration service provider (CSP) provides some device inventory information that could be useful for an enterprise. ms.assetid: f113b6bb-6ce1-45ad-b725-1b6610721e2d ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index 246408076e..cef65071ec 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -1,6 +1,6 @@ --- title: DeviceLock CSP -description: DeviceLock CSP +description: Learn how the DeviceLock configuration service provider (CSP) is used by the enterprise management server to configure device lock related policies. ms.assetid: 9a547efb-738e-4677-95d3-5506d350d8ab ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devicelock-ddf-file.md b/windows/client-management/mdm/devicelock-ddf-file.md index 545ebcdb9b..eb63ef11fe 100644 --- a/windows/client-management/mdm/devicelock-ddf-file.md +++ b/windows/client-management/mdm/devicelock-ddf-file.md @@ -1,6 +1,6 @@ --- title: DeviceLock DDF file -description: DeviceLock DDF file +description: Learn about the OMA DM device description framework (DDF) for the DeviceLock configuration service provider (CSP). ms.assetid: 46a691b9-6350-4987-bfc7-f8b1eece3ad9 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devinfo-ddf-file.md b/windows/client-management/mdm/devinfo-ddf-file.md index b81a21b82e..aec2b4cc91 100644 --- a/windows/client-management/mdm/devinfo-ddf-file.md +++ b/windows/client-management/mdm/devinfo-ddf-file.md @@ -1,6 +1,6 @@ --- title: DevInfo DDF file -description: DevInfo DDF file +description: Learn about the OMA DM device description framework (DDF) for the DevInfo configuration service provider (CSP). ms.assetid: beb07cc6-4133-4c0f-aa05-64db2b4a004f ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 2f00912ad8..2c49067d90 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -1,6 +1,6 @@ --- title: DiagnosticLog CSP -description: DiagnosticLog CSP +description: Learn about the feature areas of the DiagnosticLog configuration service provider (CSP), including the DiagnosticLog area and Policy area. ms.assetid: F76E0056-3ACD-48B2-BEA1-1048C96571C3 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index 8bedac1205..f635ed44c6 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -1,6 +1,6 @@ --- title: DiagnosticLog DDF -description: DiagnosticLog DDF +description: Learn about the the OMA DM device description framework (DDF) for the DiagnosticLog configuration service provider (CSP). ms.assetid: 9DD75EDA-5913-45B4-9BED-20E30CDEBE16 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index aa61f9d50b..4a45bf4eb2 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -1,6 +1,6 @@ --- title: DMAcc CSP -description: DMAcc CSP +description: Learn how the DMAcc configuration service provider (CSP) allows an OMA Device Management (DM) version 1.2 server to handle OMA DM account objects. ms.assetid: 43e73d8a-6617-44e7-8459-5c96f4422e63 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md index 232f5672cd..b10dcad38a 100644 --- a/windows/client-management/mdm/dmacc-ddf-file.md +++ b/windows/client-management/mdm/dmacc-ddf-file.md @@ -1,6 +1,6 @@ --- title: DMAcc DDF file -description: DMAcc DDF file +description: Learn about the OMA DM device description framework (DDF) for the DMAcc configuration service provider (CSP). ms.assetid: 44dc99aa-2a85-498b-8f52-a81863765606 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index 44ff431b60..c5ba87da90 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -1,6 +1,6 @@ --- title: DMClient DDF file -description: DMClient DDF file +description: Learn about the OMA DM device description framework (DDF) for the DMClient configuration service provider (CSP). ms.assetid: A21B33AF-DB76-4059-8170-FADF2CB898A0 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md index 2e1b590d91..b9ed5780d0 100644 --- a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md +++ b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md @@ -1,6 +1,6 @@ --- title: DMProcessConfigXMLFiltered function -description: Configures phone settings by using OMA Client Provisioning XML. +description: Learn how the DMProcessConfigXMLFiltered function configures phone settings by using OMA Client Provisioning XML. Search.Refinement.TopicID: 184 ms.assetid: 31D79901-6206-454C-AE78-9B85A3B3487F ms.reviewer: diff --git a/windows/client-management/mdm/dmsessionactions-csp.md b/windows/client-management/mdm/dmsessionactions-csp.md index b395c7c3ba..65aeb1a961 100644 --- a/windows/client-management/mdm/dmsessionactions-csp.md +++ b/windows/client-management/mdm/dmsessionactions-csp.md @@ -1,6 +1,6 @@ --- title: DMSessionActions CSP -description: DMSessionActions CSP +description: Learn how the DMSessionActions configuration service provider (CSP) is used to manage the number of sessions the client skips if the device is in a low power state. ms.author: dansimp ms.topic: article ms.prod: w10 From c80831853eb10c32e2a398ff68dc709a653b2da2 Mon Sep 17 00:00:00 2001 From: damabe Date: Fri, 14 Aug 2020 21:35:31 -0700 Subject: [PATCH 23/66] Updated short descriptions for SEO improvement --- windows/client-management/mdm/dmsessionactions-ddf.md | 2 +- windows/client-management/mdm/dynamicmanagement-csp.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/dmsessionactions-ddf.md b/windows/client-management/mdm/dmsessionactions-ddf.md index aef1210842..61b4b4754a 100644 --- a/windows/client-management/mdm/dmsessionactions-ddf.md +++ b/windows/client-management/mdm/dmsessionactions-ddf.md @@ -1,6 +1,6 @@ --- title: DMSessionActions DDF file -description: DMSessionActions DDF file +description: Learn about the OMA DM device description framework (DDF) for the DMSessionActions configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index e7d55aedc0..b6fe50d931 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -1,6 +1,6 @@ --- title: DynamicManagement CSP -description: DynamicManagement CSP +description: Learn how the Dynamic Management configuration service provider (CSP) enables configuration of policies that change how the device is managed. ms.author: dansimp ms.topic: article ms.prod: w10 From feee20e4a08b8023437b6a2fe1988997e16520de Mon Sep 17 00:00:00 2001 From: damabe Date: Fri, 14 Aug 2020 23:07:55 -0700 Subject: [PATCH 24/66] Updated short descriptions for SEO improvement --- windows/client-management/mdm/dynamicmanagement-ddf.md | 2 +- windows/client-management/mdm/email2-csp.md | 2 +- windows/client-management/mdm/email2-ddf-file.md | 2 +- .../client-management/mdm/enable-admx-backed-policies-in-mdm.md | 2 +- ...roll-a-windows-10-device-automatically-using-group-policy.md | 2 +- .../client-management/mdm/enrollmentstatustracking-csp-ddf.md | 2 +- windows/client-management/mdm/enterpriseapn-ddf.md | 2 +- windows/client-management/mdm/enterpriseappvmanagement-csp.md | 2 +- windows/client-management/mdm/enterpriseappvmanagement-ddf.md | 2 +- windows/client-management/mdm/enterpriseassignedaccess-csp.md | 2 +- windows/client-management/mdm/enterpriseext-csp.md | 2 +- windows/client-management/mdm/enterpriseext-ddf.md | 2 +- windows/client-management/mdm/enterpriseextfilesystem-ddf.md | 2 +- .../client-management/mdm/enterprisemodernappmanagement-csp.md | 2 +- .../client-management/mdm/enterprisemodernappmanagement-ddf.md | 2 +- .../client-management/mdm/enterprisemodernappmanagement-xsd.md | 2 +- windows/client-management/mdm/esim-enterprise-management.md | 2 +- windows/client-management/mdm/euiccs-csp.md | 2 +- windows/client-management/mdm/euiccs-ddf-file.md | 2 +- windows/client-management/mdm/filesystem-csp.md | 2 +- 20 files changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/client-management/mdm/dynamicmanagement-ddf.md b/windows/client-management/mdm/dynamicmanagement-ddf.md index 3439bf646a..2690fa4e23 100644 --- a/windows/client-management/mdm/dynamicmanagement-ddf.md +++ b/windows/client-management/mdm/dynamicmanagement-ddf.md @@ -1,6 +1,6 @@ --- title: DynamicManagement DDF file -description: DynamicManagement DDF file +description: Learn about the OMA DM device description framework (DDF) for the DynamicManagement configuration service provider (CSP). ms.assetid: 7e266db0-2fd9-4412-b428-4550f41a1738 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/email2-csp.md b/windows/client-management/mdm/email2-csp.md index ddb14a8d3f..844fc1be39 100644 --- a/windows/client-management/mdm/email2-csp.md +++ b/windows/client-management/mdm/email2-csp.md @@ -1,6 +1,6 @@ --- title: EMAIL2 CSP -description: EMAIL2 CSP +description: Learn how the EMAIL2 configuration service provider (CSP) is used to configure Simple Mail Transfer Protocol (SMTP) email accounts. ms.assetid: bcfc9d98-bc2e-42c6-9b81-0b5bf65ce2b8 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/email2-ddf-file.md b/windows/client-management/mdm/email2-ddf-file.md index f24a64e3e3..4f11b5b64d 100644 --- a/windows/client-management/mdm/email2-ddf-file.md +++ b/windows/client-management/mdm/email2-ddf-file.md @@ -1,6 +1,6 @@ --- title: EMAIL2 DDF file -description: EMAIL2 DDF file +description: Learn how the OMA DM device description framework (DDF) for the EMAIL2 configuration service provider (CSP). ms.assetid: 7e266db0-2fd9-4412-b428-4550f41a1738 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md index 1f420a71c4..805f9ee481 100644 --- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md @@ -1,6 +1,6 @@ --- title: Enable ADMX-backed policies in MDM -description: Use this is a step-by-step guide to configuring ADMX-backed policies in MDM. +description: Use this step-by-step guide to configure a selected set of Group Policy administrative templates (ADMX-backed policies) in Mobile Device Management (MDM). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index f45e20d377..349687ed6c 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -1,6 +1,6 @@ --- title: Enroll a Windows 10 device automatically using Group Policy -description: Enroll a Windows 10 device automatically using Group Policy +description: Learn how to use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md index e70eed0ce5..98739efcb1 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md @@ -1,6 +1,6 @@ --- title: EnrollmentStatusTracking DDF -description: View the OMA DM device description framework (DDF) for the EnrollmentStatusTracking configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: View the OMA DM DDF for the EnrollmentStatusTracking configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/enterpriseapn-ddf.md b/windows/client-management/mdm/enterpriseapn-ddf.md index 319356f336..5e7af9b60d 100644 --- a/windows/client-management/mdm/enterpriseapn-ddf.md +++ b/windows/client-management/mdm/enterpriseapn-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseAPN DDF -description: EnterpriseAPN DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAPN configuration service provider (CSP). ms.assetid: A953ADEF-4523-425F-926C-48DA62EB9E21 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseappvmanagement-csp.md b/windows/client-management/mdm/enterpriseappvmanagement-csp.md index 22445122ec..272f60f44f 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseAppVManagement CSP -description: Examine the tree format for EnterpriseAppVManagement configuration service provider (CSP) to manage virtual applications in Windows 10 PCs.(Enterprise and Education editions). +description: Examine the tree format for EnterpriseAppVManagement CSP to manage virtual applications in Windows 10 PCs.(Enterprise and Education editions). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md index 626981e0ff..8cf951cf55 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseAppVManagement DDF file -description: EnterpriseAppVManagement DDF file +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAppVManagement configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/enterpriseassignedaccess-csp.md b/windows/client-management/mdm/enterpriseassignedaccess-csp.md index 2df97c9bf4..45d11904d5 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-csp.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseAssignedAccess CSP -description: Use the EnterpriseAssignedAccess CSP to configure custom layouts on a device. +description: Use the EnterpriseAssignedAccess configuration service provider (CSP) to configure custom layouts on a device. ms.assetid: 5F88E567-77AA-4822-A0BC-3B31100639AA ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseext-csp.md b/windows/client-management/mdm/enterpriseext-csp.md index 782bc735ed..24cadf3270 100644 --- a/windows/client-management/mdm/enterpriseext-csp.md +++ b/windows/client-management/mdm/enterpriseext-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseExt CSP -description: EnterpriseExt CSP +description: Learn how the EnterpriseExt CSP allows OEMs to set their own unique ID for their devices, set display brightness values, and set the LED behavior. ms.assetid: ACA5CD79-BBD5-4DD1-86DA-0285B93982BD ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseext-ddf.md b/windows/client-management/mdm/enterpriseext-ddf.md index e30ceeb37f..4b3d4b0afd 100644 --- a/windows/client-management/mdm/enterpriseext-ddf.md +++ b/windows/client-management/mdm/enterpriseext-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseExt DDF -description: EnterpriseExt DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseExt configuration service provider (CSP). ms.assetid: 71BF81D4-FBEC-4B03-BF99-F7A5EDD4F91B ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseextfilesystem-ddf.md b/windows/client-management/mdm/enterpriseextfilesystem-ddf.md index 997493aee9..7efb54af20 100644 --- a/windows/client-management/mdm/enterpriseextfilesystem-ddf.md +++ b/windows/client-management/mdm/enterpriseextfilesystem-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseExtFileSystem DDF -description: EnterpriseExtFileSystem DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseExtFileSystem configuration service provider (CSP). ms.assetid: 2D292E4B-15EE-4AEB-8884-6FEE8B92D2D1 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md index 5384ce0168..77b6e72ff9 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseModernAppManagement CSP -description: EnterpriseModernAppManagement CSP +description: Learn how the EnterpriseModernAppManagement configuration service provider (CSP) is used for the provisioning and reporting of modern enterprise apps. ms.assetid: 9DD0741A-A229-41A0-A85A-93E185207C42 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index aa2cdb680b..237000b2f0 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseModernAppManagement DDF -description: EnterpriseModernAppManagement DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseModernAppManagement configuration service provider (CSP). ms.assetid: ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md index f7544b10a4..f8b15504cc 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md @@ -1,6 +1,6 @@ --- title: EnterpriseModernAppManagement XSD -description: Use the EnterpriseModernAppManagement XSD for set application parameters. +description: In this article, view the EnterpriseModernAppManagement XSD example so you can set application parameters. ms.assetid: D393D094-25E5-4E66-A60F-B59CC312BF57 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/esim-enterprise-management.md b/windows/client-management/mdm/esim-enterprise-management.md index 9251f6a755..79545b45cc 100644 --- a/windows/client-management/mdm/esim-enterprise-management.md +++ b/windows/client-management/mdm/esim-enterprise-management.md @@ -1,6 +1,6 @@ --- title: eSIM Enterprise Management -description: Managing eSIM devices in an enterprise +description: Learn how Mobile Device Management (MDM) Providers support the eSIM Profile Management Solution on Windows. keywords: eSIM enterprise management ms.prod: w10 ms.mktglfcycl: diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index 43626310a0..1f42e3e43d 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -1,6 +1,6 @@ --- title: eUICCs CSP -description: eUICCs CSP +description: Learn how the eUICCs CSP is used to support eUICC enterprise use cases and enables the IT admin to manage (assign, re-assign, remove) subscriptions to employees. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index 3f3e71df8d..38bb8e5f6f 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -1,6 +1,6 @@ --- title: eUICCs DDF file -description: eUICCs DDF file +description: Learn about the OMA DM device description framework (DDF) for the eUICCs configuration service provider (CSP). ms.assetid: c4cd4816-ad8f-45b2-9b81-8abb18254096 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/filesystem-csp.md b/windows/client-management/mdm/filesystem-csp.md index 653b03b527..9bad3fe712 100644 --- a/windows/client-management/mdm/filesystem-csp.md +++ b/windows/client-management/mdm/filesystem-csp.md @@ -1,6 +1,6 @@ --- title: FileSystem CSP -description: FileSystem CSP +description: Learn how the FileSystem CSP is used to query, add, modify, and delete files, file directories, and file attributes on the mobile device. ms.assetid: 9117ee16-ca7a-4efa-9270-c9ac8547e541 ms.reviewer: manager: dansimp From 997d2746a6b57db50732abf4e72e6fa1f6b93944 Mon Sep 17 00:00:00 2001 From: Dan Mabee Date: Fri, 14 Aug 2020 23:19:55 -0700 Subject: [PATCH 25/66] Update deviceinstanceservice-csp.md --- windows/client-management/mdm/deviceinstanceservice-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/deviceinstanceservice-csp.md b/windows/client-management/mdm/deviceinstanceservice-csp.md index d7b8e34afb..f24564545c 100644 --- a/windows/client-management/mdm/deviceinstanceservice-csp.md +++ b/windows/client-management/mdm/deviceinstanceservice-csp.md @@ -1,6 +1,6 @@ --- title: DeviceInstanceService CSP -description: Learn how the he DeviceInstanceService configuration service provider (CSP) provides some device inventory information that could be useful for an enterprise. +description: Learn how the DeviceInstanceService configuration service provider (CSP) provides some device inventory information that could be useful for an enterprise. ms.assetid: f113b6bb-6ce1-45ad-b725-1b6610721e2d ms.reviewer: manager: dansimp From bc3408a7774262f169d56d9b7f384bd4b4f73f73 Mon Sep 17 00:00:00 2001 From: damabe Date: Sun, 16 Aug 2020 20:59:48 -0700 Subject: [PATCH 26/66] Update short descriptions for SEO improvement --- windows/client-management/mdm/healthattestation-csp.md | 2 +- windows/client-management/mdm/healthattestation-ddf.md | 2 +- .../client-management/mdm/mdm-enrollment-of-windows-devices.md | 2 +- windows/client-management/mdm/messaging-csp.md | 2 +- windows/client-management/mdm/multisim-csp.md | 2 +- windows/client-management/mdm/nap-csp.md | 2 +- windows/client-management/mdm/napdef-csp.md | 2 +- windows/client-management/mdm/networkproxy-csp.md | 2 +- windows/client-management/mdm/networkqospolicy-ddf.md | 2 +- windows/client-management/mdm/nodecache-ddf-file.md | 2 +- windows/client-management/mdm/personalization-ddf.md | 2 +- .../mdm/policy-configuration-service-provider.md | 2 +- windows/client-management/mdm/policy-csp-abovelock.md | 2 +- windows/client-management/mdm/policy-csp-accounts.md | 2 +- windows/client-management/mdm/policy-csp-activexcontrols.md | 2 +- windows/client-management/mdm/policy-csp-applicationdefaults.md | 2 +- .../client-management/mdm/policy-csp-applicationmanagement.md | 2 +- windows/client-management/mdm/policy-csp-appruntime.md | 2 +- windows/client-management/mdm/policy-csp-appvirtualization.md | 2 +- windows/client-management/mdm/policy-csp-attachmentmanager.md | 2 +- 20 files changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index e24210c9e0..0124df555f 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -1,6 +1,6 @@ --- title: Device HealthAttestation CSP -description: Device HealthAttestation CSP +description: Learn how the DHA-CSP enables enterprise IT managers to assess if a device is booted to a trusted and compliant state, and take enterprise policy actions. ms.assetid: 6F2D783C-F6B4-4A81-B9A2-522C4661D1AC ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/healthattestation-ddf.md b/windows/client-management/mdm/healthattestation-ddf.md index 21934f6452..d7209b1cf2 100644 --- a/windows/client-management/mdm/healthattestation-ddf.md +++ b/windows/client-management/mdm/healthattestation-ddf.md @@ -1,6 +1,6 @@ --- title: HealthAttestation DDF -description: HealthAttestation DDF +description: Learn about the OMA DM device description framework (DDF) for the HealthAttestation configuration service provider. ms.assetid: D20AC78D-D2D4-434B-B9FD-294BCD9D1DDE ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md index 7b8e606d40..1c9ca9aba5 100644 --- a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md @@ -1,6 +1,6 @@ --- title: MDM enrollment of Windows 10-based devices -description: MDM enrollment of Windows 10-based devices +description: Learn about mobile device management (MDM) enrollment of Windows 10-based devices to simplify access to your organization’s resources. MS-HAID: - 'p\_phdevicemgmt.enrollment\_ui' - 'p\_phDeviceMgmt.mdm\_enrollment\_of\_windows\_devices' diff --git a/windows/client-management/mdm/messaging-csp.md b/windows/client-management/mdm/messaging-csp.md index cc739605f3..e9383e871f 100644 --- a/windows/client-management/mdm/messaging-csp.md +++ b/windows/client-management/mdm/messaging-csp.md @@ -1,6 +1,6 @@ --- title: Messaging CSP -description: Use the Messaging CSP to configure the ability to get text messages audited on a mobile device. +description: Use the Messaging configuration service provider (CSP) to configure the ability to get text messages audited on a mobile device. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/multisim-csp.md b/windows/client-management/mdm/multisim-csp.md index 7d719b40aa..3597ffa5fe 100644 --- a/windows/client-management/mdm/multisim-csp.md +++ b/windows/client-management/mdm/multisim-csp.md @@ -1,6 +1,6 @@ --- title: MultiSIM CSP -description: MultiSIM CSP allows the enterprise to manage devices with dual SIM single active configuration. +description: MultiSIM configuration service provider (CSP) allows the enterprise to manage devices with dual SIM single active configuration. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/nap-csp.md b/windows/client-management/mdm/nap-csp.md index c4dbd6410a..dcaef76767 100644 --- a/windows/client-management/mdm/nap-csp.md +++ b/windows/client-management/mdm/nap-csp.md @@ -1,6 +1,6 @@ --- title: NAP CSP -description: NAP CSP +description: Learn how the Network Access Point (NAP) configuration service provider (CSP) is used to manage and query GPRS and CDMA connections. ms.assetid: 82f04492-88a6-4afd-af10-a62b8d444d21 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index 80a87e53d1..1b5f5ecdd4 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -1,6 +1,6 @@ --- title: NAPDEF CSP -description: NAPDEF CSP +description: Learn how the NAPDEF configuration service provider (CSP) is used to add, modify, or delete WAP network access points (NAPs). ms.assetid: 9bcc65dd-a72b-4f90-aba7-4066daa06988 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index c82e246263..43aff61d37 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -1,6 +1,6 @@ --- title: NetworkProxy CSP -description: NetworkProxy CSP +description: Learn how the NetworkProxy configuration service provider (CSP) is used to configure a proxy server for ethernet and Wi-Fi connections. