mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 11:53:37 +00:00
Merge branch 'master' into aljupudi-5489000-CSPconsistencysweep
This commit is contained in:
Alekhya Jupudi
GitHub
@ -18,9 +18,9 @@ ms.topic: article
|
|||||||
|
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
|
- Windows 10
|
||||||
|
- Windows 11
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
- Windows 11
|
|
||||||
|
|
||||||
Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users.
|
Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users.
|
||||||
|
|
||||||
|
|||||||
@ -21,7 +21,7 @@ This article includes general troubleshooting for 802.1X wireless and wired clie
|
|||||||
|
|
||||||
## Scenarios
|
## Scenarios
|
||||||
|
|
||||||
This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 through Windows 11 for clients, and Windows Server 2008 R2 through Windows Server 2012 R2 for NPS.
|
This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 through Windows 10 (and Windows 11) for clients, and Windows Server 2008 R2 through Windows Server 2012 R2 for NPS.
|
||||||
|
|
||||||
## Known issues
|
## Known issues
|
||||||
|
|
||||||
|
|||||||
@ -31,8 +31,7 @@ There are several reasons why a Windows-based computer may have problems during
|
|||||||
|
|
||||||
**1. PreBoot**
|
**1. PreBoot**
|
||||||
|
|
||||||
The PC’s firmware initiates a Power-On Self Test (POST) and loads firmware settings. This pre-boot process ends when a valid system disk is detected. Firmware reads the master boot record (MBR), and then starts Windows Boot
|
The PC’s firmware initiates a Power-On Self Test (POST) and loads firmware settings. This pre-boot process ends when a valid system disk is detected. Firmware reads the master boot record (MBR), and then starts Windows Boot Manager.
|
||||||
Manager.
|
|
||||||
|
|
||||||
**2. Windows Boot Manager**
|
**2. Windows Boot Manager**
|
||||||
|
|
||||||
|
|||||||
@ -21,7 +21,8 @@ ms.topic: article
|
|||||||
**Applies to**
|
**Applies to**
|
||||||
|
|
||||||
- Windows 10
|
- Windows 10
|
||||||
- Windows 11
|
- Windows 11
|
||||||
|
|
||||||
|
|
||||||
From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](/azure/active-directory/devices/concept-azure-ad-join). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics).
|
From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](/azure/active-directory/devices/concept-azure-ad-join). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics).
|
||||||
|
|
||||||
|
|||||||
@ -16,9 +16,9 @@ ms.topic: troubleshooting
|
|||||||
# Group Policy settings that apply only to Windows 10 Enterprise and Education Editions
|
# Group Policy settings that apply only to Windows 10 Enterprise and Education Editions
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
|
- Windows 10
|
||||||
|
- Windows 11
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
- Windows 11
|
|
||||||
|
|
||||||
In Windows 10, version 1607, the following Group Policy settings apply only to Windows 10 Enterprise and Windows 10 Education.
|
In Windows 10, version 1607, the following Group Policy settings apply only to Windows 10 Enterprise and Windows 10 Education.
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
---
|
---
|
||||||
title: Manage corporate devices (Windows)
|
title: Manage corporate devices
|
||||||
description: You can use the same management tools to manage all device types running Windows 10 or Windows 11 desktops, laptops, tablets, and phones.
|
description: You can use the same management tools to manage all device types running Windows 10 or Windows 11 desktops, laptops, tablets, and phones.
|
||||||
ms.assetid: 62D6710C-E59C-4077-9C7E-CE0A92DFC05D
|
ms.assetid: 62D6710C-E59C-4077-9C7E-CE0A92DFC05D
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
@ -30,13 +30,13 @@ You can use the same management tools to manage all device types running Windows
|
|||||||
|
|
||||||
| Topic | Description |
|
| Topic | Description |
|
||||||
| --- | --- |
|
| --- | --- |
|
||||||
| [Manage Windows 10 in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | Strategies for deploying and managing Windows 10, including deploying Windows 10 in a mixed environment |
|
| [Manage Windows 10 (and Windows 11) in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | Strategies for deploying and managing Windows 10 (and Windows 11), including deploying Windows 10 (and Windows 11) in a mixed environment |
|
||||||
| [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) | How to use Remote Desktop Connection to connect to an Azure AD-joined PC |
|
| [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) | How to use Remote Desktop Connection to connect to an Azure AD-joined PC |
|
||||||
| [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions) | Options to manage user experiences to provide a consistent and predictable experience for employees |
|
| [Manage Windows 10 (and Windows 11) and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions) | Options to manage user experiences to provide a consistent and predictable experience for employees |
|
||||||
| [New policies for Windows 10](new-policies-for-windows-10.md) | New Group Policy settings added in Windows 10 |
|
| [New policies for Windows 10 (and Windows 11)](new-policies-for-windows-10.md) | New Group Policy settings added in Windows 10 |
|
||||||
| [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education |
|
| [Group Policies that apply only to Windows Enterprise and Windows Education](group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education |
|
||||||
| [Changes to Group Policy settings for Start in Windows 10](/windows/configuration/changes-to-start-policies-in-windows-10) | Changes to the Group Policy settings that you use to manage Start |
|
| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 (and Windows 11) in their organizations |
|
||||||
| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 or Windows 11 in their organizations |
|
|
||||||
|
|
||||||
|
|
||||||
## Learn more
|
## Learn more
|
||||||
@ -47,13 +47,13 @@ You can use the same management tools to manage all device types running Windows
|
|||||||
|
|
||||||
[Microsoft Intune End User Enrollment Guide](/samples/browse/?redirectedfrom=TechNet-Gallery)
|
[Microsoft Intune End User Enrollment Guide](/samples/browse/?redirectedfrom=TechNet-Gallery)
|
||||||
|
|
||||||
[Azure AD Join on Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkId=616791)
|
[Azure AD Join on Windows 10 (and Windows 11) devices](https://go.microsoft.com/fwlink/p/?LinkId=616791)
|
||||||
|
|
||||||
[Azure AD support for Windows 10](https://go.microsoft.com/fwlink/p/?LinkID=615765)
|
[Azure AD support for Windows 10 (and Windows 11)](https://go.microsoft.com/fwlink/p/?LinkID=615765)
|
||||||
|
|
||||||
[Windows 10 and Azure Active Directory: Embracing the Cloud](https://go.microsoft.com/fwlink/p/?LinkId=615768)
|
[Windows 10 (and Windows 11) and Azure Active Directory: Embracing the Cloud](https://go.microsoft.com/fwlink/p/?LinkId=615768)
|
||||||
|
|
||||||
[How to manage Windows 10 devices using Intune](https://go.microsoft.com/fwlink/p/?LinkId=613620)
|
[How to manage Windows 10 (and Windows 11) devices using Intune](https://go.microsoft.com/fwlink/p/?LinkId=613620)
|
||||||
|
|
||||||
[Using Intune alone and with Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=613207)
|
[Using Intune alone and with Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=613207)
|
||||||
|
|
||||||
|
|||||||
@ -14,7 +14,6 @@ ms.topic: article
|
|||||||
|
|
||||||
# Manage Device Installation with Group Policy
|
# Manage Device Installation with Group Policy
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
|
|
||||||
- Windows 10
|
- Windows 10
|
||||||
@ -343,8 +342,8 @@ Getting the right device identifier to prevent it from being installed:
|
|||||||
> ClassGuid = {4d36e979-e325-11ce-bfc1-08002be10318}\
|
> ClassGuid = {4d36e979-e325-11ce-bfc1-08002be10318}\
|
||||||
> This class includes printers.
|
> This class includes printers.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> As mentioned before, preventing an entire Class could block you from using your system completely. Please make sure you understand which devices are going to be blocked when specifying a Class. For our scenario, there are other classes that relate to printers but before you apply them, make sure they are not blocking any other existing device that is crucial to your system.
|
> As mentioned before, preventing an entire Class could block you from using your system completely. Please make sure you understand which devices are going to be blocked when specifying a Class. For our scenario, there are other classes that relate to printers but before you apply them, make sure they are not blocking any other existing device that is crucial to your system.
|
||||||
|
|
||||||
Creating the policy to prevent all printers from being installed:
|
Creating the policy to prevent all printers from being installed:
|
||||||
|
|
||||||
@ -377,9 +376,9 @@ Creating the policy to prevent all printers from being installed:
|
|||||||
|
|
||||||
1. If you have not completed step #9 – follow these steps:
|
1. If you have not completed step #9 – follow these steps:
|
||||||
|
|
||||||
- Uninstall your printer: Device Manager > Printers > right click the Canon Printer > click “Uninstall device”.
|
1. Uninstall your printer: Device Manager > Printers > right click the Canon Printer > click “Uninstall device”.
|
||||||
- For USB printer – unplug and plug back the cable; for network device – make a search for the printer in the Windows Settings app.
|
1. For USB printer – unplug and plug back the cable; for network device – make a search for the printer in the Windows Settings app.
|
||||||
- You should not be able to reinstall the printer.
|
1. You should not be able to reinstall the printer.
|
||||||
|
|
||||||
2. If you completed step #9 above and restarted the machine, simply look for your printer under Device Manager or the Windows Settings app and see that it is no-longer available for you to use.
|
2. If you completed step #9 above and restarted the machine, simply look for your printer under Device Manager or the Windows Settings app and see that it is no-longer available for you to use.
|
||||||
|
|
||||||
|
|||||||
@ -14,11 +14,11 @@ ms.topic: article
|
|||||||
|
|
||||||
# Manage the Settings app with Group Policy
|
# Manage the Settings app with Group Policy
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
|
|
||||||
- Windows 10, Windows Server 2016
|
- Windows 10
|
||||||
- Windows 11
|
- Windows 11
|
||||||
|
- Windows Server 2016
|
||||||
|
|
||||||
You can now manage the pages that are shown in the Settings app by using Group Policy. When you use Group Policy to manage pages, you can hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely.
|
You can now manage the pages that are shown in the Settings app by using Group Policy. When you use Group Policy to manage pages, you can hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely.
|
||||||
To make use of the Settings App group policies on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update.
|
To make use of the Settings App group policies on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update.
|
||||||
|
|||||||
@ -68,7 +68,7 @@ First, you create a default user profile with the customizations that you want,
|
|||||||
|
|
||||||
1. At a command prompt, type the following command and press **ENTER**.
|
1. At a command prompt, type the following command and press **ENTER**.
|
||||||
|
|
||||||
```dos
|
```console
|
||||||
sysprep /oobe /reboot /generalize /unattend:unattend.xml
|
sysprep /oobe /reboot /generalize /unattend:unattend.xml
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -100,11 +100,11 @@ First, you create a default user profile with the customizations that you want,
|
|||||||
|
|
||||||
- If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path.