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md index 7535a3ce20..c2d3ea4a5e 100644 --- a/windows/client-management/mdm/networkqospolicy-ddf.md +++ b/windows/client-management/mdm/networkqospolicy-ddf.md @@ -1,6 +1,6 @@ --- title: NetworkQoSPolicy DDF -description: View the OMA DM device description framework (DDF) for the NetworkQoSPolicy configuration service provider. DDF files are used only with OMA DM provisioning XML +description: View the OMA DM device description framework (DDF) for the NetworkQoSPolicy configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.assetid: ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/nodecache-ddf-file.md b/windows/client-management/mdm/nodecache-ddf-file.md index 7d58ebbea3..06a74f2979 100644 --- a/windows/client-management/mdm/nodecache-ddf-file.md +++ b/windows/client-management/mdm/nodecache-ddf-file.md @@ -1,6 +1,6 @@ --- title: NodeCache DDF file -description: NodeCache DDF file +description: Learn about the OMA DM device description framework (DDF) for the NodeCache configuration service provider (CSP). ms.assetid: d7605098-12aa-4423-89ae-59624fa31236 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md index eef4903c8c..5a9ac5cc69 100644 --- a/windows/client-management/mdm/personalization-ddf.md +++ b/windows/client-management/mdm/personalization-ddf.md @@ -1,6 +1,6 @@ --- title: Personalization DDF file -description: Learn how to set the OMA DM device description framework (DDF) for the **Personalization** configuration service provider. +description: Learn how to set the OMA DM device description framework (DDF) for the Personalization configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 5e23762281..d7f6716dcc 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1,6 +1,6 @@ --- title: Policy CSP -description: Policy CSP +description: Learn how the Policy configuration service provider (CSP) enables the enterprise to configure policies on Windows 10. ms.assetid: 4F3A1134-D401-44FC-A583-6EDD3070BA4F ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index ebc28b415c..23c1bb8142 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -1,6 +1,6 @@ --- title: Policy CSP - AboveLock -description: Learn the various AboveLock Policy CSP for Windows editions of Home, Pro, Business, and more. +description: Learn the various AboveLock Policy configuration service provider (CSP) for Windows editions of Home, Pro, Business, and more. ms.author: dansimp ms.localizationpriority: medium ms.topic: article diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index fad4a74ad7..4367ed3ed6 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Accounts -description: Policy CSP - Accounts +description: Learn about the Policy configuration service provider (CSP). This articles describes account policies. ms.author: dansimp ms.localizationpriority: medium ms.topic: article diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index 9c2b674cee..d760021b1e 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -1,6 +1,6 @@ --- title: Policy CSP - ActiveXControls -description: Learn the ins and outs of various Policy CSP - ActiveXControls settings, including SyncML, for Windows 10. +description: Learn about various Policy configuration service provider (CSP) - ActiveXControls settings, including SyncML, for Windows 10. ms.author: dansimp ms.localizationpriority: medium ms.topic: article diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index ccc641c6a3..eb4a7086d1 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -1,6 +1,6 @@ --- title: Policy CSP - ApplicationDefaults -description: Policy CSP - ApplicationDefaults +description: Learn about various Policy configuration service provider (CSP) - ApplicationDefaults, including SyncML, for Windows 10. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 6b55aa34e3..1f128f9b64 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -1,6 +1,6 @@ --- title: Policy CSP - ApplicationManagement -description: Policy CSP - ApplicationManagement +description: Learn about various Policy configuration service provider (CSP) - ApplicationManagement, including SyncML, for Windows 10. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index 6e15e10e88..2a224f8bfe 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -1,6 +1,6 @@ --- title: Policy CSP - AppRuntime -description: Control whether Microsoft accounts are optional for Windows Store apps that require an account to sign in.Policy CSP - AppRuntime. +description: Learn how the Policy CSP - AppRuntime setting controls whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index 29788ea127..63cdb4036d 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -1,6 +1,6 @@ --- title: Policy CSP - AppVirtualization -description: Policy CSP - AppVirtualization +description: Learn how the Policy CSP - AppVirtualization setting allows you to enable or disable Microsoft Application Virtualization (App-V) feature. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index cb2130e778..cf8e105de8 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -1,6 +1,6 @@ --- title: Policy CSP - AttachmentManager -description: Manage Windows marks file attachments with information about their zone of origin (such as restricted, Internet, intranet, local). +description: Manage Windows marks file attachments with information about their zone of origin, such as restricted, Internet, intranet, local. ms.author: dansimp ms.topic: article ms.prod: w10 From d21e60247429dd067d8812fa00b9df9f315e1178 Mon Sep 17 00:00:00 2001 From: Dan Mabee Date: Sun, 16 Aug 2020 21:14:51 -0700 Subject: [PATCH 27/66] Update policy-csp-attachmentmanager.md --- windows/client-management/mdm/policy-csp-attachmentmanager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index cf8e105de8..e808f11e13 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -1,6 +1,6 @@ --- title: Policy CSP - AttachmentManager -description: Manage Windows marks file attachments with information about their zone of origin, such as restricted, Internet, intranet, local. +description: Manage Windows marks file attachments with information about their zone of origin, such as restricted, internet, intranet, local. ms.author: dansimp ms.topic: article ms.prod: w10 From 286b8fa706326ed5598e5d5ce0e5b7190768f5bb Mon Sep 17 00:00:00 2001 From: damabe Date: Sun, 16 Aug 2020 22:39:27 -0700 Subject: [PATCH 28/66] Update short descriptions for SEO improvement --- windows/client-management/mdm/policy-csp-audit.md | 2 +- windows/client-management/mdm/policy-csp-authentication.md | 2 +- windows/client-management/mdm/policy-csp-autoplay.md | 2 +- windows/client-management/mdm/policy-csp-bluetooth.md | 2 +- windows/client-management/mdm/policy-csp-browser.md | 2 +- windows/client-management/mdm/policy-csp-camera.md | 2 +- windows/client-management/mdm/policy-csp-cellular.md | 2 +- windows/client-management/mdm/policy-csp-connectivity.md | 2 +- .../client-management/mdm/policy-csp-controlpolicyconflict.md | 2 +- windows/client-management/mdm/policy-csp-credentialproviders.md | 2 +- .../client-management/mdm/policy-csp-credentialsdelegation.md | 2 +- windows/client-management/mdm/policy-csp-credentialsui.md | 2 +- windows/client-management/mdm/policy-csp-cryptography.md | 2 +- windows/client-management/mdm/policy-csp-dataprotection.md | 2 +- windows/client-management/mdm/policy-csp-datausage.md | 2 +- windows/client-management/mdm/policy-csp-defender.md | 2 +- .../client-management/mdm/policy-csp-deliveryoptimization.md | 2 +- windows/client-management/mdm/policy-csp-desktop.md | 2 +- windows/client-management/mdm/policy-csp-deviceguard.md | 2 +- .../client-management/mdm/policy-csp-devicehealthmonitoring.md | 2 +- 20 files changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index ffd4519182..7d0997f275 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Audit -description: Policy CSP - Audit +description: Learn how the Policy CSP - Audit setting causes an audit event to be generated when an account can't log on to a computer because the account is locked out. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 96f9787790..51f56ffbbb 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Authentication -description: Policy CSP - Authentication +description: The Policy CSP - Authentication setting allows the Azure AD tenant administrators to enable self service password reset feature on the Windows sign in screen. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index 36a05de8df..15b769497e 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Autoplay -description: Policy CSP - Autoplay +description: Learn how the Policy CSP - Autoplay setting disallows AutoPlay for MTP devices like cameras or phones. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 28123a7dc0..6426fba5e8 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Bluetooth -description: Policy CSP - Bluetooth +description: Learn how the Policy CSP - Bluetooth setting specifies whether the device can send out Bluetooth advertisements. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 206e99f3db..d2c9190e0b 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Browser -description: Learn how to set the Policy CSP - Browser settings for Microsoft Edge, version 45 and earlier. +description: Learn how to use the Policy CSP - Browser settings so you can configure Microsoft Edge browser, version 45 and earlier. ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index 0def6900f0..93e5c5d6cf 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Camera -description: Policy CSP - Camera +description: Learn how to use the Policy CSP - Camera setting so that you can configure it to disable or enable the camera. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 3d156b1c89..ccd0ab26c1 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Cellular -description: Policy CSP - Cellular +description: Learn how to use the Policy CSP - Cellular setting so you can specify whether Windows apps can access cellular data. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index ee83ad3d00..503ee130bc 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Connectivity -description: Policy CSP - Connectivity +description: Learn how to use the Policy CSP - Connectivity setting to allow the user to enable Bluetooth or restrict access. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index a822c7a831..9a867b0778 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -1,6 +1,6 @@ --- title: Policy CSP - ControlPolicyConflict -description: Policy CSP - ControlPolicyConflict +description: Use the Policy CSP - ControlPolicyConflict setting to control which policy is used whenever both the MDM policy and its equivalent Group Policy are set on the device. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index 425fcf361a..89e4817ce7 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -1,6 +1,6 @@ --- title: Policy CSP - CredentialProviders -description: Learn the policy CSP for credential provider set up, sign in, PIN requests and so on. +description: Learn how to use the policy CSP for credential provider so you can control whether a domain user can sign in using a convenience PIN. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index c8416c3bb9..71447f45ab 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -1,6 +1,6 @@ --- title: Policy CSP - CredentialsDelegation -description: Policy CSP - CredentialsDelegation +description: Learn how to use the Policy CSP - CredentialsDelegation setting so that remote host can allow delegation of non-exportable credentials. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index 349800035d..5ccf34a12e 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -1,6 +1,6 @@ --- title: Policy CSP - CredentialsUI -description: Policy CSP - CredentialsUI +description: Learn how to use the Policy CSP - CredentialsUI setting to configure the display of the password reveal button in password entry user experiences. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index 55ceb74581..b141d4387b 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Cryptography -description: Policy CSP - Cryptography +description: Learn how to use the Policy CSP - Cryptography setting to allow or disallow the Federal Information Processing Standard (FIPS) policy. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index 4c71a876a5..9da8c6ce2c 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DataProtection -description: Policy CSP - DataProtection +description: Use the Policy CSP - DataProtection setting to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index 28f919ead9..cb540b3415 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DataUsage -description: Policy CSP - DataUsage +description: Learn how to use the Policy CSP - DataUsage setting to configure the cost of 4G connections on the local machine. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index c2fb83fe51..79fe896cdf 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Defender -description: Policy CSP - Defender +description: Learn how to use the Policy CSP - Defender setting so you can allow or disallow scanning of archives. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index bdf3985bb6..4061074c76 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DeliveryOptimization -description: Policy CSP - DeliveryOptimization +description: Learn how to use the Policy CSP - DeliveryOptimization setting to configure one or more Microsoft Connected Cache servers to be used by Delivery Optimization. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 0ade992a1d..dfbed26745 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Desktop -description: Policy CSP - Desktop +description: Learn how to use the Policy CSP - Desktop setting to prevent users from changing the path to their profile folders. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index 163655f59f..842a8a3eff 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DeviceGuard -description: Policy CSP - DeviceGuard +description: Learn how to use the Policy CSP - DeviceGuard policy to allow the IT admin to configure the launch of System Guard. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md index 8277ae0425..60d4832fae 100644 --- a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md +++ b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DeviceHealthMonitoring -description: Learn which DeviceHealthMonitoring policies are supported for your edition of Windows. +description: Learn how the Policy CSP - DeviceHealthMonitoring setting is used as an opt-in health monitoring connection between the device and Microsoft. ms.author: dansimp ms.topic: article ms.prod: w10 From 6f599b8d6f8d371c58c1d5a0a26bf971f94f7d90 Mon Sep 17 00:00:00 2001 From: Dan Mabee Date: Sun, 16 Aug 2020 22:42:11 -0700 Subject: [PATCH 29/66] Update policy-csp-deviceguard.md --- windows/client-management/mdm/policy-csp-deviceguard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index 842a8a3eff..9512ffde73 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DeviceGuard -description: Learn how to use the Policy CSP - DeviceGuard policy to allow the IT admin to configure the launch of System Guard. +description: Learn how to use the Policy CSP - DeviceGuard setting to allow the IT admin to configure the launch of System Guard. ms.author: dansimp ms.topic: article ms.prod: w10 From 44bbb3d9e0004ee0a026b98f25e333b55191fe96 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 17 Aug 2020 10:29:10 -0700 Subject: [PATCH 30/66] Update provisioning-create-package.md --- .../provisioning-create-package.md | 50 ++++++++++--------- 1 file changed, 26 insertions(+), 24 deletions(-) diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index 3c75f63d1f..f9816492d7 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -1,6 +1,6 @@ --- title: Create a provisioning package (Windows 10) -description: Learn how to create a provisioning package for Windows 10. Provisioning packages let you quickly configure a device without having to install a new image. +description: Learn how to create a provisioning package for Windows 10, which lets you quickly configure a device without having to install a new image. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -26,39 +26,41 @@ You can use Windows Configuration Designer to create a provisioning package (.pp >[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md) > [!TIP] -> We recommend creating a local admin account when developing and testing your provisioning package. We also recommend using a “least privileged” domain user account to join devices to the Active Directory domain. +> We recommend creating a local admin account when you develop and test your provisioning package. We also recommend using a *least privileged* domain user account to join devices to the Active Directory domain. ## Start a new project 1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, + - From either the Start screen or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut. or - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. + - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then select **ICD.exe**. 2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image: ![Configuration Designer wizards](../images/icd-create-options-1703.png) - - The wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices. Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop, mobile, and kiosk devices, see [What you can configure using Configuration Designer wizardS](provisioning-packages.md#configuration-designer-wizards). + - The following wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices: - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md) - [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) - [Instructions for HoloLens wizard](https://technet.microsoft.com/itpro/hololens/hololens-provisioning) - [Instructions for Surface Hub wizard](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) + + Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop, mobile, and kiosk devices, see [What you can configure using Configuration Designer wizards](provisioning-packages.md#configuration-designer-wizards). - - The **Advanced provisioning** option opens a new project with all **Runtime settings** available. *The rest of this procedure uses advanced provisioning.* + - The **Advanced provisioning** option opens a new project with all the runtime settings available. (The rest of this procedure uses advanced provisioning.) >[!TIP] > You can start a project in the simple wizard editor and then switch the project to the advanced editor. > > ![Switch to advanced editor](../images/icd-switch.png) -3. Enter a name for your project, and then click **Next**. +3. Enter a name for your project, and then select **Next**. -4. Select the settings you want to configure, based on the type of device, and then click **Next**. The following table describes the options. +4. Select the settings you want to configure, based on the type of device, and then select **Next**. The following table describes the options. | Windows edition | Settings available for customization | Provisioning package can apply to | @@ -71,12 +73,12 @@ You can use Windows Configuration Designer to create a provisioning package (.pp | Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team | [Microsoft Surface Hub](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) | -5. On the **Import a provisioning package (optional)** page, you can click **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then click **Finish**. +5. On the **Import a provisioning package (optional)** page, you can select **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then select **Finish**. >[!TIP] ->**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages you create so you don't have to reconfigure those common settings repeatedly. +>**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages that you create so you don't have to reconfigure those common settings repeatedly. -After you click **Finish**, Windows Configuration Designer will open the **Available customizations** pane and you can then configure settings for the package. +6. In the **Available customizations** pane, you can now configure settings for the package. @@ -94,7 +96,7 @@ The process for configuring settings is similar for all settings. The following - +
step one
Expand a category.		Expand Certificates category
step two
Select a setting.		Select ClientCertificates
step three
Enter a value for the setting. Click Add if the button is displayed.		Enter a name for the certificate
step three
Enter a value for the setting. Select Add if the button is displayed.		Enter a name for the certificate
step four
Some settings, such as this example, require additional information. In Available customizations, select the value you just created, and additional settings are displayed.		Additional settings for client certificate
step five
When the setting is configured, it is displayed in the Selected customizations pane.		Selected customizations pane
@@ -106,39 +108,39 @@ For details on each specific setting, see [Windows Provisioning settings referen ## Build package -1. After you're done configuring your customizations, click **Export** and select **Provisioning Package**. +1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**. ![Export on top bar](../images/icd-export-menu.png) -2. In the **Describe the provisioning package** window, enter the following information, and then click **Next**: +2. In the **Describe the provisioning package** window, enter the following information, and then select **Next**: - **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field. - - **Version (in Major.Minor format** - - Optional. You can change the default package version by specifying a new value in the **Version** field. + - **Version (in Major.Minor format** - Optional. You can change the default package version by specifying a new value in the **Version** field. - **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages). - **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0. -3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate. Both selections are optional. Click **Next** after you make your selections. +3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional: - **Encrypt package** - If you select this option, an auto-generated password will be shown on the screen. - - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select** and choosing the certificate you want to use to sign the package. + - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package. >[!NOTE] - >You should only configure provisioning package security when the package is used for device provisioning and the package has contents with sensitive security data such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. + >You should only configure provisioning package security when the package is used for device provisioning and when the package has content with sensitive security data, such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. > >If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner. -4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then click **Next**. By default, Windows Configuration Designer uses the project folder as the output location. +4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then select **Next**. By default, Windows Configuration Designer uses the project folder as the output location. -5. In the **Build the provisioning package** window, click **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. +5. In the **Build the provisioning package** window, select **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - If you need to cancel the build, click Cancel. This cancels the current build process, closes the wizard, and takes you back to the Customizations Page. + If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations** page. -6. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. +6. If your build fails, an error message will appear that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. + If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. -7. When you are done, click **Finish** to close the wizard and go back to the Customizations page. +7. When you are done, select **Finish** to close the wizard and go back to the Customizations page. **Next step**: [How to apply a provisioning package](provisioning-apply-package.md) From a207eb23d463d023f39e1325c8042a565c7ee559 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 17 Aug 2020 10:36:39 -0700 Subject: [PATCH 31/66] Update provisioning-create-package.md --- .../provisioning-packages/provisioning-create-package.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index f9816492d7..5b464073a9 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -140,7 +140,7 @@ For details on each specific setting, see [Windows Provisioning settings referen If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. -7. When you are done, select **Finish** to close the wizard and go back to the Customizations page. +7. When you are done, select **Finish** to close the wizard and go back to the **Customizations** page. **Next step**: [How to apply a provisioning package](provisioning-apply-package.md) From 09de6decc31bafdf1e54960adfd6128db1a5ba3b Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 17 Aug 2020 16:36:28 -0700 Subject: [PATCH 32/66] ADMX policy CSP-ciphersuiteorder --- .../mdm/policy-csp-admx-addremoveprograms.md | 954 +++++++++ .../mdm/policy-csp-admx-appcompat.md | 744 +++++++ .../mdm/policy-csp-admx-auditsettings.md | 119 ++ .../mdm/policy-csp-admx-ciphersuiteorder.md | 203 ++ .../mdm/policy-csp-admx-dnsclient.md | 1725 +++++++++++++++++ .../mdm/policy-csp-admx-eventforwarding.md | 200 ++ 6 files changed, 3945 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-addremoveprograms.md create mode 100644 windows/client-management/mdm/policy-csp-admx-appcompat.md create mode 100644 windows/client-management/mdm/policy-csp-admx-auditsettings.md create mode 100644 windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md create mode 100644 windows/client-management/mdm/policy-csp-admx-dnsclient.md create mode 100644 windows/client-management/mdm/policy-csp-admx-eventforwarding.md diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md new file mode 100644 index 0000000000..37cf49d46f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -0,0 +1,954 @@ +--- +title: Policy CSP - ADMX_AddRemovePrograms +description: Policy CSP - ADMX_AddRemovePrograms +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AddRemovePrograms + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## Policy CSP - ADMX_AddRemovePrograms + +
+
+ ADMX_AddRemovePrograms/DefaultCategory +
+
+ ADMX_AddRemovePrograms/NoAddFromCDorFloppy +
+
+ ADMX_AddRemovePrograms/NoAddFromInternet +
+
+ ADMX_AddRemovePrograms/NoAddFromNetwork +
+
+ ADMX_AddRemovePrograms/NoAddPage +
+
+ ADMX_AddRemovePrograms/NoAddRemovePrograms +
+
+ ADMX_AddRemovePrograms/NoChooseProgramsPage +
+
+ ADMX_AddRemovePrograms/NoRemovePage +
+
+ ADMX_AddRemovePrograms/NoServices +
+
+ ADMX_AddRemovePrograms/NoSupportInfo +
+
+ ADMX_AddRemovePrograms/NoWindowsSetupPage +
+
+ + +
+ + +**ADMX_AddRemovePrograms/DefaultCategory** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +Available in Windows 10 Insider Preview Build 20185. The policy setting specifies the category of programs that appears when users open the "Add New Programs" page. If you enable this setting, only the programs in the category you specify are displayed when the "Add New Programs" page opens. You can use the Category box on the "Add New Programs" page to display programs in other categories. + +To use this setting, type the name of a category in the Category box for this setting. You must enter a category that is already defined in Add or Remove Programs. To define a category, use Software Installation. + +If you disable this setting or do not configure it, all programs (Category: All) are displayed when the "Add New Programs" page opens. You can use this setting to direct users to the programs they are most likely to need. + +> [!NOTE] +> This setting is ignored if either the "Remove Add or Remove Programs" setting or the "Hide Add New Programs page" setting is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify default category for Add New Programs* +- GP name: *DefaultCategory* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
+ + +**ADMX_AddRemovePrograms/NoAddFromCDorFloppy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the "Add a program from CD-ROM or floppy disk" section from the Add New Programs page. This prevents users from using Add or Remove Programs to install programs from removable media. + +If you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users. This setting does not prevent users from using other tools and methods to add or remove program components. + +> [!NOTE] +> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. Also, if the "Prevent removable media source for any install" setting (located in User Configuration\Administrative Templates\Windows Components\Windows Installer) is enabled, users cannot add programs from removable media, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the "Add a program from CD-ROM or floppy disk" option* +- GP name: *NoAddFromCDorFloppy* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
+ + +**ADMX_AddRemovePrograms/NoAddFromInternet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the "Add programs from Microsoft" section from the Add New Programs page. This setting prevents users from using Add or Remove Programs to connect to Windows Update. + +If you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users. This setting does not prevent users from using other tools and methods to connect to Windows Update. + +> [!NOTE] +> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the "Add programs from Microsoft" option* +- GP name: *NoAddFromInternet* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
+ + +**ADMX_AddRemovePrograms/NoAddFromNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from viewing or installing published programs. This setting removes the "Add programs from your network" section from the Add New Programs page. The "Add programs from your network" section lists published programs and provides an easy way to install them. Published programs are those programs that the system administrator has explicitly made available to the user with a tool such as Windows Installer. Typically, system administrators publish programs to notify users that the programs are available, to recommend their use, or to enable users to install them without having to search for installation files. + +If you enable this setting, users cannot tell which programs have been published by the system administrator, and they cannot use Add or Remove Programs to install published programs. However, they can still install programs by using other methods, and they can view and install assigned (partially installed) programs that are offered on the desktop or on the Start menu. + +If you disable this setting or do not configure it, "Add programs from your network" is available to all users. + +> [!NOTE] +> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the "Add programs from your network" option* +- GP name: *NoAddFromNetwork* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + +
+ + +**ADMX_AddRemovePrograms/NoAddPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the Add New Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page. The Add New Programs button lets users install programs published or assigned by a system administrator. + +If you disable this setting or do not configure it, the Add New Programs button is available to all users. This setting does not prevent users from using other tools and methods to install programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Add New Programs page* +- GP name: *NoAddPage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
+ + +**ADMX_AddRemovePrograms/NoAddRemovePrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from using Add or Remove Programs. This setting removes Add or Remove Programs from Control Panel and removes the Add or Remove Programs item from menus. Add or Remove Programs lets users install, uninstall, repair, add, and remove features and components of Windows 2000 Professional and a wide variety of Windows programs. Programs published or assigned to the user appear in Add or Remove Programs. + +If you disable this setting or do not configure it, Add or Remove Programs is available to all users. When enabled, this setting takes precedence over the other settings in this folder. This setting does not prevent users from using other tools and methods to install or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Add or Remove Programs* +- GP name: *NoAddRemovePrograms* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
+ + +**ADMX_AddRemovePrograms/NoChooseProgramsPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the Set Program Access and Defaults button from the Add or Remove Programs bar. As a result, users cannot view or change the associated page. The Set Program Access and Defaults button lets administrators specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations. + +If you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users. This setting does not prevent users from using other tools and methods to change program access or defaults. This setting does not prevent the Set Program Access and Defaults icon from appearing on the Start menu. See the "Remove Set Program Access and Defaults from Start menu" setting. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the Set Program Access and Defaults page* +- GP name: *NoChooseProgramsPage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
+ + +**ADMX_AddRemovePrograms/NoRemovePage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the Change or Remove Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page. The Change or Remove Programs button lets users uninstall, repair, add, or remove features of installed programs. + +If you disable this setting or do not configure it, the Change or Remove Programs page is available to all users. This setting does not prevent users from using other tools and methods to delete or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Change or Remove Programs page* +- GP name: *NoRemovePage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
+ + +**ADMX_AddRemovePrograms/NoServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from using Add or Remove Programs to configure installed services. This setting removes the "Set up services" section of the Add/Remove Windows Components page. The "Set up services" section lists system services that have not been configured and offers users easy access to the configuration tools. + +If you disable this setting or do not configure it, "Set up services" appears only when there are unconfigured system services. If you enable this setting, "Set up services" never appears. This setting does not prevent users from using other methods to configure services. + +> [!NOTE] +> When "Set up services" does not appear, clicking the Add/Remove Windows Components button starts the Windows Component Wizard immediately. Because the only remaining option on the Add/Remove Windows Components page starts the wizard, that option is selected automatically, and the page is bypassed. To remove "Set up services" and prevent the Windows Component Wizard from starting, enable the "Hide Add/Remove Windows Components page" setting. If the "Hide Add/Remove Windows Components page" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Go directly to Components Wizard* +- GP name: *NoServices* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
+ + +**ADMX_AddRemovePrograms/NoSupportInfo** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes links to the Support Info dialog box from programs on the Change or Remove Programs page. Programs listed on the Change or Remove Programs page can include a "Click here for support information" hyperlink. When clicked, the hyperlink opens a dialog box that displays troubleshooting information, including a link to the installation files and data that users need to obtain product support, such as the Product ID and version number of the program. The dialog box also includes a hyperlink to support information on the Internet, such as the Microsoft Product Support Services Web page. + +If you disable this setting or do not configure it, the Support Info hyperlink appears. + +> [!NOTE] +> Not all programs provide a support information hyperlink. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Support Information* +- GP name: *NoSupportInfo* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
+ + +**ADMX_AddRemovePrograms/NoWindowsSetupPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the Add/Remove Windows Components button from the Add or Remove Programs bar. As a result, users cannot view or change the associated page. The Add/Remove Windows Components button lets users configure installed services and use the Windows Component Wizard to add, remove, and configure components of Windows from the installation files. + +If you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users. This setting does not prevent users from using other tools and methods to configure services or add or remove program components. However, this setting blocks user access to the Windows Component Wizard. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Add/Remove Windows Components page* +- GP name: *NoWindowsSetupPage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md new file mode 100644 index 0000000000..da013a6e46 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -0,0 +1,744 @@ +--- +title: Policy CSP - ADMX_AppCompat +description: Policy CSP - ADMX_AppCompat +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 08/10/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AppCompat + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## Policy CSP - ADMX_AppCompat + +
+
+ ADMX_AppCompat/AppCompatPrevent16BitMach + +
+
+ ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage + +
+
+ ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry + +
+
+ ADMX_AppCompat/AppCompatTurnOffSwitchBack + +
+
+ ADMX_AppCompat/AppCompatTurnOffEngine + +
+
+ ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1 + +
+
+ ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2 + +
+
+ ADMX_AppCompat/AppCompatTurnOffUserActionRecord + +
+
+ ADMX_AppCompat/AppCompatTurnOffProgramInventory + +
+
+ + +
+ + +**ADMX_AppCompat/AppCompatPrevent16BitMach** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether to prevent the MS-DOS subsystem (**ntvdm.exe**) from running on this computer. This setting affects the launching of 16-bit applications in the operating system. + +You can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, **ntvdm.exe** must be allowed to run. The MS-DOS subsystem starts when the first 16-bit application is launched. While the MS-DOS subsystem is running, any subsequent 16-bit applications launch faster, but overall resource usage on the system is increased. + +If the status is set to Enabled, the MS-DOS subsystem is prevented from running, which then prevents any 16-bit applications from running. In addition, any 32-bit applications with 16-bit installers or other 16-bit components cannot run. + +If the status is set to Disabled, the MS-DOS subsystem runs for all users on this computer. + +If the status is set to Not Configured, the OS falls back on a local policy set by the registry DWORD value **HKLM\System\CurrentControlSet\Control\WOW\DisallowedPolicyDefault**. If that value is non-0, this prevents all 16-bit applications from running. If that value is 0, 16-bit applications are allowed to run. If that value is also not present, on Windows 10 and above, the OS will launch the 16-bit application support control panel to allow an elevated administrator to make the decision; on Windows 7 and down-level, the OS will allow 16-bit applications to run. + +> [!NOTE] +> This setting appears only in Computer Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent access to 16-bit applications* +- GP name: *AppCompatPrevent16BitMach* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
+ + +**ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the visibility of the Program Compatibility property page shell extension. This shell extension is visible on the property context-menu of any program shortcut or executable file. + +The compatibility property page displays a list of options that can be selected and applied to the application to resolve the most common issues affecting legacy applications. + +Enabling this policy setting removes the property page from the context-menus, but does not affect previous compatibility settings applied to application using this interface. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Program Compatibility Property Page* +- GP name: *AppCompatRemoveProgramCompatPropPage* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
+ + +**ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. The policy setting controls the state of the Application Telemetry engine in the system. + +Application Telemetry is a mechanism that tracks anonymous usage of specific Windows system components by applications. + +Turning Application Telemetry off by selecting "enable" will stop the collection of usage data. + +If the customer Experience Improvement program is turned off, Application Telemetry will be turned off regardless of how this policy is set. + +Disabling telemetry will take effect on any newly launched applications. To ensure that telemetry collection has stopped for all applications, please reboot your machine. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Application Telemetry* +- GP name: *AppCompatTurnOffApplicationImpactTelemetry* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
+ + +**ADMX_AppCompat/AppCompatTurnOffSwitchBack** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. The policy setting controls the state of the Switchback compatibility engine in the system. + +Switchback is a mechanism that provides generic compatibility mitigations to older applications by providing older behavior to old applications and new behavior to new applications. + +Switchback is on by default. + +If you enable this policy setting, Switchback will be turned off. Turning Switchback off may degrade the compatibility of older applications. This option is useful for server administrators who require performance and are aware of compatibility of the applications they are using. + +If you disable or do not configure this policy setting, the Switchback will be turned on. + +Reboot the system after changing the setting to ensure that your system accurately reflects those changes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off SwitchBack Compatibility Engine* +- GP name: *AppCompatTurnOffSwitchBack* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
+ + +**ADMX_AppCompat/AppCompatTurnOffEngine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the state of the application compatibility engine in the system. + +The engine is part of the loader and looks through a compatibility database every time an application is started on the system. If a match for the application is found it provides either run-time solutions or compatibility fixes, or displays an Application Help message if the application has a know problem. + +Turning off the application compatibility engine will boost system performance. However, this will degrade the compatibility of many popular legacy applications, and will not block known incompatible applications from installing. For example, this may result in a blue screen if an old anti-virus application is installed. + +The Windows Resource Protection and User Account Control features of Windows use the application compatibility engine to provide mitigations for application problems. If the engine is turned off, these mitigations will not be applied to applications and their installers and these applications may fail to install or run properly. + +This option is useful to server administrators who require faster performance and are aware of the compatibility of the applications they are using. It is particularly useful for a web server where applications may be launched several hundred times a second, and the performance of the loader is essential. + +> [!NOTE] +> Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, reboot to ensure that your system accurately reflects those changes. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Application Compatibility Engine* +- GP name: *AppCompatTurnOffEngine* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
+ + +**ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting exists only for backward compatibility, and is not valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\Administrative Templates\Windows Components\Application Compatibility. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Program Compatibility Assistant* +- GP name: *AppCompatTurnOffProgramCompatibilityAssistant_1* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
+ + +**ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the state of the Program Compatibility Assistant (PCA). The PCA monitors applications run by the user. When a potential compatibility issue with an application is detected, the PCA will prompt the user with recommended solutions. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics. + +If you enable this policy setting, the PCA will be turned off. The user will not be presented with solutions to known compatibility issues when running applications. Turning off the PCA can be useful for system administrators who require better performance and are already aware of application compatibility issues. + +If you disable or do not configure this policy setting, the PCA will be turned on. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics. + +> [!NOTE] +> The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to run. These services can be configured by using the Services snap-in to the Microsoft Management Console. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Program Compatibility Assistant* +- GP name: *AppCompatTurnOffProgramCompatibilityAssistant_2* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