|
- If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location.
|
- If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
1. Click **OK** to copy the default user profile.
|
1. Click **OK** to copy the default user profile.
|
||||||
|
|
||||||
|
|||||||
@ -5,8 +5,8 @@ ms.author: dansimp
|
|||||||
ms.topic: article
|
ms.topic: article
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: manikadhiman
|
author: dansimp
|
||||||
ms.date: 06/02/2021
|
ms.date: 10/14/2021
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
manager: dansimp
|
manager: dansimp
|
||||||
---
|
---
|
||||||
@ -214,7 +214,7 @@ Requirements:
|
|||||||
|
|
||||||
If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain.
|
If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain.
|
||||||
|
|
||||||
6. Wait for the SYSVOL DFSR replication to be completed and then restart the Domain Controller for the policy to be available.
|
6. Wait for the SYSVOL DFSR replication to be completed for the policy to be available.
|
||||||
|
|
||||||
This procedure will work for any future version as well.
|
This procedure will work for any future version as well.
|
||||||
|
|
||||||
|
|||||||
@ -62,6 +62,36 @@ Required. Indicates whether this eUICC is physically present and active. Updated
|
|||||||
|
|
||||||
Supported operation is Get. Value type is boolean.
|
Supported operation is Get. Value type is boolean.
|
||||||
|
|
||||||
|
<a href="" id="euicc-ppr1allowed"></a>**_eUICC_/PPR1Allowed**
|
||||||
|
Profile Policy Rule 1 (PPR1) is required. Indicates whether the download of a profile with PPR1 is allowed. If the eUICC already has a profile (regardless of its origin and policy rules associated with it), the download of a profile with PPR1 is not allowed.
|
||||||
|
|
||||||
|
Supported operation is Get. Value type is boolean.
|
||||||
|
|
||||||
|
<a href="" id="euicc-ppr1alreadyset"></a>**_eUICC_/PPR1AlreadySet**
|
||||||
|
Required. Indicates whether the eUICC already has a profile with PPR1.
|
||||||
|
|
||||||
|
Supported operation is Get. Value type is boolean.
|
||||||
|
|
||||||
|
<a href="" id="euicc-downloadservers"></a>**_eUICC_/DownloadServers**
|
||||||
|
Interior node. Represents default SM-DP+ discovery requests.
|
||||||
|
|
||||||
|
Supported operation is Get.
|
||||||
|
|
||||||
|
<a href="" id="euicc-downloadservers-servername"></a>**_eUICC_/DownloadServers/_ServerName_**
|
||||||
|
Interior node. Optional. Node specifying the server name for a discovery operation. The node name is the fully qualified domain name of the SM-DP+ server that will be used for profile discovery. Creation of this subtree triggers a discovery request.
|
||||||
|
|
||||||
|
Supported operations are Add, Get, and Delete.
|
||||||
|
|
||||||
|
<a href="" id="euicc-downloadservers-servername-discoverystate"></a>**_eUICC_/DownloadServers/_ServerName_/DiscoveryState**
|
||||||
|
Required. Current state of the discovery operation for the parent ServerName (Requested = 1, Executing = 2, Completed = 3, Failed = 4). Queried by the CSP and only updated by the LPA.
|
||||||
|
|
||||||
|
Supported operation is Get. Value type is integer. Default value is 1.
|
||||||
|
|
||||||
|
<a href="" id="euicc-downloadservers-servername-autoenable"></a>**_eUICC_/DownloadServers/_ServerName_/AutoEnable**
|
||||||
|
Required. Indicates whether the discovered profile must be enabled automatically after install. This must be set by the MDM when the ServerName subtree is created.
|
||||||
|
|
||||||
|
Supported operations are Add, Get, and Replace. Value type is bool.
|
||||||
|
|
||||||
<a href="" id="euicc-profiles"></a>**_eUICC_/Profiles**
|
<a href="" id="euicc-profiles"></a>**_eUICC_/Profiles**
|
||||||
Interior node. Required. Represents all enterprise-owned profiles.
|
Interior node. Required. Represents all enterprise-owned profiles.
|
||||||
|
|
||||||
|
|||||||
@ -49,7 +49,7 @@ The XML below if for Windows 10, version 1803.
|
|||||||
<CIS />
|
<CIS />
|
||||||
</CaseSense>
|
</CaseSense>
|
||||||
<DFType>
|
<DFType>
|
||||||
<MIME>com.microsoft/1.1/MDM/eUICCs</MIME>
|
<MIME>com.microsoft/1.2/MDM/eUICCs</MIME>
|
||||||
</DFType>
|
</DFType>
|
||||||
</DFProperties>
|
</DFProperties>
|
||||||
<Node>
|
<Node>
|
||||||
@ -58,7 +58,7 @@ The XML below if for Windows 10, version 1803.
|
|||||||
<AccessType>
|
<AccessType>
|
||||||
<Get />
|
<Get />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<Description>Represents information associated with an eUICC. There is one subtree for each known eUICC, created by the Local Profile Assistant (LPA) when the eUICC is first seen. The node name is meaningful only to the LPA (which associates it with an eUICC ID (EID) in an implementation-specific manner, e.g., this could be a SHA-256 hash of the EID). The node name "Default" represents the currently active eUICC.</Description>
|
<Description>Represents information associated with an eUICC. There is one subtree for each known eUICC, created by the Local Profile Assistant (LPA) when the eUICC is first seen. The node name is the eUICC ID (EID). The node name "Default" represents the currently active eUICC.</Description>
|
||||||
<DFFormat>
|
<DFFormat>
|
||||||
<node />
|
<node />
|
||||||
</DFFormat>
|
</DFFormat>
|
||||||
@ -79,7 +79,7 @@ The XML below if for Windows 10, version 1803.
|
|||||||
<AccessType>
|
<AccessType>
|
||||||
<Get />
|
<Get />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<Description>Identifies an eUICC in an implementation-specific manner, e.g., this could be a SHA-256 hash of the EID.</Description>
|
<Description>The EID.</Description>
|
||||||
<DFFormat>
|
<DFFormat>
|
||||||
<chr />
|
<chr />
|
||||||
</DFFormat>
|
</DFFormat>
|
||||||
@ -118,6 +118,139 @@ The XML below if for Windows 10, version 1803.
|
|||||||
</DFType>
|
</DFType>
|
||||||
</DFProperties>
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>PPR1Allowed</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Indicates whether the download of a profile with PPR1 is allowed. If the eUICC already has a profile (regardless of its origin and policy rules associated with it), the download of a profile with PPR1 is not allowed.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<bool />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>PPR1AlreadySet</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Indicates whether the eUICC already has a profile with PPR1.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<bool />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>DownloadServers</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Represents default SM-DP+ discovery requests.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<node />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<DDFName></DDFName>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
<Node>
|
||||||
|
<NodeName></NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Add />
|
||||||
|
<Delete />
|
||||||
|
<Get />
|
||||||
|
<Replace />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Node specifying the server name for a discovery operation. The node name is the fully qualified domain name of the SM-DP+ server that will be used for profile discovery. Creation of this subtree triggers a discovery request.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<node />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<ZeroOrMore />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFTitle>ServerName</DFTitle>
|
||||||
|
<DFType>
|
||||||
|
<DDFName></DDFName>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
<Node>
|
||||||
|
<NodeName>DiscoveryState</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<DefaultValue>1</DefaultValue>
|
||||||
|
<Description>Current state of the discovery operation for the parent ServerName (Requested = 1, Executing = 2, Completed = 3, Failed = 4). Queried by the CSP and only updated by the LPA.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<int />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>AutoEnable</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Add />
|
||||||
|
<Get />
|
||||||
|
<Replace />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Indicates whether the discovered profile must be enabled automatically after install. This must be set by the MDM when the ServerName subtree is created.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<bool />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
</Node>
|
||||||
|
</Node>
|
||||||
<Node>
|
<Node>
|
||||||
<NodeName>Profiles</NodeName>
|
<NodeName>Profiles</NodeName>
|
||||||
<DFProperties>
|
<DFProperties>
|
||||||
@ -145,6 +278,7 @@ The XML below if for Windows 10, version 1803.
|
|||||||
<Add />
|
<Add />
|
||||||
<Delete />
|
<Delete />
|
||||||
<Get />
|
<Get />
|
||||||
|
<Replace />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<Description>Node representing an enterprise-owned eUICC profile. The node name is the ICCID of the profile (which is a unique identifier). Creation of this subtree triggers an AddProfile request by the LPA (which installs the profile on the eUICC). Removal of this subtree triggers the LPA to delete the profile (if resident on the eUICC).</Description>
|
<Description>Node representing an enterprise-owned eUICC profile. The node name is the ICCID of the profile (which is a unique identifier). Creation of this subtree triggers an AddProfile request by the LPA (which installs the profile on the eUICC). Removal of this subtree triggers the LPA to delete the profile (if resident on the eUICC).</Description>
|
||||||
<DFFormat>
|
<DFFormat>
|
||||||
@ -167,6 +301,7 @@ The XML below if for Windows 10, version 1803.
|
|||||||
<AccessType>
|
<AccessType>
|
||||||
<Add />
|
<Add />
|
||||||
<Get />
|
<Get />
|
||||||
|
<Replace />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<Description>Fully qualified domain name of the SM-DP+ that can download this profile. Must be set by the MDM when the ICCID subtree is created.</Description>
|
<Description>Fully qualified domain name of the SM-DP+ that can download this profile. Must be set by the MDM when the ICCID subtree is created.</Description>
|
||||||
<DFFormat>
|
<DFFormat>
|
||||||
@ -192,6 +327,7 @@ The XML below if for Windows 10, version 1803.
|
|||||||
<AccessType>
|
<AccessType>
|
||||||
<Add />
|
<Add />
|
||||||
<Get />
|
<Get />
|
||||||
|
<Replace />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<Description>Matching ID (activation code token) for profile download. Must be set by the MDM when the ICCID subtree is created.</Description>
|
<Description>Matching ID (activation code token) for profile download. Must be set by the MDM when the ICCID subtree is created.</Description>
|
||||||
<DFFormat>
|
<DFFormat>
|
||||||
@ -256,6 +392,70 @@ The XML below if for Windows 10, version 1803.