+ + +**ADMX_AppCompat/AppCompatTurnOffUserActionRecord** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the state of Steps Recorder. + +Steps Recorder keeps a record of steps taken by the user. The data generated by Steps Recorder can be used in feedback systems such as Windows Error Reporting to help developers understand and fix problems. The data includes user actions such as keyboard input and mouse input, user interface data, and screen shots. Steps Recorder includes an option to turn on and off data collection. + +If you enable this policy setting, Steps Recorder will be disabled. + +If you disable or do not configure this policy setting, Steps Recorder will be enabled. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Steps Recorder* +- GP name: *AppCompatTurnOffUserActionRecord* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
+ + +**ADMX_AppCompat/AppCompatTurnOffProgramInventory** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the state of the Inventory Collector. + +The Inventory Collector inventories applications, files, devices, and drivers on the system and sends the information to Microsoft. This information is used to help diagnose compatibility problems. + +If you enable this policy setting, the Inventory Collector will be turned off and data will not be sent to Microsoft. Collection of installation data through the Program Compatibility Assistant is also disabled. + +If you disable or do not configure this policy setting, the Inventory Collector will be turned on. + +> [!NOTE] +> This policy setting has no effect if the Customer Experience Improvement Program is turned off. The Inventory Collector will be off. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Inventory Collector* +- GP name: *AppCompatTurnOffProgramInventory* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md new file mode 100644 index 0000000000..2f91449316 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -0,0 +1,119 @@ +--- +title: Policy CSP - ADMX_AuditSettings +description: Policy CSP - ADMX_AuditSettings +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AuditSettings +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_AuditSettings policies + +
+
+ ADMX_AuditSettings/IncludeCmdLine +
+
+ + +
+ + +**ADMX_AuditSettings/IncludeCmdLine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines what information is logged in security audit events when a new process has been created. This setting only applies when the Audit Process Creation policy is enabled. + +If you enable this policy setting, the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied. + +If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events. + +Default is Not configured. + +> [!NOTE] +> When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information, such as passwords or user data. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Include command line in process creation events* +- GP name: *IncludeCmdLine* +- GP path: *System/Audit Process Creation* +- GP ADMX file name: *AuditSettings.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md new file mode 100644 index 0000000000..3e28f47950 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -0,0 +1,203 @@ +--- +title: Policy CSP - ADMX_CipherSuiteOrder +description: Policy CSP - ADMX_CipherSuiteOrder +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/17/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CipherSuiteOrder + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_CipherSuiteOrder policies + +
+
+ ADMX_CipherSuiteOrder/SSLCipherSuiteOrder +
+
+ ADMX_CipherSuiteOrder/SSLCurveOrder +
+
+ + +
+ + +**ADMX_CipherSuiteOrder/SSLCipherSuiteOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the cipher suites used by the Secure Socket Layer (SSL). + +If you enable this policy setting, SSL cipher suites are prioritized in the order specified. + +If you disable or do not configure this policy setting, default cipher suite order is used. + +For information about supported cipher Suites, see [Cipher Suites in TLS/SSL (Schannel SSP)](http://go.microsoft.com/fwlink/?LinkId=517265). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *SSL Cipher Suite Order* +- GP name: *Functions* +- GP path: *Network/SSL Configuration Settings* +- GP ADMX file name: *CipherSuiteOrder.admx* + + + +
+ +
+ + +**ADMX_CipherSuiteOrder/SSLCurveOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the priority order of ECC curves used with ECDHE cipher suites. + +If you enable this policy setting, ECC curves are prioritized in the order specified. Enter one curve name per line. + +If you disable or do not configure this policy setting, the default ECC curve order is used. + +The default curve order is as follows: + +- curve25519 +- NistP256 +- NistP384 + +To see all the curves supported on the system, enter the following command: + +``` cmd +CertUtil.exe -DisplayEccCurve +``` + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *ECC Curve Order* +- GP name: *EccCurves* +- GP path: *Network/SSL Configuration Settings* +- GP ADMX file name: *CipherSuiteOrder.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-dnsclient.md b/windows/client-management/mdm/policy-csp-admx-dnsclient.md new file mode 100644 index 0000000000..0c26d32f23 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-dnsclient.md @@ -0,0 +1,1725 @@ +--- +title: Policy CSP - ADMX_DnsClient +description: Policy CSP - ADMX_DnsClient +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/12/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DnsClient + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_DnsClient policies + +
+
+ ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries +
+
+ ADMX_DnsClient/DNS_AppendToMultiLabelName +
+
+ ADMX_DnsClient/DNS_Domain +
+
+ ADMX_DnsClient/DNS_DomainNameDevolutionLevel +
+
+ ADMX_DnsClient/DNS_IdnEncoding +
+
+ ADMX_DnsClient/DNS_IdnMapping +
+
+ ADMX_DnsClient/DNS_NameServer +
+
+ ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns +
+
+ ADMX_DnsClient/DNS_PrimaryDnsSuffix +
+
+ ADMX_DnsClient/DNS_RegisterAdapterName +
+
+ ADMX_DnsClient/DNS_RegisterReverseLookup +
+
+ ADMX_DnsClient/DNS_RegistrationEnabled +
+
+ ADMX_DnsClient/DNS_RegistrationOverwritesInConflict +
+
+ ADMX_DnsClient/DNS_RegistrationRefreshInterval +
+
+ ADMX_DnsClient/DNS_RegistrationTtl +
+
+ ADMX_DnsClient/DNS_SearchList +
+
+ ADMX_DnsClient/DNS_SmartMultiHomedNameResolution +
+
+ ADMX_DnsClient/DNS_SmartProtocolReorder +
+
+ ADMX_DnsClient/DNS_UpdateSecurityLevel +
+
+ ADMX_DnsClient/DNS_UpdateTopLevelDomainZones +
+
+ ADMX_DnsClient/DNS_UseDomainNameDevolution +
+
+ ADMX_DnsClient/Turn_Off_Multicast +
+
+ + +
+ + +**ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that NetBIOS over TCP/IP (NetBT) queries are issued for fully qualified domain names. + +If you enable this policy setting, NetBT queries will be issued for multi-label and fully qualified domain names, such as "www.example.com" in addition to single-label names. + +If you disable this policy setting, or if you do not configure this policy setting, NetBT queries will only be issued for single-label names, such as "example" and not for multi-label and fully qualified domain names. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow NetBT queries for fully qualified domain names* +- GP name: *DNS_AllowFQDNNetBiosQueries* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + +
+ + +**ADMX_DnsClient/DNS_AppendToMultiLabelName** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that computers may attach suffixes to an unqualified multi-label name before sending subsequent DNS queries if the original name query fails. + +A name containing dots, but not dot-terminated, is called an unqualified multi-label name, for example "server.corp" is an unqualified multi-label name. The name "server.corp.contoso.com." is an example of a fully qualified name because it contains a terminating dot. + +For example, if attaching suffixes is allowed, an unqualified multi-label name query for "server.corp" will be queried by the DNS client first. If the query succeeds, the response is returned to the client. If the query fails, the unqualified multi-label name is appended with DNS suffixes. These suffixes can be derived from a combination of the local DNS client's primary domain suffix, a connection-specific domain suffix, and a DNS suffix search list. + +If attaching suffixes is allowed, and a DNS client with a primary domain suffix of "contoso.com" performs a query for "server.corp" the DNS client will send a query for "server.corp" first, and then a query for "server.corp.contoso.com." second if the first query fails. + +If you enable this policy setting, suffixes are allowed to be appended to an unqualified multi-label name if the original name query fails. + +If you disable this policy setting, no suffixes are appended to unqualified multi-label name queries if the original name query fails. + +If you do not configure this policy setting, computers will use their local DNS client settings to determine the query behavior for unqualified multi-label names. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow DNS suffix appending to unqualified multi-label name queries* +- GP name: *DNS_AppendToMultiLabelName* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_Domain** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies a connection-specific DNS suffix. This policy setting supersedes local connection-specific DNS suffixes, and those configured using DHCP. To use this policy setting, click Enabled, and then enter a string value representing the DNS suffix. + +If you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied connection specific DNS suffix, if configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Connection-specific DNS suffix* +- GP name: *DNS_Domain* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_DomainNameDevolutionLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if the devolution level that DNS clients will use if they perform primary DNS suffix devolution during the name resolution process. + +With devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name. + +The DNS client appends DNS suffixes to the single-label, unqualified domain name based on the state of the Append primary and connection specific DNS suffixes radio button and Append parent suffixes of the primary DNS suffix check box on the DNS tab in Advanced TCP/IP Settings for the Internet Protocol (TCP/IP) Properties dialog box. + +Devolution is not enabled if a global suffix search list is configured using Group Policy. + +If a global suffix search list is not configured, and the Append primary and connection specific DNS suffixes radio button is selected, the DNS client appends the following names to a single-label name when it sends DNS queries: + +- The primary DNS suffix, as specified on the Computer Name tab of the System control panel. +- Each connection-specific DNS suffix, assigned either through DHCP or specified in the DNS suffix for this connection box on the DNS tab in the Advanced TCP/IP Settings dialog box for each connection. + +For example, when a user submits a query for a single-label name such as "example," the DNS client attaches a suffix such as "microsoft.com" resulting in the query "example.microsoft.com," before sending the query to a DNS server. + +If a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server. + +For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix cannot be devolved beyond a devolution level of two. The devolution level can be configured using this policy setting. The default devolution level is two. + +If you enable this policy setting and DNS devolution is also enabled, DNS clients use the DNS devolution level that you specify. + +If you disable this policy setting or do not configure it, DNS clients use the default devolution level of two provided that DNS devolution is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Primary DNS suffix devolution level* +- GP name: *DNS_DomainNameDevolutionLevel* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_IdnEncoding** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether the DNS client should convert internationalized domain names (IDNs) to Punycode when the computer is on non-domain networks with no WINS servers configured. + +If this policy setting is enabled, IDNs are not converted to Punycode. + +If this policy setting is disabled, or if this policy setting is not configured, IDNs are converted to Punycode when the computer is on non-domain networks with no WINS servers configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off IDN encoding* +- GP name: *DNS_IdnEncoding* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_IdnMapping** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether the DNS client should convert internationalized domain names (IDNs) to the Nameprep form, a canonical Unicode representation of the string. + +If this policy setting is enabled, IDNs are converted to the Nameprep form. + +If this policy setting is disabled, or if this policy setting is not configured, IDNs are not converted to the Nameprep form. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IDN mapping* +- GP name: *DNS_IdnMapping* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_NameServer** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting defines the DNS servers to which a computer sends queries when it attempts to resolve names. This policy setting supersedes the list of DNS servers configured locally and those configured using DHCP. + +To use this policy setting, click Enabled, and then enter a space-delimited list of IP addresses in the available field. To use this policy setting, you must enter at least one IP address. + +If you enable this policy setting, the list of DNS servers is applied to all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied list of DNS servers, if configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DNS servers* +- GP name: *DNS_NameServer* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that responses from link local name resolution protocols received over a network interface that is higher in the binding order are preferred over DNS responses from network interfaces lower in the binding order. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT). + +If you enable this policy setting, responses from link local protocols will be preferred over DNS responses if the local responses are from a network with a higher binding order. + +If you disable this policy setting, or if you do not configure this policy setting, then DNS responses from networks lower in the binding order will be preferred over responses from link local protocols received from networks higher in the binding order. + +> [!NOTE] +> This policy setting is applicable only if the turn off smart multi-homed name resolution policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prefer link local responses over DNS when received over a network with higher precedence* +- GP name: *DNS_PreferLocalResponsesOverLowerOrderDns* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + + +
+ + +**ADMX_DnsClient/DNS_PrimaryDnsSuffix** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the primary DNS suffix used by computers in DNS name registration and DNS name resolution. + +To use this policy setting, click Enabled and enter the entire primary DNS suffix you want to assign. For example: microsoft.com. + +> [!IMPORTANT] +> In order for changes to this policy setting to be applied on computers that receive it, you must restart Windows. + +If you enable this policy setting, it supersedes the primary DNS suffix configured in the DNS Suffix and NetBIOS Computer Name dialog box using the System control panel. + +You can use this policy setting to prevent users, including local administrators, from changing the primary DNS suffix. + +If you disable this policy setting, or if you do not configure this policy setting, each computer uses its local primary DNS suffix, which is usually the DNS name of Active Directory domain to which it is joined. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Primary DNS suffix* +- GP name: *DNS_PrimaryDnsSuffix* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_RegisterAdapterName** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if a computer performing dynamic DNS registration will register A and PTR resource records with a concatenation of its computer name and a connection-specific DNS suffix, in addition to registering these records with a concatenation of its computer name and the primary DNS suffix. + +By default, a DNS client performing dynamic DNS registration registers A and PTR resource records with a concatenation of its computer name and the primary DNS suffix. For example, a computer name of mycomputer and a primary DNS suffix of microsoft.com will be registered as: mycomputer.microsoft.com. + +If you enable this policy setting, a computer will register A and PTR resource records with its connection-specific DNS suffix, in addition to the primary DNS suffix. This applies to all network connections used by computers that receive this policy setting. + +For example, with a computer name of mycomputer, a primary DNS suffix of microsoft.com, and a connection specific DNS suffix of VPNconnection, a computer will register A and PTR resource records for mycomputer.VPNconnection and mycomputer.microsoft.com when this policy setting is enabled. + +Important: This policy setting is ignored on a DNS client computer if dynamic DNS registration is disabled. + +If you disable this policy setting, or if you do not configure this policy setting, a DNS client computer will not register any A and PTR resource records using a connection-specific DNS suffix. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Register DNS records with connection-specific DNS suffix* +- GP name: *DNS_RegisterAdapterName* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_RegisterReverseLookup** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if DNS client computers will register PTR resource records. + +By default, DNS clients configured to perform dynamic DNS registration will attempt to register PTR resource record only if they successfully registered the corresponding A resource record. + +If you enable this policy setting, registration of PTR records will be determined by the option that you choose under Register PTR records. + +To use this policy setting, click Enabled, and then select one of the following options from the drop-down list: + +- Do not register: Computers will not attempt to register PTR resource records +- Register: Computers will attempt to register PTR resource records even if registration of the corresponding A records was not successful. +- Register only if A record registration succeeds: Computers will attempt to register PTR resource records only if registration of the corresponding A records was successful. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use locally configured settings. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Register PTR records* +- GP name: *DNS_RegisterReverseLookup* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_RegistrationEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if DNS dynamic update is enabled. Computers configured for DNS dynamic update automatically register and update their DNS resource records with a DNS server. + +If you enable this policy setting, or you do not configure this policy setting, computers will attempt to use dynamic DNS registration on all network connections that have connection-specific dynamic DNS registration enabled. For a dynamic DNS registration to be enabled on a network connection, the connection-specific configuration must allow dynamic DNS registration, and this policy setting must not be disabled. + +If you disable this policy setting, computers may not use dynamic DNS registration for any of their network connections, regardless of the configuration for individual network connections. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Dynamic update* +- GP name: *DNS_RegistrationEnabled* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_RegistrationOverwritesInConflict** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether dynamic updates should overwrite existing resource records that contain conflicting IP addresses. + +This policy setting is designed for computers that register address (A) resource records in DNS zones that do not use Secure Dynamic Updates. Secure Dynamic Update preserves ownership of resource records and does not allow a DNS client to overwrite records that are registered by other computers. + +During dynamic update of resource records in a zone that does not use Secure Dynamic Updates, an A resource record might exist that associates the client's host name with an IP address different than the one currently in use by the client. By default, the DNS client attempts to replace the existing A resource record with an A resource record that has the client's current IP address. + +If you enable this policy setting or if you do not configure this policy setting, DNS clients maintain their default behavior and will attempt to replace conflicting A resource records during dynamic update. + +If you disable this policy setting, existing A resource records that contain conflicting IP addresses will not be replaced during a dynamic update, and an error will be recorded in Event Viewer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Replace addresses in conflicts* +- GP name: *DNS_RegistrationOverwritesInConflict* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_RegistrationRefreshInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the interval used by DNS clients to refresh registration of A and PTR resource. This policy setting only applies to computers performing dynamic DNS updates. + +Computers configured to perform dynamic DNS registration of A and PTR resource records periodically reregister their records with DNS servers, even if the record has not changed. This reregistration is required to indicate to DNS servers that records are current and should not be automatically removed (scavenged) when a DNS server is configured to delete stale records. + +> [!WARNING] +> If record scavenging is enabled on the zone, the value of this policy setting should never be longer than the value of the DNS zone refresh interval. Configuring the registration refresh interval to be longer than the refresh interval of the DNS zone might result in the undesired deletion of A and PTR resource records. + +To specify the registration refresh interval, click Enabled and then enter a value of 1800 or greater. The value that you specify is the number of seconds to use for the registration refresh interval. For example, 1800 seconds is 30 minutes. + +If you enable this policy setting, registration refresh interval that you specify will be applied to all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied setting. By default, client computers configured with a static IP address attempt to update their DNS resource records once every 24 hours and DHCP clients will attempt to update their DNS resource records when a DHCP lease is granted or renewed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Registration refresh interval* +- GP name: *DNS_RegistrationRefreshInterval* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_RegistrationTtl** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the value of the time to live (TTL) field in A and PTR resource records that are registered by computers to which this policy setting is applied. + +To specify the TTL, click Enabled and then enter a value in seconds (for example, 900 is 15 minutes). + +If you enable this policy setting, the TTL value that you specify will be applied to DNS resource records registered for all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the TTL settings specified in DNS. By default, the TTL is 1200 seconds (20 minutes). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *TTL value for A and PTR records* +- GP name: *DNS_RegistrationTtl* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_SearchList** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the DNS suffixes to attach to an unqualified single-label name before submission of a DNS query for that name. + +An unqualified single-label name contains no dots. The name "example" is a single-label name. This is different from a fully qualified domain name such as "example.microsoft.com." + +Client computers that receive this policy setting will attach one or more suffixes to DNS queries for a single-label name. For example, a DNS query for the single-label name "example" will be modified to "example.microsoft.com" before sending the query to a DNS server if this policy setting is enabled with a suffix of "microsoft.com." + +To use this policy setting, click Enabled, and then enter a string value representing the DNS suffixes that should be appended to single-label names. You must specify at least one suffix. Use a comma-delimited string, such as "microsoft.com,serverua.microsoft.com,office.microsoft.com" to specify multiple suffixes. + +If you enable this policy setting, one DNS suffix is attached at a time for each query. If a query is unsuccessful, a new DNS suffix is added in place of the failed suffix, and this new query is submitted. The values are used in the order they appear in the string, starting with the leftmost value and proceeding to the right until a query is successful or all suffixes are tried. + +If you disable this policy setting, or if you do not configure this policy setting, the primary DNS suffix and network connection-specific DNS suffixes are appended to the unqualified queries. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DNS suffix search list* +- GP name: *DNS_SearchList* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_SmartMultiHomedNameResolution** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that a multi-homed DNS client should optimize name resolution across networks. The setting improves performance by issuing parallel DNS, link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT) queries across all networks. In the event that multiple positive responses are received, the network binding order is used to determine which response to accept. + +If you enable this policy setting, the DNS client will not perform any optimizations. DNS queries will be issued across all networks first. LLMNR queries will be issued if the DNS queries fail, followed by NetBT queries if LLMNR queries fail. + +If you disable this policy setting, or if you do not configure this policy setting, name resolution will be optimized when issuing DNS, LLMNR and NetBT queries. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off smart multi-homed name resolution* +- GP name: *DNS_SmartMultiHomedNameResolution* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_SmartProtocolReorder** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that the DNS client should prefer responses from link local name resolution protocols on non-domain networks over DNS responses when issuing queries for flat names. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT). + +If you enable this policy setting, the DNS client will prefer DNS responses, followed by LLMNR, followed by NetBT for all networks. + +If you disable this policy setting, or if you do not configure this policy setting, the DNS client will prefer link local responses for flat name queries on non-domain networks. + +> [!NOTE] +> This policy setting is applicable only if the turn off smart multi-homed name resolution policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off smart protocol reordering* +- GP name: *DNS_SmartProtocolReorder* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_UpdateSecurityLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the security level for dynamic DNS updates. + +To use this policy setting, click Enabled and then select one of the following values: + +- Unsecure followed by secure - computers send secure dynamic updates only when nonsecure dynamic updates are refused. +- Only unsecure - computers send only nonsecure dynamic updates. +- Only secure - computers send only secure dynamic updates. + +If you enable this policy setting, computers that attempt to send dynamic DNS updates will use the security level that you specify in this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use local settings. By default, DNS clients attempt to use unsecured dynamic update first. If an unsecured update is refused, clients try to use secure update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Update security level* +- GP name: *DNS_UpdateSecurityLevel* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_UpdateTopLevelDomainZones** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if computers may send dynamic updates to zones with a single label name. These zones are also known as top-level domain zones, for example: "com." + +By default, a DNS client that is configured to perform dynamic DNS update will update the DNS zone that is authoritative for its DNS resource records unless the authoritative zone is a top-level domain or root zone. + +If you enable this policy setting, computers send dynamic updates to any zone that is authoritative for the resource records that the computer needs to update, except the root zone. + +If you disable this policy setting, or if you do not configure this policy setting, computers do not send dynamic updates to the root zone or top-level domain zones that are authoritative for the resource records that the computer needs to update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Update top level domain zones* +- GP name: *DNS_UpdateTopLevelDomainZones* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/DNS_UseDomainNameDevolution** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if the DNS client performs primary DNS suffix devolution during the name resolution process. + +With devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name. + +The DNS client appends DNS suffixes to the single-label, unqualified domain name based on the state of the Append primary and connection specific DNS suffixes radio button and Append parent suffixes of the primary DNS suffix check box on the DNS tab in Advanced TCP/IP Settings for the Internet Protocol (TCP/IP) Properties dialog box. + +Devolution is not enabled if a global suffix search list is configured using Group Policy. + +If a global suffix search list is not configured, and the Append primary and connection specific DNS suffixes radio button is selected, the DNS client appends the following names to a single-label name when it sends DNS queries: + +The primary DNS suffix, as specified on the Computer Name tab of the System control panel. + +Each connection-specific DNS suffix, assigned either through DHCP or specified in the DNS suffix for this connection box on the DNS tab in the Advanced TCP/IP Settings dialog box for each connection. + +For example, when a user submits a query for a single-label name such as "example," the DNS client attaches a suffix such as "microsoft.com" resulting in the query "example.microsoft.com," before sending the query to a DNS server. + +If a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server. + +For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix cannot be devolved beyond a devolution level of two. The devolution level can be configured using the primary DNS suffix devolution level policy setting. The default devolution level is two. + +If you enable this policy setting, or if you do not configure this policy setting, DNS clients attempt to resolve single-label names using concatenations of the single-label name to be resolved and the devolved primary DNS suffix. + +If you disable this policy setting, DNS clients do not attempt to resolve names that are concatenations of the single-label name to be resolved and the devolved primary DNS suffix. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Primary DNS suffix devolution* +- GP name: *DNS_UseDomainNameDevolution* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
+ + +**ADMX_DnsClient/Turn_Off_Multicast** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that link local multicast name resolution (LLMNR) is disabled on client computers. + +LLMNR is a secondary name resolution protocol. With LLMNR, queries are sent using multicast over a local network link on a single subnet from a client computer to another client computer on the same subnet that also has LLMNR enabled. LLMNR does not require a DNS server or DNS client configuration, and provides name resolution in scenarios in which conventional DNS name resolution is not possible. + +If you enable this policy setting, LLMNR will be disabled on all available network adapters on the client computer. + +If you disable this policy setting, or you do not configure this policy setting, LLMNR will be enabled on all available network adapters. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off multicast name resolution* +- GP name: *Turn_Off_Multicast* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md new file mode 100644 index 0000000000..b964fbde10 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md @@ -0,0 +1,200 @@ +--- +title: Policy CSP - ADMX_EventForwarding +description: Policy CSP - ADMX_EventForwarding +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/17/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EventForwarding + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_EventForwarding policies + +
+
+ ADMX_EventForwarding/ForwarderResourceUsage +
+
+ ADMX_EventForwarding/SubscriptionManager +
+
+ + +
+ + +**ADMX_EventForwarding/ForwarderResourceUsage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls resource usage for the forwarder (source computer) by controlling the events/per second sent to the Event Collector. + +If you enable this policy setting, you can control the volume of events sent to the Event Collector by the source computer. This may be required in high volume environments. + +If you disable or do not configure this policy setting, forwarder resource usage is not specified. + +This setting applies across all subscriptions for the forwarder (source computer). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure forwarder resource usage* +- GP name: *MaxForwardingRate* +- GP path: *Windows Components/Event Forwarding* +- GP ADMX file name: *EventForwarding.admx* + + + +
+ +
+ + +**ADMX_EventForwarding/SubscriptionManager** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure the server address, refresh interval, and issuer certificate authority (CA) of a target Subscription Manager. + +If you enable this policy setting, you can configure the Source Computer to contact a specific FQDN (Fully Qualified Domain Name) or IP Address and request subscription specifics. + +Use the following syntax when using the HTTPS protocol: + +``` syntax + +Server=https://:5986/wsman/SubscriptionManager/WEC,Refresh=,IssuerCA=. +``` + +When using the HTTP protocol, use port 5985. + +If you disable or do not configure this policy setting, the Event Collector computer will not be specified. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure target Subscription Manager* +- GP name: *SubscriptionManager* +- GP path: *Windows Components/Event Forwarding* +- GP ADMX file name: *EventForwarding.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From dc77103db01606a2f07e39866930192be66bad27 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 17 Aug 2020 16:41:24 -0700 Subject: [PATCH 33/66] Fixed build warning --- .../client-management/mdm/policy-csp-admx-ciphersuiteorder.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index 3e28f47950..7c64c3a7a9 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -84,7 +84,7 @@ If you enable this policy setting, SSL cipher suites are prioritized in the orde If you disable or do not configure this policy setting, default cipher suite order is used. -For information about supported cipher Suites, see [Cipher Suites in TLS/SSL (Schannel SSP)](http://go.microsoft.com/fwlink/?LinkId=517265). +For information about supported cipher Suites, see [Cipher Suites in TLS/SSL (Schannel SSP)](https://go.microsoft.com/fwlink/?LinkId=517265). > [!TIP] From 072f857ec90fd3708c021b5d704f5f3732601b28 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 17 Aug 2020 16:46:35 -0700 Subject: [PATCH 34/66] minor update --- .../client-management/mdm/policy-csp-admx-ciphersuiteorder.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index 7c64c3a7a9..3088951d88 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -84,7 +84,7 @@ If you enable this policy setting, SSL cipher suites are prioritized in the orde If you disable or do not configure this policy setting, default cipher suite order is used. -For information about supported cipher Suites, see [Cipher Suites in TLS/SSL (Schannel SSP)](https://go.microsoft.com/fwlink/?LinkId=517265). +For information about supported cipher suites, see [Cipher Suites in TLS/SSL (Schannel SSP)](https://go.microsoft.com/fwlink/?LinkId=517265). > [!TIP] From 856f2226cbf920aaa9c745c8402573eac1cf8854 Mon Sep 17 00:00:00 2001 From: damabe Date: Mon, 17 Aug 2020 22:29:17 -0700 Subject: [PATCH 35/66] Update short descriptions for SEO improvement --- windows/client-management/mdm/policy-csp-taskmanager.md | 2 +- windows/client-management/mdm/policy-csp-taskscheduler.md | 2 +- windows/client-management/mdm/policy-csp-textinput.md | 2 +- .../client-management/mdm/policy-csp-timelanguagesettings.md | 2 +- windows/client-management/mdm/policy-csp-troubleshooting.md | 2 +- windows/client-management/mdm/policy-csp-update.md | 2 +- windows/client-management/mdm/policy-csp-userrights.md | 2 +- windows/client-management/mdm/policy-csp-wifi.md | 2 +- .../mdm/policy-csp-windowsconnectionmanager.md | 2 +- .../mdm/policy-csp-windowsdefendersecuritycenter.md | 2 +- windows/client-management/mdm/policy-csp-windowsinkworkspace.md | 2 +- windows/client-management/mdm/policy-csp-windowslogon.md | 2 +- windows/client-management/mdm/policy-csp-windowspowershell.md | 2 +- windows/client-management/mdm/policy-csp-wirelessdisplay.md | 2 +- windows/client-management/mdm/policy-ddf-file.md | 2 +- windows/client-management/mdm/policymanager-csp.md | 2 +- windows/client-management/mdm/proxy-csp.md | 2 +- windows/client-management/mdm/reboot-csp.md | 2 +- windows/client-management/mdm/registry-csp.md | 2 +- windows/client-management/mdm/registry-ddf-file.md | 2 +- 20 files changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index 9787467c21..ce84398393 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -1,6 +1,6 @@ --- title: Policy CSP - TaskManager -description: Policy CSP - TaskManager +description: Learn how to use the Policy CSP - TaskManager setting to determine whether non-administrators can use Task Manager to end tasks. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index 44a8f08bdd..ab6ec4d46c 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -1,6 +1,6 @@ --- title: Policy CSP - TaskScheduler -description: Policy CSP - TaskScheduler +description: Learn how to use the Policy CSP - TaskScheduler setting to determine whether the specific task is enabled (1) or disabled (0). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index e1799a0c16..99360d692b 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -1,6 +1,6 @@ --- title: Policy CSP - TextInput -description: Policy CSP - TextInput +description: The Policy CSP - TextInput setting allows the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index d029929145..8ef9349148 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -1,6 +1,6 @@ --- title: Policy CSP - TimeLanguageSettings -description: Learn which TimeLanguageSettings policies are supported for your edition of Windows. +description: Learn to use the Policy CSP - TimeLanguageSettings setting to specify the time zone to be applied to the device. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index 881b9b3a43..c7862d0866 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Troubleshooting -description: Policy CSP - Troubleshooting +description: The Policy CSP - Troubleshooting setting allows IT admins to configure how to apply recommended troubleshooting for known problems on the devices in their domains. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index d9187a1854..38e9dd4066 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Update -description: Manage a range of active hours for when update reboots are not scheduled. +description: The Policy CSP - Update allows the IT admin, when used with Update/ActiveHoursStart, to manage a range of active hours where update reboots aren't scheduled. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 73f3dfd843..df12efd32b 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -1,6 +1,6 @@ --- title: Policy CSP - UserRights -description: Policy CSP - UserRights +description: Learn how user rights are assigned for user accounts or groups, and how the name of the policy defines the user right in question. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 770316e0bc..db63da7a5a 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Wifi -description: Policy CSP - Wifi +description: Learn how the Policy CSP - Wifi setting allows or disallows the device to automatically connect to Wi-Fi hotspots. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index 4cbed0f5f3..4f89b78bcf 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WindowsConnectionManager -description: Policy CSP - WindowsConnectionManager +description: The Policy CSP - WindowsConnectionManager setting prevents computers from connecting to a domain based network and a non-domain based network simultaneously. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index d2c74ba941..a4cd3536f0 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WindowsDefenderSecurityCenter -description: Policy CSP - WindowsDefenderSecurityCenter +description: Learn how to use the Policy CSP - WindowsDefenderSecurityCenter setting to display the Account protection area in Windows Defender Security Center. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index bc97e2e774..e60269d795 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WindowsInkWorkspace -description: Policy CSP - WindowsInkWorkspace +description: Learn to use the Policy CSP - WindowsInkWorkspace setting to specify whether to allow the user to access the ink workspace. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index d3793a4bb7..c7ccb54106 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WindowsLogon -description: Policy CSP - WindowsLogon +description: Use the Policy CSP - WindowsLogon setting to control whether a device automatically signs in and locks the last interactive user after the system restarts. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index cc4f87b917..b60def1361 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WindowsPowerShell -description: Policy CSP - WindowsPowerShell +description: Use the Policy CSP - WindowsPowerShell setting to enable logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index eb74f99772..3aff9aac6c 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WirelessDisplay -description: Policy CSP - WirelessDisplay +description: Use the Policy CSP - WirelessDisplay setting to turn off the Wireless Display multicast DNS service advertisement from a Wireless Display receiver. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 7a522ee312..27c1aceaf0 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -1,6 +1,6 @@ --- title: Policy DDF file -description: Policy DDF file +description: Learn about the OMA DM device description framework (DDF) for the Policy configuration service provider. ms.assetid: D90791B5-A772-4AF8-B058-5D566865AF8D ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policymanager-csp.md b/windows/client-management/mdm/policymanager-csp.md index ad4bb24be7..656e292b4e 100644 --- a/windows/client-management/mdm/policymanager-csp.md +++ b/windows/client-management/mdm/policymanager-csp.md @@ -1,6 +1,6 @@ --- title: PolicyManager CSP -description: PolicyManager CSP +description: Learn how PolicyManager CSP is deprecated. For Windows 10 devices you should use Policy CSP, which replaces PolicyManager CSP. ms.assetid: 048427b1-6024-4660-8660-bd91c583f7f9 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/proxy-csp.md b/windows/client-management/mdm/proxy-csp.md index cced09bc2b..c1d9034fe8 100644 --- a/windows/client-management/mdm/proxy-csp.md +++ b/windows/client-management/mdm/proxy-csp.md @@ -1,6 +1,6 @@ --- title: PROXY CSP -description: PROXY CSP +description: Learn how the PROXY configuration service provider (CSP) is used to configure proxy connections. ms.assetid: 9904d44c-4a1e-4ae7-a6c7-5dba06cb16ce ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index e7cb92b9c4..d906bca3da 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -1,6 +1,6 @@ --- title: Reboot CSP -description: Reboot CSP +description: Learn how the Reboot configuration service provider (CSP) is used to configure reboot settings. ms.assetid: 4E3F1225-BBAD-40F5-A1AB-FF221B6BAF48 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/registry-csp.md b/windows/client-management/mdm/registry-csp.md index 38bd56ba6d..4978cc70e0 100644 --- a/windows/client-management/mdm/registry-csp.md +++ b/windows/client-management/mdm/registry-csp.md @@ -1,6 +1,6 @@ --- title: Registry CSP -description: Registry CSP +description: In this article, learn how to use the Registry configuration service provider (CSP) to update registry settings. ms.assetid: 2307e3fd-7b61-4f00-94e1-a639571f2c9d ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/registry-ddf-file.md b/windows/client-management/mdm/registry-ddf-file.md index 164f8d4a66..6b6bc9c191 100644 --- a/windows/client-management/mdm/registry-ddf-file.md +++ b/windows/client-management/mdm/registry-ddf-file.md @@ -1,6 +1,6 @@ --- title: Registry DDF file -description: Registry DDF file +description: Learn about the OMA DM device description framework (DDF) for the Registry configuration service provider (CSP). ms.assetid: 29b5cc07-f349-4567-8a77-387d816a9d15 ms.reviewer: manager: dansimp From 76422150f356a700dec97db7923904bb1d984f78 Mon Sep 17 00:00:00 2001 From: TimShererWithAquent Date: Tue, 18 Aug 2020 15:22:58 -0700 Subject: [PATCH 36/66] Edit descriptions for SEO. --- .../windows-firewall/planning-domain-isolation-zones.md | 2 +- .../windows-firewall/planning-gpo-deployment.md | 2 +- ...planning-group-policy-deployment-for-your-isolation-zones.md | 2 +- .../windows-firewall/planning-network-access-groups.md | 2 +- .../windows-firewall/planning-server-isolation-zones.md | 2 +- .../planning-settings-for-a-basic-firewall-policy.md | 2 +- .../threat-protection/windows-firewall/planning-the-gpos.md | 2 +- ...nning-your-windows-firewall-with-advanced-security-design.md | 2 +- .../windows-firewall/procedures-used-in-this-guide.md | 2 +- .../protect-devices-from-unwanted-network-traffic.md | 2 +- ...ire-encryption-when-accessing-sensitive-network-resources.md | 2 +- .../windows-firewall/restrict-access-to-only-trusted-devices.md | 2 +- .../threat-protection/windows-firewall/server-isolation-gpos.md | 2 +- .../windows-firewall/server-isolation-policy-design-example.md | 2 +- .../windows-firewall/server-isolation-policy-design.md | 2 +- .../verify-that-network-traffic-is-authenticated.md | 2 +- .../windows-firewall-with-advanced-security-deployment-guide.md | 2 +- .../windows-firewall-with-advanced-security-design-guide.md | 2 +- windows/whats-new/get-started-with-1709.md | 2 +- windows/whats-new/whats-new-windows-10-version-1809.md | 2 +- 20 files changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md index f37a7ebdea..5a7fcb44a2 100644 --- a/windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md +++ b/windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md @@ -1,6 +1,6 @@ --- title: Planning Domain Isolation Zones (Windows 10) -description: Planning Domain Isolation Zones +description: Learn how to use information you have gathered to make decisions about isolation zones for your environment in Windows Defender Firewall with Advanced Security. ms.assetid: 70bc7c52-91f0-4a0d-a64a-69d3ea1c6d05 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md b/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md index 188f4f2556..f9140ddefd 100644 --- a/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md +++ b/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md @@ -1,6 +1,6 @@ --- title: Planning GPO Deployment (Windows 10) -description: Planning GPO Deployment +description: Learn how to use a combination of security group filtering and WMI filtering to provide the most flexible options for applying GPOs devices in Active Directory. ms.assetid: b38adfb1-1371-4227-a887-e6d118809de1 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md index 991bdcec0d..001626eb9e 100644 --- a/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md +++ b/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md @@ -1,6 +1,6 @@ --- title: Planning Group Policy Deployment for Your Isolation Zones (Windows 10) -description: Planning Group Policy Deployment for Your Isolation Zones +description: Learn how to plan a group policy deployment for your isolation zones after you determine the best logical design of your isolation environment. ms.assetid: ea7c0acd-af28-4347-9d4a-4801b470557c ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/planning-network-access-groups.md b/windows/security/threat-protection/windows-firewall/planning-network-access-groups.md index 3043878e04..5cb6ff075c 100644 --- a/windows/security/threat-protection/windows-firewall/planning-network-access-groups.md +++ b/windows/security/threat-protection/windows-firewall/planning-network-access-groups.md @@ -1,6 +1,6 @@ --- title: Planning Network Access Groups (Windows 10) -description: Planning Network Access Groups +description: Learn how to implement a network access group for users and devices that can access an isolated server in Windows Defender Firewall with Advanced Security. ms.assetid: 56ea1717-1731-4a5d-b277-5a73eb86feb0 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md index f42eca057b..b1af014fa5 100644 --- a/windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md +++ b/windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md @@ -1,6 +1,6 @@ --- title: Planning Server Isolation Zones (Windows 10) -description: Planning Server Isolation Zones +description: Learn how to restrict access to a server to approved users by using a server isolation zone in Windows Defender Firewall with Advanced Security. ms.assetid: 5f63c929-589e-4b64-82ea-515d62765b7b ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md b/windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md index 8138bd8ee1..5a8cd1a017 100644 --- a/windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md +++ b/windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md @@ -1,6 +1,6 @@ --- title: Planning Settings for a Basic Firewall Policy (Windows 10) -description: Planning Settings for a Basic Firewall Policy +description: Learn how to design a basic policy for Windows Defender Firewall with Advanced Security, the settings and rules that enforce your requirements on devices. ms.assetid: 4c90df5a-3cbc-4b85-924b-537c2422d735 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/planning-the-gpos.md b/windows/security/threat-protection/windows-firewall/planning-the-gpos.md index 78c49adcca..80b776ca44 100644 --- a/windows/security/threat-protection/windows-firewall/planning-the-gpos.md +++ b/windows/security/threat-protection/windows-firewall/planning-the-gpos.md @@ -1,6 +1,6 @@ --- title: Planning the GPOs (Windows 10) -description: Planning the GPOs +description: Learn about planning Group Policy Objects for your isolation zones in Windows Defender Firewall with Advanced Security, after you design the zone layout. ms.assetid: 11949ca3-a11c-4a16-b297-0862432eb5b4 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md b/windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md index 6992965186..2caa25566a 100644 --- a/windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md +++ b/windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md @@ -1,6 +1,6 @@ --- title: Planning Your Windows Defender Firewall with Advanced Security Design (Windows 10) -description: Planning Your Windows Defender Firewall with Advanced Security Design +description: After you gather the relevant information, select the design or combination of designs for Windows Defender Firewall with Advanced Security in your environment. ms.assetid: f3ac3d49-ef4c-4f3c-a16c-e107284e169f ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md b/windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md index 2d37487be2..643f41ab14 100644 --- a/windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md +++ b/windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md @@ -1,6 +1,6 @@ --- title: Procedures Used in This Guide (Windows 10) -description: Procedures Used in This Guide +description: Refer to this summary of procedures for Windows Defender Firewall with Advanced Security from checklists in this guide. ms.assetid: 45c0f549-e4d8-45a3-a600-63e2a449e178 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md b/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md index a3ca3c4b6e..9f6879ad17 100644 --- a/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md +++ b/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md @@ -1,6 +1,6 @@ --- title: Protect Devices from Unwanted Network Traffic (Windows 10) -description: Protect Devices from Unwanted Network Traffic +description: Learn how running a host-based firewall on every device in your organization can help protect against attacks as part of a defense-in-depth security strategy. ms.assetid: 307d2b38-e8c4-4358-ae16-f2143af965dc ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md index 4f5c2b1cb0..a79aedce9d 100644 --- a/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md +++ b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md @@ -1,6 +1,6 @@ --- title: Require Encryption When Accessing Sensitive Network Resources (Windows 10) -description: Require Encryption When Accessing Sensitive Network Resources +description: Windows Defender Firewall with Advanced Security allows you to require that all network traffic in an isolated domain be encrypted. ms.assetid: da980d30-a68b-4e2a-ba63-94726355ce6f ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md index cbdd8e51d9..1204db7e48 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md @@ -1,6 +1,6 @@ --- title: Restrict Access to Only Trusted Devices (Windows 10) -description: Restrict Access to Only Trusted Devices +description: Windows Defender Firewall with Advanced Security enables you to isolate devices you trust and restrict access of untrusted devices to trusted devices. ms.assetid: bc1f49a4-7d54-4857-8af9-b7c79f47273b ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-gpos.md b/windows/security/threat-protection/windows-firewall/server-isolation-gpos.md index dbffb1b8f1..8286d47f26 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-gpos.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-gpos.md @@ -1,6 +1,6 @@ --- title: Server Isolation GPOs (Windows 10) -description: Server Isolation GPOs +description: Learn about required GPOs for isolation zones and how many server isolation zones you need in Windows Defender Firewall with Advanced Security. ms.assetid: c97b1f2f-51d8-4596-b38a-8a3f6f706be4 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md index b93e884682..daba2b5e2c 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md @@ -1,6 +1,6 @@ --- title: Server Isolation Policy Design Example (Windows 10) -description: Server Isolation Policy Design Example +description: Learn about server isolation policy design in Windows Defender Firewall with Advanced Security by referring to this example of a fictitious company. ms.assetid: 337e5f6b-1ec5-4b83-bee5-d0aea1fa5fc6 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md index 1eeea3dc76..68a19552fd 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md @@ -1,6 +1,6 @@ --- title: Server Isolation Policy Design (Windows 10) -description: Server Isolation Policy Design +description: Learn about server isolation policy design, where you assign servers to a zone that allows access only to members of an approved network access group. ms.assetid: f93f65cd-b863-461e-ab5d-a620fd962c9a ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md b/windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md index 7cbeb23689..a7178f39fe 100644 --- a/windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md +++ b/windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md @@ -1,6 +1,6 @@ --- title: Verify That Network Traffic Is Authenticated (Windows 10) -description: Verify That Network Traffic Is Authenticated +description: Learn how to confirm that network traffic is being protected by IPsec authentication after you configure your domain isolation rule to require authentication. ms.assetid: cc1fb973-aedf-4074-ad4a-7376b24f03d2 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md index d91723c3d2..c476c2ea19 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md @@ -1,6 +1,6 @@ --- title: Deploy Windows Defender Firewall with Advanced Security (Windows 10) -description: Windows Defender Firewall with Advanced Security Deployment Guide +description: Learn how to use the Windows Defender Firewall with Advanced Security MMC snap-in to control access to the device from the network. ms.assetid: 56b51b97-1c38-481e-bbda-540f1216ad56 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md index 70c8912478..fc1efb0573 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md @@ -1,6 +1,6 @@ --- title: Windows Defender Firewall with Advanced Security Design Guide (Windows 10) -description: Windows Defender Firewall with Advanced Security Design Guide +description: Learn about common goals for using Windows Defender Firewall with Advanced Security to choose or create a design for deploying the firewall in your enterprise. ms.assetid: 5c631389-f232-4b95-9e48-ec02b8677d51 ms.reviewer: ms.author: dansimp diff --git a/windows/whats-new/get-started-with-1709.md b/windows/whats-new/get-started-with-1709.md index 2b22a606de..4a419e9cd1 100644 --- a/windows/whats-new/get-started-with-1709.md +++ b/windows/whats-new/get-started-with-1709.md @@ -1,6 +1,6 @@ --- title: Get started with Windows 10, version 1709 -description: Learn the dos and don'ts for getting started with Windows 10, version 1709. +description: Learn about features, review requirements, and plan your deployment Windows 10, version 1709, including IT Pro content, release information, and update history. keywords: ["get started", "windows 10", "fall creators update", "1709"] ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/whats-new/whats-new-windows-10-version-1809.md b/windows/whats-new/whats-new-windows-10-version-1809.md index ba0090d559..309ce421df 100644 --- a/windows/whats-new/whats-new-windows-10-version-1809.md +++ b/windows/whats-new/whats-new-windows-10-version-1809.md @@ -1,7 +1,7 @@ --- title: What's new in Windows 10, version 1809 ms.reviewer: -description: New and updated features in Windows 10, version 1809 +description: Learn about features for Windows 10, version 1809, including features and fixes included in previous cumulative updates to Windows 10, version 1803. keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 October 2018 Update"] ms.prod: w10 ms.mktglfcycl: deploy From 714509b135149044db52e9c1aadb5ab6654fe217 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 18 Aug 2020 17:19:05 -0700 Subject: [PATCH 37/66] Added Conf policies --- .../mdm/policy-csp-admx-appcompat.md | 36 +- .../mdm/policy-csp-admx-ciphersuiteorder.md | 8 +- .../mdm/policy-csp-admx-com.md | 197 ++ .../mdm/policy-csp-admx-conf.md | 2431 +++++++++++++++++ 4 files changed, 2650 insertions(+), 22 deletions(-) create mode 100644 windows/client-management/mdm/policy-csp-admx-com.md create mode 100644 windows/client-management/mdm/policy-csp-admx-conf.md diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md index da013a6e46..cd7a091fd2 100644 --- a/windows/client-management/mdm/policy-csp-admx-appcompat.md +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -24,39 +24,39 @@ manager: dansimp
- ADMX_AppCompat/AppCompatPrevent16BitMach + ADMX_AppCompat/AppCompatPrevent16BitMach
- ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage + ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage
- ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry + ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry
- ADMX_AppCompat/AppCompatTurnOffSwitchBack + ADMX_AppCompat/AppCompatTurnOffSwitchBack
- ADMX_AppCompat/AppCompatTurnOffEngine + ADMX_AppCompat/AppCompatTurnOffEngine
- ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1 + ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1
- ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2 + ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2
- ADMX_AppCompat/AppCompatTurnOffUserActionRecord + ADMX_AppCompat/AppCompatTurnOffUserActionRecord
- ADMX_AppCompat/AppCompatTurnOffProgramInventory + ADMX_AppCompat/AppCompatTurnOffProgramInventory
@@ -65,7 +65,7 @@ manager: dansimp
-**ADMX_AppCompat/AppCompatPrevent16BitMach** +**ADMX_AppCompat/AppCompatPrevent16BitMach** @@ -142,7 +142,7 @@ ADMX Info:
-**ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage** +**ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage**
@@ -213,7 +213,7 @@ ADMX Info:
-**ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry** +**ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry**
@@ -288,7 +288,7 @@ ADMX Info:
-**ADMX_AppCompat/AppCompatTurnOffSwitchBack** +**ADMX_AppCompat/AppCompatTurnOffSwitchBack**
@@ -364,7 +364,7 @@ ADMX Info:
-**ADMX_AppCompat/AppCompatTurnOffEngine** +**ADMX_AppCompat/AppCompatTurnOffEngine**
@@ -442,7 +442,7 @@ ADMX Info:
-**ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1** +**ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1**
@@ -509,7 +509,7 @@ ADMX Info:
-**ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2** +**ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2**
@@ -583,7 +583,7 @@ ADMX Info:
-**ADMX_AppCompat/AppCompatTurnOffUserActionRecord** +**ADMX_AppCompat/AppCompatTurnOffUserActionRecord**
@@ -656,7 +656,7 @@ ADMX Info:
-**ADMX_AppCompat/AppCompatTurnOffProgramInventory** +**ADMX_AppCompat/AppCompatTurnOffProgramInventory**
diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index 3088951d88..306231cdcf 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -24,10 +24,10 @@ manager: dansimp
- ADMX_CipherSuiteOrder/SSLCipherSuiteOrder + ADMX_CipherSuiteOrder/SSLCipherSuiteOrder
- ADMX_CipherSuiteOrder/SSLCurveOrder + ADMX_CipherSuiteOrder/SSLCurveOrder
@@ -35,7 +35,7 @@ manager: dansimp
-**ADMX_CipherSuiteOrder/SSLCipherSuiteOrder** +**ADMX_CipherSuiteOrder/SSLCipherSuiteOrder**
@@ -108,7 +108,7 @@ ADMX Info:
-**ADMX_CipherSuiteOrder/SSLCurveOrder** +**ADMX_CipherSuiteOrder/SSLCurveOrder**
diff --git a/windows/client-management/mdm/policy-csp-admx-com.md b/windows/client-management/mdm/policy-csp-admx-com.md new file mode 100644 index 0000000000..ff361f80d2 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-com.md @@ -0,0 +1,197 @@ +--- +title: Policy CSP - ADMX_COM +description: Policy CSP - ADMX_COM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/18/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_COM + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_COM policies + +
+
+ ADMX_COM/AppMgmt_COM_SearchForCLSID_1 +
+
+ ADMX_COM/AppMgmt_COM_SearchForCLSID_2 +
+
+ + +
+ + +**ADMX_COM/AppMgmt_COM_SearchForCLSID_1** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. + +Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components. + +If you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it is found, downloads it. The resulting searches might make some programs start or run slowly. + +If you disable or do not configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Download missing COM components* +- GP name: *COMClassStore* +- GP path: *System* +- GP ADMX file name: *COM.admx* + + + +
+ +
+ + +**ADMX_COM/AppMgmt_COM_SearchForCLSID_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. + +Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components. + +If you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it is found, downloads it. The resulting searches might make some programs start or run slowly. + +If you disable or do not configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Download missing COM components* +- GP name: *COMClassStore* +- GP path: *System* +- GP ADMX file name: *COM.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-conf.md b/windows/client-management/mdm/policy-csp-admx-conf.md new file mode 100644 index 0000000000..931927fe44 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-conf.md @@ -0,0 +1,2431 @@ +--- +title: Policy CSP - ADMX_Conf +description: Policy CSP - ADMX_Conf +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 08/18/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Conf + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## Policy CSP - ADMX_Conf + +
+
+ ADMX_Conf/AllowPersistAutoAcceptCalls + +
+
+ ADMX_Conf/DisableAdvCallingButton + +
+
+ ADMX_Conf/DisableAppSharing + +
+
+ ADMX_Conf/DisableAudioPage + +
+
+ ADMX_Conf/DisableChat + +
+
+ ADMX_Conf/DisableGeneralPage + +
+
+ ADMX_Conf/DisableNewWhiteboard + +
+
+ ADMX_Conf/DisableOldWhiteboard + +
+
+ ADMX_Conf/DisableRDS + +
+
+ ADMX_Conf/DisableSecurityPage + +
+
+ ADMX_Conf/DisableVideoPage + +
+
+ ADMX_Conf/EnableAutoConfiguration + +
+
+ ADMX_Conf/PreventAddingNewILS + +
+
+ ADMX_Conf/PreventAudio + +
+
+ ADMX_Conf/PreventAutoAccept + +
+
+ ADMX_Conf/PreventChangeDirectSound + +
+
+ ADMX_Conf/PreventChangingCallMode + +
+
+ ADMX_Conf/PreventDirectoryServices + +
+
+ ADMX_Conf/PreventFullDuplex + +
+
+ ADMX_Conf/PreventGrantingControl + +
+
+ ADMX_Conf/PreventReceivingFiles + +
+
+ ADMX_Conf/PreventReceivingVideo + +
+
+ ADMX_Conf/PreventSendingFiles + +
+
+ ADMX_Conf/PreventSendingVideo + +
+
+ ADMX_Conf/PreventSharing + +
+
+ ADMX_Conf/PreventSharingCMDPrompt + +
+
+ ADMX_Conf/PreventSharingDesktop + +
+
+ ADMX_Conf/PreventSharingExplorer + +
+
+ ADMX_Conf/PreventSharingTrueColor + +
+
+ ADMX_Conf/PreventWebDirectory + +
+
+ ADMX_Conf/RestrictFTSendSize + +
+
+ ADMX_Conf/SetAVThroughput + +
+
+ ADMX_Conf/SetIntranetSupport + +
+
+ ADMX_Conf/SetSecurityOptions + +
+
+ + +