|
|||||||
</DFType>
|
</DFType>
|
||||||
</DFProperties>
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>PPR1Set</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>This profile policy rule indicates whether disabling of this profile is not allowed (true if not allowed, false otherwise).</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<bool />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>PPR2Set</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>This profile policy rule indicates whether deletion of this profile is not allowed (true if not allowed, false otherwise).</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<bool />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>ErrorDetail</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<DefaultValue>0</DefaultValue>
|
||||||
|
<Description>Detailed error if the profile download and install procedure failed (None = 0, CardGeneralFailure = 1, ConfirmationCodeMissing = 3, ForbiddenByPolicy = 5, InvalidMatchingId = 6, NoEligibleProfileForThisDevice = 7, NotEnoughSpaceOnCard = 8, ProfileEidMismatch = 10, ProfileNotAvailableForNewBinding = 11, ProfileNotReleasedByOperator = 12, RemoteServerGeneralFailure = 13, RemoteServerUnreachable = 14).</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<int />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
</Node>
|
</Node>
|
||||||
</Node>
|
</Node>
|
||||||
<Node>
|
<Node>
|
||||||
|
|||||||
@ -8,25 +8,470 @@ ms.author: dansimp
|
|||||||
ms.topic: article
|
ms.topic: article
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: manikadhiman
|
author: dansimp
|
||||||
ms.date: 06/26/2017
|
ms.date:
|
||||||
---
|
---
|
||||||
|
|
||||||
# Device HealthAttestation CSP
|
# Device HealthAttestation CSP
|
||||||
|
|
||||||
The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT managers to assess if a device is booted to a trusted and compliant state, and take enterprise policy actions.
|
The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT administrators to assess if a device is booted to a trusted and compliant state, and to take enterprise policy actions.
|
||||||
|
|
||||||
The following is a list of functions performed by the Device HealthAttestation CSP:
|
The following is a list of functions performed by the Device HealthAttestation CSP:
|
||||||
|
|
||||||
- Collects device boot logs, TPM audit trails and the TPM certificate (DHA-BootData) from a managed device
|
- Collects device boot logs, Trusted Platform Module (TPM) audit trails and the TPM certificate (DHA-BootData) from a managed device
|
||||||
- Forwards DHA-BootData to Device Health Attestation Service (DHA-Service)
|
- Forwards DHA-BootData to a Device Health Attestation Service (DHA-Service)
|
||||||
- Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device
|
- Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device
|
||||||
- Receives attestation requests (DHA-Requests) from a DHA-Enabled MDM, and replies with Device Health Attestation data (DHA-Data
|
- Receives attestation requests (DHA-Requests) from a DHA-Enabled MDM, and replies with Device Health Attestation data (DHA-Data)
|
||||||
|
|
||||||
## Terms
|
## Windows 11 Device health attestation
|
||||||
|
|
||||||
|
Windows 11 introduces an update to the device health attestation feature. This helps add support for deeper insights to Windows boot security, supporting a zero trust approach to device security. Device health attestation on Windows can be accessed by using the HealthAttestation CSP. This CSP helps assess if a device is booted to a trusted and compliant state and then to take appropriate action. Windows 11 introduces additional child nodes to the HealthAttestation node for the MDM providers to connect to the Microsoft Azure Attestation service, which provides a simplified approach to attestation.
|
||||||
|
|
||||||
|
The attestation report provides a health assessment of the boot-time properties of the device to ensure that the devices are automatically secure as soon as they power on. The health attestation result can then be used to allow or deny access to networks, apps, or services, depending on the health of the device.
|
||||||
|
|
||||||
|
### Terms
|
||||||
|
**TPM (Trusted Platform Module)**
|
||||||
|
<p>TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption, and signing.</p>
|
||||||
|
|
||||||
|
**DHA (Device HealthAttestation) feature**
|
||||||
|
<p>The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.</p>
|
||||||
|
|
||||||
|
**MAA-Session (Microsoft Azure Attestation service based device HealthAttestation session)**
|
||||||
|
<p>The Microsoft Azure Attestation service-based device HealthAttestation session (MAA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.</p>
|
||||||
|
|
||||||
|
**MAA-CSP Nodes (Microsoft Azure Attestation based Configuration Service Provider)**
|
||||||
|
<p>The Configuration Service Provider nodes added to Windows 11 to integrate with Microsoft Azure Attestation Service.</p>
|
||||||
|
<p>The following list of operations is performed by MAA-CSP:</p>
|
||||||
|
<ul>
|
||||||
|
<li>Receives attestation trigger requests from a HealthAttestation enabled MDM provider.</li>
|
||||||
|
<li>The device collects Attestation Evidence (device boot logs, TPM audit trails and the TPM certificate) from a managed device.</li>
|
||||||
|
<li>Forwards the Attestation Evidence to the Azure Attestation Service instance as configured by the MDM provider.</li>
|
||||||
|
<li>Receives a signed report from the Azure Attestation Service instance and stores it in a local cache on the device.</li>
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
**MAA endpoint**
|
||||||
|
Microsoft Azure attestation service is an Azure resource, and every instance of the service gets administrator configured URL. The URI generated is unique in nature and for the purposes of device health attestation is known as the MAA endpoint.
|
||||||
|
|
||||||
|
**JWT (JSON Web Token)**
|
||||||
|
JSON Web Token (JWT) is an open standard RFC7519 method for securely transmitting information between parties as a JavaScript Object Notation (JSON) object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret or a public/private key pair.
|
||||||
|
|
||||||
|
### Attestation Flow with Microsoft Azure Attestation Service
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<br>
|
||||||
|
<p>Attestation flow can be broadly in three main steps:</p>
|
||||||
|
<ul>
|
||||||
|
<li>An instance of the Azure Attestation service is set up with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.</li>
|
||||||
|
<li>The MDM provider triggers a call to the attestation service, the device then performs an attestation check keeping the report ready to be retrieved.</li>
|
||||||
|
<li>The MDM provider after verifying the token is coming from the attestation service it can parse the attestation token to reflect on the attested state of the device.</li>
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
The protocol implemented can be found here: <a href="/azure/attestation/virtualization-based-security-protocol" id="attestationprotocol"> Attestation Protocol</a>.
|
||||||
|
|
||||||
|
### Configuration Service Provider Nodes
|
||||||
|
Windows 11 introduces additions to the HealthAttestation CSP node to integrate with Microsoft Azure Attestation service.
|
||||||
|
```
|
||||||
|
./Vendor/MSFT
|
||||||
|
HealthAttestation
|
||||||
|
----...
|
||||||
|
----TriggerAttestation |
|
||||||
|
----AttestStatus | Added in Windows 11
|
||||||
|
----GetAttestReport |
|
||||||
|
----GetServiceCorrelationIDs |
|
||||||
|
----VerifyHealth
|
||||||
|
----Status
|
||||||
|
----ForceRetrieve
|
||||||
|
----Certificate
|
||||||
|
----Nonce
|
||||||
|
----CorrelationID
|
||||||
|
----HASEndpoint
|
||||||
|
----TpmReadyStatus
|
||||||
|
----CurrentProtocolVersion
|
||||||
|
----PreferredMaxProtocolVersion
|
||||||
|
----MaxSupportedProtocolVersion
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
<a href="" id="healthattestation"></a>**./Vendor/MSFT/HealthAttestation**
|
||||||
|
<p>The root node for the device HealthAttestation configuration service provider.</p>
|
||||||
|
|
||||||
|
<a href="" id="triggerAttestation"></a>**TriggerAttestation** (Required)
|
||||||
|
<p>Node type: EXECUTE
|
||||||
|
This node will trigger attestation flow by launching an attestation process. If the attestation process is launched successfully, this node will return code 202 indicating the request is received and being processed. Otherwise, an error will be returned.
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p>Templated SyncML Call:</p>
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||||
|
<SyncBody>
|
||||||
|
<Exec>
|
||||||
|
<CmdID>VERIFYHEALTHV2</CmdID>
|
||||||
|
<Item>
|
||||||
|
<Target>
|
||||||
|
<LocURI>
|
||||||
|
./Vendor/MSFT/HealthAttestation/TriggerAttestation
|
||||||
|
</LocURI>
|
||||||
|
</Target>
|
||||||
|
<Data>
|
||||||
|
{
|
||||||
|
rpID : "rpID", serviceEndpoint : “MAA endpoint”,
|
||||||
|
nonce : “nonce”, aadToken : “aadToken”, "cv" : "CorrelationVector"
|
||||||
|
}
|
||||||
|
</Data>
|
||||||
|
</Item>
|
||||||
|
</Exec>
|
||||||
|
<Final/>
|
||||||
|
</SyncBody>
|
||||||
|
</SyncML>
|
||||||
|
```
|
||||||
|
|
||||||
|
<p>Data fields:</p>
|
||||||
|
<ul>
|
||||||
|
<li>rpID (Relying Party Identifier): This field contains an identifier that can be used to help determine the caller.</li>
|
||||||
|
<li>serviceEndpoint : This field contains the complete URL of the Microsoft Azure Attestation provider instance to be used for evaluation.</li>
|
||||||
|
<li>nonce : This field contains an arbitrary number that can be used just once in a cryptographic communication. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.</li>
|
||||||
|
<li>aadToken: The AAD token to be used for authentication against the Microsoft Azure Attestation service.</li>
|
||||||
|
<li>cv: This field contains an identifier(Correlation Vector) that will passed in to the service call, that can be used for diagnostics purposes.</li>
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<p>Sample Data:</p>
|
||||||
|
|
||||||
|
```json
|
||||||
|
<Data>
|
||||||
|
{
|
||||||
|
"rpid" : "https://www.contoso.com/attestation",
|
||||||
|
"endpoint" : "https://contoso.eus.attest.azure.net/attest/tpm?api-version=2020-10-01",
|
||||||
|
"nonce" : "5468697320697320612054657374204e6f6e6365",
|
||||||
|
"aadToken" : "dummytokenstring",
|
||||||
|
"cv" : "testonboarded"
|
||||||
|
}
|
||||||
|
</Data>
|
||||||
|
```
|
||||||
|
|
||||||
|
<a href="" id="AttestStatus"></a>**AttestStatus**
|
||||||
|
<p>Node type: GET
|
||||||
|
This node will retrieve the status(HRESULT value) stored in registry updated by the attestation process triggered in the previous step.
|
||||||
|
The status is always cleared prior to making the attest service call.
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p>Templated SyncML Call:</p>
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||||
|
<SyncBody>
|
||||||
|
<Get>
|
||||||
|
<Item>
|
||||||
|
<Target>
|
||||||
|
<LocURI>
|
||||||
|
./Device/Vendor/MSFT/HealthAttestation/AttestStatus
|
||||||
|
</LocURI>
|
||||||
|
</Target>
|
||||||
|
</Item>
|
||||||
|
</Get>
|
||||||
|
<Final/>
|
||||||
|
</SyncBody>
|
||||||
|
</SyncML>
|
||||||
|
```
|
||||||
|
|
||||||
|
<p>Sample Data:</p>
|
||||||
|
|
||||||
|
```
|
||||||
|
If Successful: 0
|
||||||
|
If Failed: A corresponding HRESULT error code
|
||||||
|
Example: 0x80072efd, WININET_E_CANNOT_CONNECT
|
||||||
|
```
|
||||||
|
|
||||||
|
<a href="" id="getAttestReport"></a>**GetAttestReport**
|
||||||
|
<p>Node type: GET
|
||||||
|
This node will retrieve the attestation report per the call made by the TriggerAttestation, if there is any, for the given MDM provider. The report is stored in a registry key in the respective MDM enrollment store.
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p>Templated SyncML Call:</p>
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||||
|
<SyncBody>
|
||||||
|
<Get>
|
||||||
|
<Item>
|
||||||
|
<Target>
|
||||||
|
<LocURI>
|
||||||
|
./Device/Vendor/MSFT/HealthAttestation/GetAttestReport
|
||||||
|
</LocURI>
|
||||||
|
</Target>
|
||||||
|
</Item>
|
||||||
|
</Get>
|
||||||
|
<Final/>
|
||||||
|
</SyncBody>
|
||||||
|
</SyncML>
|
||||||
|
```
|
||||||
|
|
||||||
|
<p>Sample data:</p>
|
||||||
|
|
||||||
|
```
|
||||||
|
If Success:
|
||||||
|
JWT token: aaaaaaaaaaaaa.bbbbbbbbbbbbb.cccccccccc
|
||||||
|
If failed:
|
||||||
|
Previously cached report if available (the token may have already expired per the attestation policy).
|
||||||
|
OR Sync ML 404 error if not cached report available.
|
||||||
|
```
|
||||||
|
|
||||||
|
<a href="" id="getServiceCorrelationIDs"></a>**GetServiceCorrelationIDs**
|
||||||
|
<p>Node type: GET
|
||||||
|
This node will retrieve the service-generated correlation IDs for the given MDM provider. If there are more than one correlation IDs, they are separated by “;” in the string.
|
||||||
|
</p>
|
||||||
|
<p>Templated SyncML Call:</p>
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||||
|
<SyncBody>
|
||||||
|
<Get>
|
||||||
|
<Item>
|
||||||
|
<Target>
|
||||||
|
<LocURI>
|
||||||
|
./Device/Vendor/MSFT/HealthAttestation/GetServiceCorrelationIDs
|
||||||
|
</LocURI>
|
||||||
|
</Target>
|
||||||
|
</Item>
|
||||||
|
</Get>
|
||||||
|
<Final/>
|
||||||
|
</SyncBody>
|
||||||
|
</SyncML>
|
||||||
|
```
|
||||||
|
|
||||||
|
<p>Sample data:</p>
|
||||||
|
|
||||||
|
> If success:
|
||||||
|
> GUID returned by the attestation service: 1k9+vQOn00S8ZK33;CMc969r1JEuHwDpM
|
||||||
|
> If Trigger Attestation call failed and no previous data is present. The field remains empty.
|
||||||
|
> Otherwise, the last service correlation id will be returned. In a successful attestation there are two
|
||||||
|
> calls between client and MAA and for each call the GUID is separated by semicolon.
|
||||||
|
|
||||||
|
> **_Note:_** MAA CSP nodes are available on arm64 but is not currently supported.
|
||||||
|
|
||||||
|
|
||||||
|
### MAA CSP Integration Steps
|
||||||
|
<ol>
|
||||||
|
<li>Set up a MAA provider instance:<br>
|
||||||
|
MAA instance can be created following the steps here <a href="/azure/attestation/quickstart-portal" id="quickstartsetup">Quickstart: Set up Azure Attestation by using the Azure portal | Microsoft Docs.</a></li>
|
||||||
|
<br><li>Update the provider with an appropriate policy:<br>
|
||||||
|
The MAA instance should be updated with an appropriate policy. <a href="/azure/attestation/claim-rule-grammar" id="policy">How to author an Azure Attestation policy | Microsoft Docs</a>
|
||||||
|
<br>A Sample attestation policy:
|
||||||
|
|
||||||
|
```
|
||||||
|
version=1.2;
|
||||||
|
|
||||||
|
configurationrules{
|
||||||
|
};
|
||||||
|
|
||||||
|
authorizationrules {
|
||||||
|
=> permit();
|
||||||
|
};
|
||||||
|
|
||||||
|
issuancerules{
|
||||||
|
|
||||||
|
// SecureBoot enabled
|
||||||
|
c:[type == "events", issuer=="AttestationService"] => add(type = "efiConfigVariables", value = JmesPath(c.value, "Events[?EventTypeString == 'EV_EFI_VARIABLE_DRIVER_CONFIG' && ProcessedData.VariableGuid == '8BE4DF61-93CA-11D2-AA0D-00E098032B8C']"));
|
||||||
|
c:[type == "efiConfigVariables", issuer=="AttestationPolicy"]=> issue(type = "secureBootEnabled", value = JsonToClaimValue(JmesPath(c.value, "[?ProcessedData.UnicodeName == 'SecureBoot'] | length(@) == `1` && @[0].ProcessedData.VariableData == 'AQ'")));
|
||||||
|
![type=="secureBootEnabled", issuer=="AttestationPolicy"] => issue(type="secureBootEnabled", value=false);
|
||||||
|
|
||||||
|
// Retrieve bool properties
|
||||||
|
c:[type=="events", issuer=="AttestationService"] => add(type="boolProperties", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && (PcrIndex == `12` || PcrIndex == `13` || PcrIndex == `19` || PcrIndex == `20`)].ProcessedData.EVENT_TRUSTBOUNDARY"));
|
||||||
|
c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="codeIntegrityEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_CODEINTEGRITY")));
|
||||||
|
c:[type=="codeIntegrityEnabledSet", issuer=="AttestationPolicy"] => issue(type="codeIntegrityEnabled", value=ContainsOnlyValue(c.value, true));
|
||||||
|
![type=="codeIntegrityEnabled", issuer=="AttestationPolicy"] => issue(type="codeIntegrityEnabled", value=false);
|
||||||
|
|
||||||
|
// Bitlocker Boot Status, The first non zero measurement or zero.
|
||||||
|
c:[type=="events", issuer=="AttestationService"] => add(type="srtmDrtmEventPcr", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && (PcrIndex == `12` || PcrIndex == `19`)].ProcessedData.EVENT_TRUSTBOUNDARY"));
|
||||||
|
c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => issue(type="bitlockerEnabledValue", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_BITLOCKER_UNLOCK | @[? Value != `0`].Value | @[0]")));
|
||||||
|
[type=="bitlockerEnabledValue"] => issue(type="bitlockerEnabled", value=true);
|
||||||
|
![type=="bitlockerEnabledValue"] => issue(type="bitlockerEnabled", value=false);
|
||||||
|
|
||||||
|
// Elam Driver (windows defender) Loaded
|
||||||
|
c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="elamDriverLoaded", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_LOADEDMODULE_AGGREGATION[] | [? EVENT_IMAGEVALIDATED == `true` && (equals_ignore_case(EVENT_FILEPATH, '\\windows\\system32\\drivers\\wdboot.sys') || equals_ignore_case(EVENT_FILEPATH, '\\windows\\system32\\drivers\\wd\\wdboot.sys'))] | @ != `null`")));
|
||||||
|
[type=="elamDriverLoaded", issuer=="AttestationPolicy"] => issue(type="WindowsDefenderElamDriverLoaded", value=true);
|
||||||
|
![type=="elamDriverLoaded", issuer=="AttestationPolicy"] => issue(type="WindowsDefenderElamDriverLoaded", value=false);
|
||||||
|
|
||||||
|
// Boot debugging
|
||||||
|
c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="bootDebuggingEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_BOOTDEBUGGING")));
|
||||||
|
c:[type=="bootDebuggingEnabledSet", issuer=="AttestationPolicy"] => issue(type="bootDebuggingDisabled", value=ContainsOnlyValue(c.value, false));
|
||||||
|
![type=="bootDebuggingDisabled", issuer=="AttestationPolicy"] => issue(type="bootDebuggingDisabled", value=false);
|
||||||
|
|
||||||
|
// Kernel Debugging
|
||||||
|
c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="osKernelDebuggingEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_OSKERNELDEBUG")));
|
||||||
|
c:[type=="osKernelDebuggingEnabledSet", issuer=="AttestationPolicy"] => issue(type="osKernelDebuggingDisabled", value=ContainsOnlyValue(c.value, false));
|
||||||
|
![type=="osKernelDebuggingDisabled", issuer=="AttestationPolicy"] => issue(type="osKernelDebuggingDisabled", value=false);
|
||||||
|
|
||||||
|
// DEP Policy
|
||||||
|
c:[type=="boolProperties", issuer=="AttestationPolicy"] => issue(type="depPolicy", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_DATAEXECUTIONPREVENTION.Value | @[-1]")));
|
||||||
|
![type=="depPolicy"] => issue(type="depPolicy", value=0);
|
||||||
|
|
||||||
|
// Test Signing
|
||||||
|
c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="testSigningEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_TESTSIGNING")));
|
||||||
|
c:[type=="testSigningEnabledSet", issuer=="AttestationPolicy"] => issue(type="testSigningDisabled", value=ContainsOnlyValue(c.value, false));
|
||||||
|
![type=="testSigningDisabled", issuer=="AttestationPolicy"] => issue(type="testSigningDisabled", value=false);
|
||||||
|
|
||||||
|
// Flight Signing
|
||||||
|
c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="flightSigningEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_FLIGHTSIGNING")));
|
||||||
|
c:[type=="flightSigningEnabledSet", issuer=="AttestationPolicy"] => issue(type="flightSigningNotEnabled", value=ContainsOnlyValue(c.value, false));
|
||||||
|
![type=="flightSigningNotEnabled", issuer=="AttestationPolicy"] => issue(type="flightSigningNotEnabled", value=false);
|
||||||
|
|
||||||
|
// VSM enabled
|
||||||
|
c:[type=="events", issuer=="AttestationService"] => add(type="srtmDrtmEventPcr", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && (PcrIndex == `12` || PcrIndex == `19`)].ProcessedData.EVENT_TRUSTBOUNDARY"));
|
||||||
|
c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => add(type="vbsEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_VSM_REQUIRED")));
|
||||||
|
c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => add(type="vbsEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_MANDATORY_ENFORCEMENT")));
|
||||||
|
c:[type=="vbsEnabledSet", issuer=="AttestationPolicy"] => issue(type="vbsEnabled", value=ContainsOnlyValue(c.value, true));
|
||||||
|
![type=="vbsEnabled", issuer=="AttestationPolicy"] => issue(type="vbsEnabled", value=false);
|
||||||
|
c:[type=="vbsEnabled", issuer=="AttestationPolicy"] => issue(type="vbsEnabled", value=c.value);
|
||||||
|
|
||||||
|
// HVCI
|
||||||
|
c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => add(type="hvciEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_HVCI_POLICY | @[?String == 'HypervisorEnforcedCodeIntegrityEnable'].Value")));
|
||||||
|
c:[type=="hvciEnabledSet", issuer=="AttestationPolicy"] => issue(type="hvciEnabled", value=ContainsOnlyValue(c.value, 1));
|
||||||
|
![type=="hvciEnabled", issuer=="AttestationPolicy"] => issue(type="hvciEnabled", value=false);
|
||||||
|
|
||||||
|
// IOMMU
|
||||||
|
c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="iommuEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_IOMMU_REQUIRED")));
|
||||||
|
c:[type=="iommuEnabledSet", issuer=="AttestationPolicy"] => issue(type="iommuEnabled", value=ContainsOnlyValue(c.value, true));
|
||||||
|
![type=="iommuEnabled", issuer=="AttestationPolicy"] => issue(type="iommuEnabled", value=false);
|
||||||
|
|
||||||
|
// Find the Boot Manager SVN, this is measured as part of a sequence and find the various measurements
|
||||||
|
// Find the first EV_SEPARATOR in PCR 12, 13, Or 14
|
||||||
|
c:[type=="events", issuer=="AttestationService"] => add(type="evSeparatorSeq", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_SEPARATOR' && (PcrIndex == `12` || PcrIndex == `13` || PcrIndex == `14`)] | @[0].EventSeq"));
|
||||||
|
c:[type=="evSeparatorSeq", value != "null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value=AppendString(AppendString("Events[? EventSeq < `", c.value), "`"));
|
||||||
|
[type=="evSeparatorSeq", value=="null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value="Events[? `true` ");
|
||||||
|
|
||||||
|
// Find the first EVENT_APPLICATION_SVN.