+ + +**ADMX_Conf/AllowPersistAutoAcceptCalls** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting makes the automatic acceptance of incoming calls persistent. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow persisting automatic acceptance of Calls* +- GP name: *PersistAutoAcceptCalls* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/DisableAdvCallingButton** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables the Advanced Calling button on the General Options page. Users will not then be able to change the call placement method and the servers used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable the Advanced Calling button* +- GP name: *NoAdvancedCalling* +- GP path: *Windows Components/NetMeeting/Options Page* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/DisableAppSharing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables the application sharing feature of NetMeeting completely. Users will not be able to host or view shared applications. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable application Sharing* +- GP name: *NoAppSharing* +- GP path: *Windows Components/NetMeeting/Application Sharing* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/DisableAudioPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting hides the Audio page of the Tools Options dialog. Users will not then be able to change audio settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the Audio page* +- GP name: *NoAudioPage* +- GP path: *Windows Components/NetMeeting/Options Page* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/DisableChat** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables the Chat feature of NetMeeting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Chat* +- GP name: *NoChat* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/DisableGeneralPage** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting hides the General page of the Tools Options dialog. Users will not then be able to change personal identification and bandwidth settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the General page* +- GP name: *NoGeneralPage* +- GP path: *Windows Components/NetMeeting/Options Page* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/DisableNewWhiteboard** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables the T.126 whiteboard feature of NetMeeting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Whiteboard* +- GP name: *NoNewWhiteBoard* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/DisableOldWhiteboard** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables the 2.x whiteboard feature of NetMeeting. + +The 2.x whiteboard is available for compatibility with older versions of NetMeeting only. + +Deployers who do not need it can save bandwidth by disabling it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable NetMeeting 2.x Whiteboard* +- GP name: *NoOldWhiteBoard* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/DisableRDS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables the remote desktop sharing feature of NetMeeting. Users will not be able to set it up or use it for controlling their computers remotely. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable remote Desktop Sharing* +- GP name: *NoRDS* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/DisableSecurityPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting hides the Security page of the Tools Options dialog. Users will not then be able to change call security and authentication settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the Security page* +- GP name: *NoSecurityPage* +- GP path: *Windows Components/NetMeeting/Options Page* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/DisableVideoPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting hides the Video page of the Tools Options dialog. Users will not then be able to change video settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the Video page* +- GP name: *NoVideoPage* +- GP path: *Windows Components/NetMeeting/Options Page* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/EnableAutoConfiguration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures NetMeeting to download settings for users each time it starts. + +The settings are downloaded from the URL listed in the "Configuration URL:" text box. + +Group Policy based settings have precedence over any conflicting settings set by downloading them from this URL. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Automatic Configuration* +- GP name: *Use AutoConfig* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventAddingNewILS** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from adding directory (ILS) servers to the list of those they can use for placing calls. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent adding Directory servers* +- GP name: *NoAddingDirectoryServers* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventAudio** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables the audio feature of NetMeeting. Users will not be able to send or receive audio. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Audio* +- GP name: *NoAudio* +- GP path: *Windows Components/NetMeeting/Audio & Video* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventAutoAccept** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from turning on automatic acceptance of incoming calls. + +This ensures that others cannot call and connect to NetMeeting when the user is not present. + +This policy is recommended when deploying NetMeeting to run always. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent automatic acceptance of Calls* +- GP name: *NoAutoAcceptCalls* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventChangeDirectSound** + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents prevents user from changing the DirectSound audio setting. + +DirectSound provides much better audio quality, but older audio hardware may not support it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing DirectSound Audio setting* +- GP name: *NoChangeDirectSound* +- GP path: *Windows Components/NetMeeting/Audio & Video* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventChangingCallMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents prevents users from changing the way calls are placed, either directly or via a gatekeeper server. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing Call placement method* +- GP name: *NoChangingCallMode* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventDirectoryServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables the directory feature of NetMeeting. + +Users will not logon to a directory (ILS) server when NetMeeting starts. Users will also not be able to view or place calls via a NetMeeting directory. + +This policy is for deployers who have their own location or calling schemes such as a Web site or an address book. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Directory services* +- GP name: *NoDirectoryServices* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventFullDuplex** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables full duplex mode audio. Users will not be able to listen to incoming audio while speaking into the microphone. Older audio hardware does not perform well when in full duplex mode. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable full duplex Audio* +- GP name: *NoFullDuplex* +- GP path: *Windows Components/NetMeeting/Audio & Video* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventGrantingControl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from allowing others in a conference to control what they have shared. This enforces a read-only mode; the other participants cannot change the data in the shared application. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Control* +- GP name: *NoAllowControl* +- GP path: *Windows Components/NetMeeting/Application Sharing* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventReceivingFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from receiving files from others in a conference. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent receiving files* +- GP name: *NoReceivingFiles* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventReceivingVideo** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from receiving video. Users will still be able to send video provided they have the hardware. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent receiving Video* +- GP name: *NoReceivingVideo* +- GP path: *Windows Components/NetMeeting/Audio & Video* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventSendingFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from sending files to others in a conference. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent sending files* +- GP name: *NoSendingFiles* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventSendingVideo** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from sending video if they have the hardware. Users will still be able to receive video from others. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent sending Video* +- GP name: *NoSendingVideo* +- GP path: *Windows Components/NetMeeting/Audio & Video* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventSharing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from sharing anything themselves. They will still be able to view shared applications/desktops from others. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Sharing* +- GP name: *NoSharing* +- GP path: *Windows Components/NetMeeting/Application Sharing* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventSharingCMDPrompt** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from sharing command prompts. This prevents users from inadvertently sharing out applications, since command prompts can be used to launch other applications. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Sharing Command Prompts* +- GP name: *NoSharingDosWindows* +- GP path: *Windows Components/NetMeeting/Application Sharing* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventSharingDesktop** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from sharing the whole desktop. They will still be able to share individual applications. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Desktop Sharing* +- GP name: *NoSharingDesktop* +- GP path: *Windows Components/NetMeeting/Application Sharing* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventSharingExplorer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from sharing Explorer windows. This prevents users from inadvertently sharing out applications, since Explorer windows can be used to launch other applications. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Sharing Explorer windows* +- GP name: *NoSharingExplorer* +- GP path: *Windows Components/NetMeeting/Application Sharing* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventSharingTrueColor** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from sharing applications in true color. True color sharing uses more bandwidth in a conference. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Application Sharing in true color* +- GP name: *NoTrueColorSharing* +- GP path: *Windows Components/NetMeeting/Application Sharing* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/PreventWebDirectory** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from viewing directories as Web pages in a browser. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent viewing Web directory* +- GP name: *NoWebDirectory* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/RestrictFTSendSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting limits the size of files users can send to others in a conference. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the size of sent files* +- GP name: *MaxFileSendSize* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/SetAVThroughput** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting limits the bandwidth audio and video will consume when in a conference. This setting will guide NetMeeting to choose the right formats and send rate so that the bandwidth is limited. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the bandwidth of Audio and Video* +- GP name: *MaximumBandwidth* +- GP path: *Windows Components/NetMeeting/Audio & Video* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/SetIntranetSupport** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting sets the URL NetMeeting will display when the user chooses the Help Online Support command. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set the intranet support Web page* +- GP name: *IntranetSupportURL* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +
+ + +**ADMX_Conf/SetSecurityOptions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting sets the level of security for both outgoing and incoming NetMeeting calls. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Call Security options* +- GP name: *CallSecurity* +- GP path: *Windows Components/NetMeeting* +- GP ADMX file name: *Conf.admx* + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file From ebed1692a4eab7fd4d403e68a1a6d96a9047584a Mon Sep 17 00:00:00 2001 From: TimShererWithAquent Date: Wed, 19 Aug 2020 07:49:35 -0700 Subject: [PATCH 38/66] Additional edits. --- .../windows-firewall/planning-gpo-deployment.md | 2 +- ...planning-group-policy-deployment-for-your-isolation-zones.md | 2 +- .../windows-firewall-with-advanced-security-deployment-guide.md | 2 +- windows/whats-new/get-started-with-1709.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md b/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md index f9140ddefd..831200cf48 100644 --- a/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md +++ b/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md @@ -1,6 +1,6 @@ --- title: Planning GPO Deployment (Windows 10) -description: Learn how to use a combination of security group filtering and WMI filtering to provide the most flexible options for applying GPOs devices in Active Directory. +description: Learn how to use security group filtering and WMI filtering to provide the most flexible options for applying GPOs to devices in Active Directory. ms.assetid: b38adfb1-1371-4227-a887-e6d118809de1 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md index 001626eb9e..22f031c902 100644 --- a/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md +++ b/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md @@ -1,6 +1,6 @@ --- title: Planning Group Policy Deployment for Your Isolation Zones (Windows 10) -description: Learn how to plan a group policy deployment for your isolation zones after you determine the best logical design of your isolation environment. +description: Learn how to plan a group policy deployment for your isolation zones after you determine the best logical design for your isolation environment. ms.assetid: ea7c0acd-af28-4347-9d4a-4801b470557c ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md index c476c2ea19..0509ef4e2e 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md @@ -1,6 +1,6 @@ --- title: Deploy Windows Defender Firewall with Advanced Security (Windows 10) -description: Learn how to use the Windows Defender Firewall with Advanced Security MMC snap-in to control access to the device from the network. +description: Use this guide to deploy Windows Defender Firewall with Advanced Security for your enterprise to help protect devices and data that they share across a network. ms.assetid: 56b51b97-1c38-481e-bbda-540f1216ad56 ms.reviewer: ms.author: dansimp diff --git a/windows/whats-new/get-started-with-1709.md b/windows/whats-new/get-started-with-1709.md index 4a419e9cd1..c2522f3e4c 100644 --- a/windows/whats-new/get-started-with-1709.md +++ b/windows/whats-new/get-started-with-1709.md @@ -1,6 +1,6 @@ --- title: Get started with Windows 10, version 1709 -description: Learn about features, review requirements, and plan your deployment Windows 10, version 1709, including IT Pro content, release information, and update history. +description: Learn about features, review requirements, and plan your deployment of Windows 10, version 1709, including IT Pro content, release information, and history. keywords: ["get started", "windows 10", "fall creators update", "1709"] ms.prod: w10 ms.mktglfcycl: deploy From e458ac527235d1c3f285e594a8fbeca0834e13d2 Mon Sep 17 00:00:00 2001 From: Caroline Gitonga Date: Wed, 19 Aug 2020 23:42:15 +0300 Subject: [PATCH 39/66] Add adl.windows.com --- windows/privacy/manage-windows-1909-endpoints.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/privacy/manage-windows-1909-endpoints.md b/windows/privacy/manage-windows-1909-endpoints.md index 92f03d2111..791d04718c 100644 --- a/windows/privacy/manage-windows-1909-endpoints.md +++ b/windows/privacy/manage-windows-1909-endpoints.md @@ -117,6 +117,7 @@ The following methodology was used to derive these network endpoints: |||HTTP|*.windowsupdate.com| ||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTP|*.delivery.mp.microsoft.com| |||HTTPS/TLS v1.2|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP|adl.windows.com| ||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly.|HTTPS/TLS v1.2|tsfe.trafficshaping.dsp.mp.microsoft.com| ## Other Windows 10 editions From e3916033d246fec61ac98b3a6911f5a662d7c256 Mon Sep 17 00:00:00 2001 From: Caroline Gitonga Date: Wed, 19 Aug 2020 23:50:21 +0300 Subject: [PATCH 40/66] Add - windows.policies.live.net --- windows/privacy/manage-windows-1909-endpoints.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/privacy/manage-windows-1909-endpoints.md b/windows/privacy/manage-windows-1909-endpoints.md index 92f03d2111..ba34b2d47b 100644 --- a/windows/privacy/manage-windows-1909-endpoints.md +++ b/windows/privacy/manage-windows-1909-endpoints.md @@ -96,6 +96,7 @@ The following methodology was used to derive these network endpoints: |||TLS v1.2|*g.live.com| |||HTTPS|oneclient.sfx.ms| |||HTTPS| logincdn.msauth.net| +|||HTTP| windows.policies.live.net| |Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| |||TLS v1.2|settings-win.data.microsoft.com| |Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| @@ -117,6 +118,7 @@ The following methodology was used to derive these network endpoints: |||HTTP|*.windowsupdate.com| ||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTP|*.delivery.mp.microsoft.com| |||HTTPS/TLS v1.2|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP|adl.windows.com| ||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly.|HTTPS/TLS v1.2|tsfe.trafficshaping.dsp.mp.microsoft.com| ## Other Windows 10 editions From 0820f6e01fb3960b91a48de18f8775cdf11e933c Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Thu, 20 Aug 2020 17:03:05 +0300 Subject: [PATCH 41/66] Update configure-endpoints-vdi.md Minor modification to ensure customers don't miss the step. I've seen cases where customers did not copy the CMD file and only pasted in the PS1 file and this caused onboarding to fial. --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 32e7e448f6..771c2b866b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -63,7 +63,7 @@ The following steps will guide you through onboarding VDI devices and will highl 1. Click **Download package** and save the .zip file. -2. Copy the extracted files from the .zip into `golden/master` image under the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. You should have a folder called `WindowsDefenderATPOnboardingPackage` containing the file `WindowsDefenderATPOnboardingScript.cmd`. +2. Copy all the extracted files from the .zip into `golden/master` image under the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. You should have a folder called `WindowsDefenderATPOnboardingPackage` containing the file `WindowsDefenderATPOnboardingScript.cmd`. >[!NOTE] >If you don't see the `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup` folder, it might be hidden. You'll need to choose the **Show hidden files and folders** option from file explorer. From a5cbd9f97a20c25200ea1ea4f4a1077e5313fb3a Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Thu, 20 Aug 2020 10:37:15 -0700 Subject: [PATCH 42/66] network section added --- windows/whats-new/whats-new-windows-10-version-2004.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/whats-new/whats-new-windows-10-version-2004.md b/windows/whats-new/whats-new-windows-10-version-2004.md index 8518f5c4af..c9092135cd 100644 --- a/windows/whats-new/whats-new-windows-10-version-2004.md +++ b/windows/whats-new/whats-new-windows-10-version-2004.md @@ -124,6 +124,12 @@ The following [Delivery Optimization](https://docs.microsoft.com/windows/deploym - Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we have created a new policy that enables admins to opt devices out of the built-in safeguard holds. - Update less: Last year, we [changed update installation policies](https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency/#l2jH7KMkOkfcWdBs.97) for Windows 10 to only target devices running a feature update version that is nearing end of service. As a result, many devices are only updating once a year. To enable all devices to make the most of this policy change, and to prevent confusion, we have removed deferrals from the Windows Update settings **Advanced Options** page starting on Windows 10, version 2004. If you wish to continue leveraging deferrals, you can use local Group Policy (**Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview builds and Feature Updates are received** or **Select when Quality Updates are received**). For more information about this change, see [Simplified Windows Update settings for end users](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplified-windows-update-settings-for-end-users/ba-p/1497215). +## Networking + +Windows now supports the latest Wi-Fi standards with [Wi-Fi 6 and WPA3](https://support.microsoft.com/help/4562575/windows-10-faster-more-secure-wifi). Wi-Fi 6 gives you better wireless coverage and performance with added security. WPA3 provides improved Wi-Fi security and secures open networks. + +In this release, Tunnel Extensible Authentication Protocol (TEAP) has been added as an authentication method to allow chaining together multiple credentials into a single EAP transaction. TEAP networks can be configured by [enterprise policy](https://docs.microsoft.com/openspecs/windows_protocols/ms-gpwl/94cf6896-c28e-4865-b12a-d83ee38cd3ea). + ## Virtualization ### Windows Sandbox From 4aec4bc09db7027e419a464fa1ed12b31631f71f Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 20 Aug 2020 10:45:39 -0700 Subject: [PATCH 43/66] tags causing loc issues. replacing w --- .../active-directory-accounts.md | 8 +- .../access-control/local-accounts.md | 14 +- .../credential-guard-requirements.md | 4 +- .../hello-feature-pin-reset.md | 2 +- .../hello-how-it-works-provisioning.md | 2 +- .../hello-hybrid-aadj-sso-base.md | 4 +- .../remote-credential-guard.md | 2 +- .../how-user-account-control-works.md | 2 +- .../bitlocker/bitlocker-basic-deployment.md | 30 +- .../bitlocker-group-policy-settings.md | 734 +++---- ...ve-encryption-tools-to-manage-bitlocker.md | 28 +- ...nd-storage-area-networks-with-bitlocker.md | 38 +- .../app-behavior-with-wip.md | 14 +- .../create-wip-policy-using-configmgr.md | 20 +- .../enlightened-microsoft-apps-and-wip.md | 2 +- .../limitations-with-wip.md | 26 +- .../testing-scenarios-for-wip.md | 56 +- .../threat-protection/auditing/event-4626.md | 2 +- .../threat-protection/auditing/event-4670.md | 2 +- .../threat-protection/auditing/event-4672.md | 2 +- .../threat-protection/auditing/event-4673.md | 62 +- .../threat-protection/auditing/event-4674.md | 66 +- .../threat-protection/auditing/event-4688.md | 4 +- .../threat-protection/auditing/event-4741.md | 2 +- .../threat-protection/auditing/event-4742.md | 2 +- .../threat-protection/auditing/event-4907.md | 2 +- .../threat-protection/auditing/event-5140.md | 2 +- .../threat-protection/auditing/event-5142.md | 2 +- .../threat-protection/auditing/event-5143.md | 2 +- .../threat-protection/auditing/event-5144.md | 2 +- ...tion-based-protection-of-code-integrity.md | 4 +- .../threat-protection/fips-140-validation.md | 1876 ++++++++--------- .../intelligence/support-scams.md | 2 +- .../configure-arcsight.md | 6 +- .../event-error-codes.md | 6 +- ...defender-smartscreen-available-settings.md | 96 +- ...iew-of-threat-mitigations-in-windows-10.md | 6 +- ...-the-health-of-windows-10-based-devices.md | 4 +- .../create-a-rule-for-packaged-apps.md | 20 +- .../document-your-application-list.md | 4 +- .../plan-for-applocker-policy-management.md | 2 +- ...ements-for-deploying-applocker-policies.md | 4 +- ...stand-applocker-policy-design-decisions.md | 2 +- .../applocker/what-is-applocker.md | 4 +- 44 files changed, 1587 insertions(+), 1587 deletions(-) diff --git a/windows/security/identity-protection/access-control/active-directory-accounts.md b/windows/security/identity-protection/access-control/active-directory-accounts.md index dabc7f749b..2ae163cea6 100644 --- a/windows/security/identity-protection/access-control/active-directory-accounts.md +++ b/windows/security/identity-protection/access-control/active-directory-accounts.md @@ -470,7 +470,7 @@ Each default local account in Active Directory has a number of account settings