|
||||||
|
c:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] => add(type="bootMgrSvnSeqQuery", value=AppendString(c.value, " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `12` && ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_APPLICATION_SVN] | @[0].EventSeq"));
|
||||||
|
c1:[type=="bootMgrSvnSeqQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => add(type="bootMgrSvnSeq", value=JmesPath(c2.value, c1.value));
|
||||||
|
c:[type=="bootMgrSvnSeq", value!="null", issuer=="AttestationPolicy"] => add(type="bootMgrSvnQuery", value=AppendString(AppendString("Events[? EventSeq == `", c.value), "`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_APPLICATION_SVN | @[0]"));
|
||||||
|
|
||||||
|
// The first EVENT_APPLICATION_SVN. That value is the Boot Manager SVN
|
||||||
|
c1:[type=="bootMgrSvnQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => issue(type="bootMgrSvn", value=JsonToClaimValue(JmesPath(c2.value, c1.value)));
|
||||||
|
|
||||||
|
// OS Rev List Info
|
||||||
|
c:[type=="events", issuer=="AttestationService"] => issue(type="osRevListInfo", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_OS_REVOCATION_LIST.RawData | @[0]")));
|
||||||
|
|
||||||
|
// Safe mode
|
||||||
|
c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="safeModeEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_SAFEMODE")));
|
||||||
|
c:[type=="safeModeEnabledSet", issuer=="AttestationPolicy"] => issue(type="notSafeMode", value=ContainsOnlyValue(c.value, false));
|
||||||
|
![type=="notSafeMode", issuer=="AttestationPolicy"] => issue(type="notSafeMode", value=true);
|
||||||
|
|
||||||
|
// Win PE
|
||||||
|
c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="winPEEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_WINPE")));
|
||||||
|
c:[type=="winPEEnabledSet", issuer=="AttestationPolicy"] => issue(type="notWinPE", value=ContainsOnlyValue(c.value, false));
|
||||||
|
![type=="notWinPE", issuer=="AttestationPolicy"] => issue(type="notWinPE", value=true);
|
||||||
|
|
||||||
|
// CI Policy
|
||||||
|
c:[type=="events", issuer=="AttestationService"] => issue(type="codeIntegrityPolicy", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_SI_POLICY[].RawData")));
|
||||||
|
|
||||||
|
// Secure Boot Custom Policy
|
||||||
|
c:[type=="events", issuer=="AttestationService"] => issue(type="secureBootCustomPolicy", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EFI_VARIABLE_DRIVER_CONFIG' && PcrIndex == `7` && ProcessedData.UnicodeName == 'CurrentPolicy' && ProcessedData.VariableGuid == '77FA9ABD-0359-4D32-BD60-28F4E78F784B'].ProcessedData.VariableData | @[0]")));
|
||||||
|
|
||||||
|
// Find the first EV_SEPARATOR in PCR 12, 13, Or 14
|
||||||
|
c:[type=="events", issuer=="AttestationService"] => add(type="evSeparatorSeq", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_SEPARATOR' && (PcrIndex == `12` || PcrIndex == `13` || PcrIndex == `14`)] | @[0].EventSeq"));
|
||||||
|
c:[type=="evSeparatorSeq", value != "null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value=AppendString(AppendString("Events[? EventSeq < `", c.value), "`"));
|
||||||
|
[type=="evSeparatorSeq", value=="null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value="Events[? `true` "); // No restriction of EV_SEPARATOR in case it is not present
|
||||||
|
|
||||||
|
//Finding the Boot App SVN
|
||||||
|
// Find the first EVENT_TRANSFER_CONTROL with value 1 or 2 in PCR 12 which is before the EV_SEPARATOR
|
||||||
|
c1:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] && c2:[type=="bootMgrSvnSeq", value != "null", issuer=="AttestationPolicy"] => add(type="beforeEvSepAfterBootMgrSvnClause", value=AppendString(AppendString(AppendString(c1.value, "&& EventSeq >= `"), c2.value), "`"));
|
||||||
|
c:[type=="beforeEvSepAfterBootMgrSvnClause", issuer=="AttestationPolicy"] => add(type="tranferControlQuery", value=AppendString(c.value, " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `12`&& (ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_TRANSFER_CONTROL.Value == `1` || ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_TRANSFER_CONTROL.Value == `2`)] | @[0].EventSeq"));
|
||||||
|
c1:[type=="tranferControlQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => add(type="tranferControlSeq", value=JmesPath(c2.value, c1.value));
|
||||||
|
|
||||||
|
// Find the first non-null EVENT_MODULE_SVN in PCR 13 after the transfer control.
|
||||||
|
c:[type=="tranferControlSeq", value!="null", issuer=="AttestationPolicy"] => add(type="afterTransferCtrlClause", value=AppendString(AppendString(" && EventSeq > `", c.value), "`"));
|
||||||
|
c1:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] && c2:[type=="afterTransferCtrlClause", issuer=="AttestationPolicy"] => add(type="moduleQuery", value=AppendString(AppendString(c1.value, c2.value), " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13` && ((ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_LOADEDMODULE_AGGREGATION[].EVENT_MODULE_SVN | @[0]) || (ProcessedData.EVENT_LOADEDMODULE_AGGREGATION[].EVENT_MODULE_SVN | @[0]))].EventSeq | @[0]"));
|
||||||
|
c1:[type=="moduleQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => add(type="moduleSeq", value=JmesPath(c2.value, c1.value));
|
||||||
|
|
||||||
|
// Find the first EVENT_APPLICATION_SVN after EV_EVENT_TAG in PCR 12.
|
||||||
|
c:[type=="moduleSeq", value!="null", issuer=="AttestationPolicy"] => add(type="applicationSvnAfterModuleClause", value=AppendString(AppendString(" && EventSeq > `", c.value), "`"));
|
||||||
|
c1:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] && c2:[type=="applicationSvnAfterModuleClause", issuer=="AttestationPolicy"] => add(type="bootAppSvnQuery", value=AppendString(AppendString(c1.value, c2.value), " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `12`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_APPLICATION_SVN | @[0]"));
|
||||||
|
c1:[type=="bootAppSvnQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => issue(type="bootAppSvn", value=JsonToClaimValue(JmesPath(c2.value, c1.value)));
|
||||||
|
|
||||||
|
// Finding the Boot Rev List Info
|
||||||
|
c:[type=="events", issuer=="AttestationService"] => issue(type="bootRevListInfo", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_BOOT_REVOCATION_LIST.RawData | @[0]")));
|
||||||
|
|
||||||
|
};
|
||||||
|
```
|
||||||
|
|
||||||
|
</li>
|
||||||
|
<br><li>Call TriggerAttestation with your rpid, AAD token and the attestURI:<br>
|
||||||
|
Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. More information about the api version can be found here Attestation - Attest Tpm - REST API (Azure Attestation) | Microsoft Docs</li>
|
||||||
|
<br><li>Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties:<br>
|
||||||
|
GetAttestReport return the signed attestation token as a JWT. The JWT can be decoded to parse the information per the attestation policy.
|
||||||
|
<br>
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"typ": "JWT",
|
||||||
|
"alg": "RS256",
|
||||||
|
"x5c": [
|
||||||
|
"MIIE.....=",
|
||||||
|
"MIIG.....=",
|
||||||
|
"MIIF.....="
|
||||||
|
],
|
||||||
|
"kid": "8FUer20z6wzf1rod044wOAFdjsg"
|
||||||
|
}.{
|
||||||
|
"nbf": 1633664812,
|
||||||
|
"exp": 1634010712,
|
||||||
|
"iat": 1633665112,
|
||||||
|
"iss": "https://contosopolicy.eus.attest.azure.net",
|
||||||
|
"jti": "2b63663acbcafefa004d20969991c0b1f063c9be",
|
||||||
|
"ver": "1.0",
|
||||||
|
"x-ms-ver": "1.0",
|
||||||
|
"rp_data": "AQIDBA",
|
||||||
|
"nonce": "AQIDBA",
|
||||||
|
"cnf": {
|
||||||
|
"jwk": {
|
||||||
|
"kty": "RSA",
|
||||||
|
"n": "yZGC3-1rFZBt6n6vRHjRjvrOYlH69TftIQWOXiEHz__viQ_Z3qxWVa4TfrUxiQyDQnxJ8-f8tBRmlunMdFDIQWhnew_rc3-UYMUPNcTQ0IkrLBDG6qDjFFeEAMbn8gqr0rRWu_Qt7Cb_Cq1upoEBkv0RXk8yR6JXmFIvLuSdewGs-xCWlHhd5w3n1rVk0hjtRk9ZErlbPXt74E5l-ZZQUIyeYEZ1FmbivOIL-2f6NnKJ-cR4cdhEU8i9CH1YV0r578ry89nGvBJ5u4_3Ib9Ragdmxm259npH53hpnwf0I6V-_ZhGPyF6LBVUG_7x4CyxuHCU20uI0vXKXJNlbj1wsQ",
|
||||||
|
"e": "AQAB"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"x-ms-policy-hash": "GiGQCTOylCohHt4rd3pEppD9arh5mXC3ifF1m1hONh0",
|
||||||
|
"WindowsDefenderElamDriverLoaded": true,
|
||||||
|
"bitlockerEnabled": true,
|
||||||
|
"bitlockerEnabledValue": 4,
|
||||||
|
"bootAppSvn": 1,
|
||||||
|
"bootDebuggingDisabled": true,
|
||||||
|
"bootMgrSvn": 1,
|
||||||
|
"bootRevListInfo": "gHWqR2F-1wEgAAAACwBxrZXHbaiuTuO0PSaJ7WQMF8yz37Z2ATgSNTTlRkwcTw",
|
||||||
|
"codeIntegrityEnabled": true,
|
||||||
|
"codeIntegrityPolicy": [
|
||||||
|
"AAABAAAAAQBWAAsAIAAAAHsAOABmAGIANAA4ADYANQBlAC0AZQA5ADAAYgAtADQANAA0AGYALQBiADUAYgA1AC0AZQAyAGEAYQA1ADEAZAA4ADkAMABmAGQAfQAuAEMASQBQAAAAVnW86ERqAg5n9QT1UKFr-bOP2AlNtBaaHXjZODnNLlk",
|
||||||
|
"AAAAAAAACgBWAAsAIAAAAHsAYgBjADQAYgBmADYAZAA3AC0AYwBjADYAMAAtADQAMABmADAALQA4ADYANAA0AC0AMQBlADYANAA5ADEANgBmADgAMQA4ADMAfQAuAEMASQBQAAAAQ7vOXuAbBRIMglSSg7g_LHNeHoR4GrY-M-2W5MNvf0o",
|
||||||
|
"AAAAAAAACgBWAAsAIAAAAHsAYgAzADEAOAA5ADkAOQBhAC0AYgAxADMAZQAtADQANAA3ADUALQBiAGMAZgBkAC0AMQBiADEANgBlADMAMABlADYAMAAzADAAfQAuAEMASQBQAAAALTmwU3eadNtg0GyAyKIAkYed127RJCSgmfFmO1jN_aI",
|
||||||
|
"AAAAAAAACgBWAAsAIAAAAHsAZgBlADgAMgBkADUAOAA5AC0ANwA3AGQAMQAtADQAYwA3ADYALQA5AGEANABhAC0AZQA0ADUANQA0ADYAOAA4ADkANAAxAGIAfQAuAEMASQBQAAAA8HGUwA85gHN_ThItTYtu6sw657gVuOb4fOhYl-YJRoc",
|
||||||
|
"AACRVwAACgAmAAsAIAAAAEQAcgBpAHYAZQByAFMAaQBQAG8AbABpAGMAeQAuAHAANwBiAAAAYcVuY0HdW4Iqr5B-6Sl85kwIXRG9bqr43pVhkirg4qM"
|
||||||
|
],
|
||||||
|
"depPolicy": 0,
|
||||||
|
"flightSigningNotEnabled": false,
|
||||||
|
"hvciEnabled": true,
|
||||||
|
"iommuEnabled": true,
|
||||||
|
"notSafeMode": true,
|
||||||
|
"notWinPE": true,
|
||||||
|
"osKernelDebuggingDisabled": true,
|
||||||
|
"osRevListInfo": "gHLuW2F-1wEgAAAACwDLyDTUQILjdz_RfNlShVgNYT9EghL7ceMReWg9TuwdKA",
|
||||||
|
"secureBootEnabled": true,
|
||||||
|
"testSigningDisabled": true,
|
||||||
|
"vbsEnabled": true
|
||||||
|
}.[Signature]
|
||||||
|
```
|
||||||
|
</li>
|
||||||
|
</ol>
|
||||||
|
|
||||||
|
### Learn More
|
||||||
|
|
||||||
|
More information about TPM attestation can be found here: [Microsoft Azure Attestation](/azure/attestation/).
|
||||||
|
|
||||||
|
|
||||||
|
## Windows 10 Device HealthAttestation
|
||||||
|
|
||||||
|
### Terms
|
||||||
|
|
||||||
**TPM (Trusted Platform Module)**
|
**TPM (Trusted Platform Module)**
|
||||||
<p>TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption and signing. </p>
|
<p>TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption, and signing. </p>
|
||||||
|
|
||||||
**DHA (Device HealthAttestation) feature**
|
**DHA (Device HealthAttestation) feature**
|
||||||
<p>The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.</p>
|
<p>The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.</p>
|
||||||
@ -59,10 +504,10 @@ The following is a list of functions performed by the Device HealthAttestation C
|
|||||||
<strong>DHA session data (Device HealthAttestation session data)</strong>
|
<strong>DHA session data (Device HealthAttestation session data)</strong>
|
||||||
<p>The following list of data is produced or consumed in one DHA-Transaction:</p>
|
<p>The following list of data is produced or consumed in one DHA-Transaction:</p>
|
||||||
<ul>
|
<ul>
|
||||||
<li>DHA-BootData: the device boot data (TCG logs, PCR values, device/TPM certificate, boot and TPM counters) that are required for validating device boot health.</li>
|
<li>DHA-BootData: the device boot data (TCG logs, PCR values, device/TPM certificate, boot, and TPM counters) that are required for validating device boot health.</li>
|
||||||
<li>DHA-EncBlob: an encrypted summary report that DHA-Service issues to a device after reviewing the DHA-BootData it receives from devices.</li>
|
<li>DHA-EncBlob: an encrypted summary report that DHA-Service issues to a device after reviewing the DHA-BootData it receives from devices.</li>
|
||||||
<li>DHA-SignedBlob: it is a signed snapshot of the current state of a device’s runtime that is captured by DHA-CSP at device health attestation time.</li>
|
<li>DHA-SignedBlob: it is a signed snapshot of the current state of a device’s runtime that is captured by DHA-CSP at device health attestation time.</li>
|
||||||
<li>DHA-Data: an XML formatted data blob that devices forward for device health validation to DHA-Service via MDM-Server. DHA-Data has 2 parts:
|
<li>DHA-Data: an XML formatted data blob that devices forward for device health validation to DHA-Service via MDM-Server. DHA-Data has two parts:
|
||||||
<ul>
|
<ul>
|
||||||
<li>DHA-EncBlob: the encrypted data blob that the device receives from DHA-Service</li>
|
<li>DHA-EncBlob: the encrypted data blob that the device receives from DHA-Service</li>
|
||||||
<li>DHA-SignedBlob: a current snapshot of the current security state of the device that is generated by DHA-CSP</li>
|
<li>DHA-SignedBlob: a current snapshot of the current security state of the device that is generated by DHA-CSP</li>
|
||||||
@ -96,7 +541,7 @@ The following is a list of functions performed by the Device HealthAttestation C
|
|||||||
<strong>DHA-Service (Device HealthAttestation Service)</strong>
|
<strong>DHA-Service (Device HealthAttestation Service)</strong>
|
||||||
<p>Device HealthAttestation Service (DHA-Service) validates the data it receives from DHA-CSP and issues a highly trusted hardware (TPM) protected report (DHA-Report) to DHA-Enabled device management solutions through a tamper resistant and tamper evident communication channel.</p>
|
<p>Device HealthAttestation Service (DHA-Service) validates the data it receives from DHA-CSP and issues a highly trusted hardware (TPM) protected report (DHA-Report) to DHA-Enabled device management solutions through a tamper resistant and tamper evident communication channel.</p>
|
||||||
|
|
||||||
<p>DHA-Service is available in 2 flavors: “DHA-Cloud” and “DHA-Server2016”. DHA-Service supports a variety of implementation scenarios including cloud, on premises, air-gapped, and hybrid scenarios.</p>
|
<p>DHA-Service is available in two flavors: “DHA-Cloud” and “DHA-Server2016”. DHA-Service supports various implementation scenarios including cloud, on premises, air-gapped, and hybrid scenarios.</p>
|
||||||
<p>The following list of operations is performed by DHA-Service:</p>
|
<p>The following list of operations is performed by DHA-Service:</p>
|
||||||
|
|
||||||
- Receives device boot data (DHA-BootData) from a DHA-Enabled device</li>
|
- Receives device boot data (DHA-BootData) from a DHA-Enabled device</li>
|
||||||
@ -173,7 +618,7 @@ The following is a list of functions performed by the Device HealthAttestation C
|
|||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
## CSP diagram and node descriptions
|
### CSP diagram and node descriptions
|
||||||
|
|
||||||
|
|
||||||
The following shows the Device HealthAttestation configuration service provider in tree format.
|
The following shows the Device HealthAttestation configuration service provider in tree format.