Account is trusted for delegation

-

Lets a service running under this account perform operations on behalf of other user accounts on the network. A service running under a user account (also known as a service account) that is trusted for delegation can impersonate a client to gain access to resources, either on the computer where the service is running or on other computers. For example, in a forest that is set to the Windows Server 2003 functional level, this setting is found on the Delegation tab. It is available only for accounts that have been assigned service principal names (SPNs), which are set by using the setspn command from Windows Support Tools. This setting is security-sensitive and should be assigned cautiously.

+

Lets a service running under this account perform operations on behalf of other user accounts on the network. A service running under a user account (also known as a service account) that is trusted for delegation can impersonate a client to gain access to resources, either on the computer where the service is running or on other computers. For example, in a forest that is set to the Windows Server 2003 functional level, this setting is found on the Delegation tab. It is available only for accounts that have been assigned service principal names (SPNs), which are set by using the setspn command from Windows Support Tools. This setting is security-sensitive and should be assigned cautiously.

Account is sensitive and cannot be delegated

@@ -480,7 +480,7 @@ Each default local account in Active Directory has a number of account settings

Use DES encryption types for this account

Provides support for the Data Encryption Standard (DES). DES supports multiple levels of encryption, including Microsoft Point-to-Point Encryption (MPPE) Standard (40-bit and 56-bit), MPPE standard (56-bit), MPPE Strong (128-bit), Internet Protocol security (IPSec) DES (40-bit), IPSec 56-bit DES, and IPSec Triple DES (3DES).

-Note

DES is not enabled by default in Windows Server operating systems starting with Windows Server 2008 R2, nor in Windows client operating systems starting with Windows 7. For these operating systems, computers will not use DES-CBC-MD5 or DES-CBC-CRC cipher suites by default. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see Hunting down DES in order to securely deploy Kerberos.

+Note

DES is not enabled by default in Windows Server operating systems starting with Windows Server 2008 R2, nor in Windows client operating systems starting with Windows 7. For these operating systems, computers will not use DES-CBC-MD5 or DES-CBC-CRC cipher suites by default. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see Hunting down DES in order to securely deploy Kerberos.

@@ -656,8 +656,8 @@ In this procedure, the workstations are dedicated to domain administrators. By s -

Windows Update Setting

-

Configuration

+

Windows Update Setting

+

Configuration

Allow Automatic Updates immediate installation

diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index 7e7c2236cd..56e4f2edf2 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -297,9 +297,9 @@ The following table shows the Group Policy and registry settings that are used t -

No.

-

Setting

-

Detailed Description

+

No.

+

Setting

+

Detailed Description

@@ -334,7 +334,7 @@ The following table shows the Group Policy and registry settings that are used t

3

Registry key

-

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

+

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

@@ -444,9 +444,9 @@ The following table shows the Group Policy settings that are used to deny networ -

No.

-

Setting

-

Detailed Description

+

No.

+

Setting

+

Detailed Description

diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 7f5c4ffe62..25d125585e 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -98,7 +98,7 @@ The following tables describe baseline protections, plus protections for improve | Hardware: **Trusted Platform Module (TPM)** |  **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.
[TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations) | A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. | | Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)| UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. | | Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).| UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. | -| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise

Important:
Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard.

|Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. | +| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise

Important:
Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard.

|Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. | > [!IMPORTANT] > The following tables list additional qualifications for improved security. We strongly recommend meeting the additional qualifications to significantly strengthen the level of security that Windows Defender Credential Guard can provide. @@ -133,5 +133,5 @@ The following table lists qualifications for Windows 10, version 1703, which are | Protections for Improved Security | Description | Security Benefits |---|---|---| -| Firmware: **VBS enablement of NX protection for UEFI runtime services** | **Requirements**:
• VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable.
• UEFI runtime service must meet these requirements:
    - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
    - PE sections need to be page-aligned in memory (not required for in non-volatile storage).
    - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
        - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
        - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.

Notes:
• This only applies to UEFI runtime service memory, and not UEFI boot service memory.
• This protection is applied by VBS on OS page tables.


Please also note the following:
• Do not use sections that are both writeable and executable
• Do not attempt to directly modify executable system memory
• Do not use dynamic code | • Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware. | +| Firmware: **VBS enablement of NX protection for UEFI runtime services** | **Requirements**:
• VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable.
• UEFI runtime service must meet these requirements:
    - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
    - PE sections need to be page-aligned in memory (not required for in non-volatile storage).
    - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
        - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
        - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.

Notes:
• This only applies to UEFI runtime service memory, and not UEFI boot service memory.
• This protection is applied by VBS on OS page tables.


Please also note the following:
• Do not use sections that are both writeable and executable
• Do not attempt to directly modify executable system memory
• Do not use dynamic code | • Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware. | | Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](https://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features. | • Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware.
• Blocks additional security attacks against SMM. | diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 33a9c450e1..7a92ed864a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -84,7 +84,7 @@ To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 1. In the **Custom OMA-URI Settings** blade, Click **Add**. 1. In the **Add Row** blade, type **PIN Reset Settings** in the **Name** field. In the **OMA-URI** field, type **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery** where *tenant ID* is your Azure Active Directory tenant ID from step 2. 1. Select **Boolean** from the **Data type** list and select **True** from the **Value** list. -1. Click **OK** to save the row configuration. Click **OK** to close the Custom OMA-URI Settings blade. Click **Create to save the profile. +1. Click **OK** to save the row configuration. Click **OK** to close the Custom OMA-URI Settings blade. Click **Create to save the profile. #### Assign the PIN Reset Device configuration profile using Microsoft Intune diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index f220db21f6..0fb161ccb5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -17,7 +17,7 @@ ms.reviewer: --- # Windows Hello for Business Provisioning -Applies to: +Applies to: - Windows 10 Windows Hello for Business provisioning enables a user to enroll a new, strong, two-factor credential that they can use for passwordless authentication. Provisioning experience vary based on: diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index ae11903279..8ea5343d35 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -187,7 +187,7 @@ The web server is ready to host the CRL distribution point. Now, configure the 1. On the issuing certificate authority, sign-in as a local administrator. Start the **Certificate Authority** console from **Administrative Tools**. 2. In the navigation pane, right-click the name of the certificate authority and click **Properties** 3. Click **Extensions**. On the **Extensions** tab, select **CRL Distribution Point (CDP)** from the **Select extension** list. -4. On the **Extensions** tab, click **Add**. Type http://crl.[domainname]/cdp/ in **location**. For example, ** or ** (do not forget the trailing forward slash). +4. On the **Extensions** tab, click **Add**. Type http://crl.[domainname]/cdp/ in **location**. For example, ** or ** (do not forget the trailing forward slash). ![CDP New Location dialog box](images/aadj/cdp-extension-new-location.png) 5. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. 6. Type **.crl** at the end of the text in **Location**. Click **OK**. @@ -225,7 +225,7 @@ The web server is ready to host the CRL distribution point. Now, configure the Validate your new CRL distribution point is working. -1. Open a web browser. Navigate to http://crl.[yourdomain].com/cdp. You should see two files created from publishing your new CRL. +1. Open a web browser. Navigate to http://crl.[yourdomain].com/cdp. You should see two files created from publishing your new CRL. ![Validate the new CRL](images/aadj/validate-cdp-using-browser.png) ### Reissue domain controller certificates diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 4e95da0531..373339ebcd 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -58,7 +58,7 @@ Use the following table to compare different Remote Desktop connection security | **Protection benefits** | Credentials on the server are not protected from Pass-the-Hash attacks. | User credentials remain on the client. An attacker can act on behalf of the user *only* when the session is ongoing | User logs on to the server as local administrator, so an attacker cannot act on behalf of the “domain user”. Any attack is local to the server | | **Version support** | The remote computer can run any Windows operating system | Both the client and the remote computer must be running **at least Windows 10, version 1607, or Windows Server 2016**. | The remote computer must be running **at least patched Windows 7 or patched Windows Server 2008 R2**.

For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](https://technet.microsoft.com/library/security/2871997.aspx). | | **Helps prevent**                    |      N/A          |
  • Pass-the-Hash
  • Use of a credential after disconnection
|
  • Pass-the-Hash
  • Use of domain identity during connection
| -| **Credentials supported from the remote desktop client device** |
  • Signed on credentials
  • Supplied credentials
  • Saved credentials
|