|
||||||
@ -205,12 +650,12 @@ HealthAttestation
|
|||||||
|
|
||||||
<p>The supported operation is Get.</p>
|
<p>The supported operation is Get.</p>
|
||||||
|
|
||||||
<p>The following list shows some examples of supported values. For the complete list of status see <a href="#device-healthattestation-csp-status-and-error-codes" data-raw-source="[Device HealthAttestation CSP status and error codes](#device-healthattestation-csp-status-and-error-codes)">Device HealthAttestation CSP status and error codes</a>.</p>
|
<p>The following list shows some examples of supported values. For the complete list of status, see <a href="#device-healthattestation-csp-status-and-error-codes" data-raw-source="[Device HealthAttestation CSP status and error codes](#device-healthattestation-csp-status-and-error-codes)">Device HealthAttestation CSP status and error codes</a>.</p>
|
||||||
|
|
||||||
- 0 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_UNINITIALIZED): DHA-CSP is preparing a request to get a new DHA-EncBlob from DHA-Service
|
- 0 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_UNINITIALIZED): DHA-CSP is preparing a request to get a new DHA-EncBlob from DHA-Service
|
||||||
- 1 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_REQUESTED): DHA-CSP is waiting for the DHA-Service to respond back, and issue a DHA-EncBlob to the device
|
- 1 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_REQUESTED): DHA-CSP is waiting for the DHA-Service to respond back, and issue a DHA-EncBlob to the device
|
||||||
- 2 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_FAILED): A valid DHA-EncBlob could not be retrieved from the DHA-Service for reasons other than discussed in the DHA error/status codes
|
- 2 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_FAILED): A valid DHA-EncBlob could not be retrieved from the DHA-Service for reasons other than discussed in the DHA error/status codes
|
||||||
- 3 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_COMPLETE): DHA-Data is ready for pick up
|
- 3 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_COMPLETE): DHA-Data is ready for pickup
|
||||||
|
|
||||||
<a href="" id="forceretrieve"></a>**ForceRetrieve** (Optional)
|
<a href="" id="forceretrieve"></a>**ForceRetrieve** (Optional)
|
||||||
<p>Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service.</p>
|
<p>Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service.</p>
|
||||||
@ -220,7 +665,7 @@ HealthAttestation
|
|||||||
<a href="" id="certificate"></a>**Certificate** (Required)
|
<a href="" id="certificate"></a>**Certificate** (Required)
|
||||||
<p>Instructs the DHA-CSP to forward DHA-Data to the MDM server.</p>
|
<p>Instructs the DHA-CSP to forward DHA-Data to the MDM server.</p>
|
||||||
|
|
||||||
<p>Value type is b64.The supported operation is Get.</p>
|
<p>Value type is b64. The supported operation is Get.</p>
|
||||||
|
|
||||||
<a href="" id="nonce"></a>**Nonce** (Required)
|
<a href="" id="nonce"></a>**Nonce** (Required)
|
||||||
<p>Enables MDMs to protect the device health attestation communications from man-in-the-middle type (MITM) attacks with a crypt-protected random value that is generated by the MDM Server.</p>
|
<p>Enables MDMs to protect the device health attestation communications from man-in-the-middle type (MITM) attacks with a crypt-protected random value that is generated by the MDM Server.</p>
|
||||||
@ -243,7 +688,7 @@ HealthAttestation
|
|||||||
<p>Added in Windows 10, version 1607 March service release. Returns a bitmask of information describing the state of TPM. It indicates whether the TPM of the device is in a ready and trusted state.</p>
|
<p>Added in Windows 10, version 1607 March service release. Returns a bitmask of information describing the state of TPM. It indicates whether the TPM of the device is in a ready and trusted state.</p>
|
||||||
<p>Value type is integer. The supported operation is Get.</p>
|
<p>Value type is integer. The supported operation is Get.</p>
|
||||||
|
|
||||||
## **DHA-CSP integration steps**
|
### **DHA-CSP integration steps**
|
||||||
|
|
||||||
|
|
||||||
The following list of validation and development tasks are required for integrating the Microsoft Device Health Attestation feature with a Windows Mobile device management solution (MDM):
|
The following list of validation and development tasks are required for integrating the Microsoft Device Health Attestation feature with a Windows Mobile device management solution (MDM):
|
||||||
@ -260,7 +705,7 @@ The following list of validation and development tasks are required for integrat
|
|||||||
|
|
||||||
Each step is described in detail in the following sections of this topic.
|
Each step is described in detail in the following sections of this topic.
|
||||||
|
|
||||||
## <a href="" id="verify-access"></a>**Step 1: Verify HTTPS access**
|
### <a href="" id="verify-access"></a>**Step 1: Verify HTTPS access**
|
||||||
|
|
||||||
|
|
||||||
Validate that both the MDM server and the device (MDM client) can access has.spserv.microsoft.com using the TCP protocol over port 443 (HTTPS).
|
Validate that both the MDM server and the device (MDM client) can access has.spserv.microsoft.com using the TCP protocol over port 443 (HTTPS).
|
||||||
@ -313,7 +758,7 @@ SSL-Session:
|
|||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
## <a href="" id="assign-trusted-dha-service"></a>**Step 2: Assign an enterprise trusted DHA-Service**
|
### <a href="" id="assign-trusted-dha-service"></a>**Step 2: Assign an enterprise trusted DHA-Service**
|
||||||
|
|
||||||
There are three types of DHA-Service:
|
There are three types of DHA-Service:
|
||||||
- Device Health Attestation – Cloud (owned and operated by Microsoft)
|
- Device Health Attestation – Cloud (owned and operated by Microsoft)
|
||||||
@ -339,7 +784,7 @@ The following example shows a sample call that instructs a managed device to com
|
|||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
## <a href="" id="prepare-health-data"></a>**Step 3: Instruct client to prepare health data for verification**
|
### <a href="" id="prepare-health-data"></a>**Step 3: Instruct client to prepare health data for verification**
|
||||||
|
|
||||||
|
|
||||||
Send a SyncML call to start collection of the DHA-Data.
|
Send a SyncML call to start collection of the DHA-Data.
|
||||||
@ -366,7 +811,7 @@ The following example shows a sample call that triggers collection and verificat
|
|||||||
</Get>
|
</Get>
|
||||||
```
|
```
|
||||||
|
|
||||||
## <a href="" id="take-action-client-response"></a>**Step 4: Take action based on the clients response**
|
### <a href="" id="take-action-client-response"></a>**Step 4: Take action based on the clients response**
|
||||||
|
|
||||||
|
|
||||||
After the client receives the health attestation request, it sends a response. The following list describes the responses, along with a recommended action to take.
|
After the client receives the health attestation request, it sends a response. The following list describes the responses, along with a recommended action to take.
|
||||||
@ -392,9 +837,9 @@ Here is a sample alert that is issued by DHA_CSP:
|
|||||||
</Item>
|
</Item>
|
||||||
</Alert>
|
</Alert>
|
||||||
```
|
```
|
||||||
- If the response to the status node is not 0, 1 or 3, then troubleshoot the issue. For the complete list of status codes see [Device HealthAttestation CSP status and error codes](#device-healthattestation-csp-status-and-error-codes).
|
- If the response to the status node is not 0, 1 or 3, then troubleshoot the issue. For the complete list of status codes, see [Device HealthAttestation CSP status and error codes](#device-healthattestation-csp-status-and-error-codes).
|
||||||
|
|
||||||
## <a href="" id="forward-health-attestation"></a>**Step 5: Instruct the client to forward health attestation data for verification**
|
### <a href="" id="forward-health-attestation"></a>**Step 5: Instruct the client to forward health attestation data for verification**
|
||||||
|
|
||||||
|
|
||||||
Create a call to the **Nonce**, **Certificate** and **CorrelationId** nodes, and pick up an encrypted payload that includes a health certificate and related data from the device.
|
Create a call to the **Nonce**, **Certificate** and **CorrelationId** nodes, and pick up an encrypted payload that includes a health certificate and related data from the device.
|
||||||
@ -431,7 +876,7 @@ Here is an example:
|
|||||||
</Get>
|
</Get>
|
||||||
```
|
```
|
||||||
|
|
||||||
## <a href="" id="forward-data-to-has"></a>**Step 6: Forward device health attestation data to DHA-service**
|
### <a href="" id="forward-data-to-has"></a>**Step 6: Forward device health attestation data to DHA-service**
|
||||||
|
|
||||||
|
|
||||||
In response to the request that was sent in the previous step, the MDM client forwards an XML formatted blob (response from ./Vendor/MSFT/HealthAttestation/Certificate node) and a call identifier called CorrelationId (response to ./Vendor/MSFT/HealthAttestation/CorrelationId node).
|
In response to the request that was sent in the previous step, the MDM client forwards an XML formatted blob (response from ./Vendor/MSFT/HealthAttestation/Certificate node) and a call identifier called CorrelationId (response to ./Vendor/MSFT/HealthAttestation/CorrelationId node).
|
||||||
@ -455,14 +900,14 @@ When the MDM-Server receives the above data, it must:
|
|||||||
- DHA-OnPrem or DHA-EMC: https://FullyQualifiedDomainName-FDQN/DeviceHealthAttestation/ValidateHealthCertificate/v3
|
- DHA-OnPrem or DHA-EMC: https://FullyQualifiedDomainName-FDQN/DeviceHealthAttestation/ValidateHealthCertificate/v3
|
||||||
|
|
||||||
|
|
||||||
## <a href="" id="receive-has-response"></a>**Step 7: Receive response from the DHA-service**
|
### <a href="" id="receive-has-response"></a>**Step 7: Receive response from the DHA-service**
|
||||||
|
|
||||||
When the Microsoft Device Health Attestation Service receives a request for verification, it performs the following steps:
|
When the Microsoft Device Health Attestation Service receives a request for verification, it performs the following steps:
|
||||||
- Decrypts the encrypted data it receives.
|
- Decrypts the encrypted data it receives.
|
||||||
- Validates the data it has received
|
- Validates the data it has received
|
||||||
- Creates a report, and shares the evaluation results to the MDM server via SSL in XML format
|
- Creates a report, and shares the evaluation results to the MDM server via SSL in XML format
|
||||||
|
|
||||||
## <a href="" id="take-policy-action"></a>**Step 8: Take appropriate policy action based on evaluation results**
|
### <a href="" id="take-policy-action"></a>**Step 8: Take appropriate policy action based on evaluation results**
|
||||||
|
|
||||||
|
|
||||||
After the MDM server receives the verified data, the information can be used to make policy decisions by evaluating the data. Some possible actions would be:
|
After the MDM server receives the verified data, the information can be used to make policy decisions by evaluating the data. Some possible actions would be:
|
||||||
@ -471,7 +916,7 @@ After the MDM server receives the verified data, the information can be used to
|
|||||||
- Allow the device to access the resources, but flag the device for further investigation.
|
- Allow the device to access the resources, but flag the device for further investigation.
|
||||||
- Prevent a device from accessing resources.
|
- Prevent a device from accessing resources.
|
||||||
|
|
||||||
The following list of data points are verified by the DHA-Service in DHA-Report version 3:
|
The following list of data points is verified by the DHA-Service in DHA-Report version 3:
|
||||||
|
|
||||||
- [Issued](#issued )
|
- [Issued](#issued )
|
||||||
- [AIKPresent](#aikpresent)
|
- [AIKPresent](#aikpresent)
|
||||||
@ -503,7 +948,7 @@ The following list of data points are verified by the DHA-Service in DHA-Report
|
|||||||
|
|
||||||
\* TPM 2.0 only
|
\* TPM 2.0 only
|
||||||
\*\* Reports if BitLocker was enabled during initial boot.
|
\*\* Reports if BitLocker was enabled during initial boot.
|
||||||
\*\*\* The “Hybrid Resume” must be disabled on the device. Reports 1st party ELAM “Defender” was loaded during boot.
|
\*\*\* The “Hybrid Resume” must be disabled on the device. Reports first-party ELAM “Defender” was loaded during boot.
|
||||||
|
|
||||||
Each of these are described in further detail in the following sections, along with the recommended actions to take.
|
Each of these are described in further detail in the following sections, along with the recommended actions to take.
|
||||||
|
|
||||||
@ -519,7 +964,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
|
|
||||||
- Disallow all access
|
- Disallow all access
|
||||||
- Disallow access to HBI assets
|
- Disallow access to HBI assets
|
||||||
- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a devices past activities and trust history.
|
- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history.
|
||||||
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
|
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
|
||||||
|
|
||||||
<a href="" id="resetcount"></a>**ResetCount** (Reported only for devices that support TPM 2.0)
|
<a href="" id="resetcount"></a>**ResetCount** (Reported only for devices that support TPM 2.0)
|
||||||
@ -544,7 +989,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
|
|
||||||
- Disallow all access
|
- Disallow all access
|
||||||
- Disallow access to HBI assets
|
- Disallow access to HBI assets
|
||||||
- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a devices past activities and trust history.
|
- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history.
|
||||||
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
|
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
|
||||||
|
|
||||||
<a href="" id="bitlockerstatus"></a>**BitLockerStatus** (at boot time)
|
<a href="" id="bitlockerstatus"></a>**BitLockerStatus** (at boot time)
|
||||||
@ -560,7 +1005,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
|
|
||||||
- Disallow all access
|
- Disallow all access
|
||||||
- Disallow access to HBI assets
|
- Disallow access to HBI assets
|
||||||
- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a devices past activities and trust history.
|
- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history.
|
||||||
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
|
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
|
||||||
|
|
||||||
<a href="" id="bootmanagerrevlistversion"></a>**BootManagerRevListVersion**
|
<a href="" id="bootmanagerrevlistversion"></a>**BootManagerRevListVersion**
|
||||||
@ -573,7 +1018,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
- Disallow all access
|
- Disallow all access
|
||||||
- Disallow access to HBI and MBI assets
|
- Disallow access to HBI and MBI assets
|
||||||
- Place the device in a watch list to monitor the device more closely for potential risks.
|
- Place the device in a watch list to monitor the device more closely for potential risks.
|
||||||
- Trigger a corrective action, such as such as informing the technical support team to contact the owner investigate the issue.
|
- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue.
|
||||||
|
|
||||||
<a href="" id="codeintegrityrevlistversion"></a>**CodeIntegrityRevListVersion**
|
<a href="" id="codeintegrityrevlistversion"></a>**CodeIntegrityRevListVersion**
|
||||||
<p>This attribute indicates the version of the code that is performing integrity checks during the boot sequence. Using this attribute can help you detect if the device is running the latest version of the code that performs integrity checks, or if it is exposed to security risks (revoked) and enforce an appropriate policy action.</p>
|
<p>This attribute indicates the version of the code that is performing integrity checks during the boot sequence. Using this attribute can help you detect if the device is running the latest version of the code that performs integrity checks, or if it is exposed to security risks (revoked) and enforce an appropriate policy action.</p>
|
||||||
@ -585,7 +1030,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
- Disallow all access
|
- Disallow all access
|
||||||
- Disallow access to HBI and MBI assets
|
- Disallow access to HBI and MBI assets
|
||||||
- Place the device in a watch list to monitor the device more closely for potential risks.
|
- Place the device in a watch list to monitor the device more closely for potential risks.
|
||||||
- Trigger a corrective action, such as such as informing the technical support team to contact the owner investigate the issue.
|
- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue.
|
||||||
|
|
||||||
<a href="" id="securebootenabled"></a>**SecureBootEnabled**
|
<a href="" id="securebootenabled"></a>**SecureBootEnabled**
|
||||||
<p>When Secure Boot is enabled the core components used to boot the machine must have correct cryptographic signatures that are trusted by the organization that manufactured the device. The UEFI firmware verifies this before it lets the machine start. If any files have been tampered with, breaking their signature, the system will not boot.</p>
|
<p>When Secure Boot is enabled the core components used to boot the machine must have correct cryptographic signatures that are trusted by the organization that manufactured the device. The UEFI firmware verifies this before it lets the machine start. If any files have been tampered with, breaking their signature, the system will not boot.</p>
|
||||||
@ -596,11 +1041,11 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
|
|
||||||
- Disallow all access
|
- Disallow all access
|
||||||
- Disallow access to HBI assets
|
- Disallow access to HBI assets
|
||||||
- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a devices past activities and trust history.
|
- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history.
|
||||||
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
|
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
|
||||||
|
|
||||||
<a href="" id="bootdebuggingenabled"></a>**BootDebuggingEnabled**
|
<a href="" id="bootdebuggingenabled"></a>**BootDebuggingEnabled**
|
||||||
<p>Boot debug enabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: the device may run unstable code, or be configured with fewer security restrictions that is required for testing and development.</p>
|
<p>Boot debug-enabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: the device may run unstable code, or be configured with fewer security restrictions that is required for testing and development.</p>
|
||||||
|
|
||||||
<p>Boot debugging can be disabled or enabled by using the following commands in WMI or a PowerShell script:</p>
|
<p>Boot debugging can be disabled or enabled by using the following commands in WMI or a PowerShell script:</p>
|
||||||
|
|
||||||
@ -626,7 +1071,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
- Disallow all access
|
- Disallow all access
|
||||||
- Disallow access to HBI assets
|
- Disallow access to HBI assets
|
||||||
- Place the device in a watch list to monitor the device more closely for potential risks.
|
- Place the device in a watch list to monitor the device more closely for potential risks.
|
||||||
- Trigger a corrective action, such as such as informing the technical support team to contact the owner investigate the issue.
|
- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue.
|
||||||
|
|
||||||
<a href="" id="codeintegrityenabled"></a>**CodeIntegrityEnabled**
|
<a href="" id="codeintegrityenabled"></a>**CodeIntegrityEnabled**
|
||||||
<p>When code integrity is enabled, code execution is restricted to integrity verified code.</p>
|
<p>When code integrity is enabled, code execution is restricted to integrity verified code.</p>
|
||||||
@ -641,7 +1086,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
|
|
||||||
- Disallow all access
|
- Disallow all access
|
||||||
- Disallow access to HBI assets
|
- Disallow access to HBI assets
|
||||||
- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a devices past activities and trust history.
|
- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history.
|
||||||
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
|
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
|
||||||
|
|
||||||
<a href="" id="testsigningenabled"></a>**TestSigningEnabled**
|
<a href="" id="testsigningenabled"></a>**TestSigningEnabled**
|
||||||
@ -680,11 +1125,11 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
<p>If WinPE = 1 (True), then limit access to remote resources that are required for Windows OS installation.</p>
|
<p>If WinPE = 1 (True), then limit access to remote resources that are required for Windows OS installation.</p>
|
||||||
|
|
||||||
<a href="" id="elamdriverloaded"></a>**ELAMDriverLoaded** (Windows Defender)
|
<a href="" id="elamdriverloaded"></a>**ELAMDriverLoaded** (Windows Defender)
|
||||||
<p>To use this reporting feature you must disable "Hybrid Resume" on the device. Early launch anti-malware (ELAM) provides protection for the computers in your network when they start up and before third-party drivers initialize.</p>
|
<p>To use this reporting feature, you must disable "Hybrid Resume" on the device. Early launch anti-malware (ELAM) provides protection for the computers in your network when they start up and before third-party drivers initialize.</p>
|
||||||
|
|
||||||
<p>In the current release, this attribute only monitors/reports if a Microsoft 1st party ELAM (Windows Defender) was loaded during initial boot.</p>
|
<p>In the current release, this attribute only monitors/reports if a Microsoft first-party ELAM (Windows Defender) was loaded during initial boot.</p>
|
||||||
|
|
||||||
<p>If a device is expected to use a 3rd party antivirus program, ignore the reported state.</p>
|
<p>If a device is expected to use a third-party antivirus program, ignore the reported state.</p>
|
||||||
|
|
||||||
<p>If a device is expected to use Windows Defender and ELAMDriverLoaded = 1 (True), then allow access.</p>
|
<p>If a device is expected to use Windows Defender and ELAMDriverLoaded = 1 (True), then allow access.</p>
|
||||||
|
|
||||||
@ -705,7 +1150,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue.
|
- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue.
|
||||||
|
|
||||||
<a href="" id="vsmenabled"></a>**VSMEnabled**
|
<a href="" id="vsmenabled"></a>**VSMEnabled**
|
||||||
<p>Virtual Secure Mode (VSM) is a container that protects high value assets from a compromised kernel. VSM requires about 1GB of memory – it has just enough capability to run the LSA service that is used for all authentication brokering.</p>
|
<p>Virtual Secure Mode (VSM) is a container that protects high value assets from a compromised kernel. VSM requires about 1 GB of memory – it has enough capability to run the LSA service that is used for all authentication brokering.</p>
|
||||||
|
|
||||||
<p>VSM can be enabled by using the following command in WMI or a PowerShell script:</p>
|
<p>VSM can be enabled by using the following command in WMI or a PowerShell script:</p>
|
||||||
|
|
||||||
@ -760,7 +1205,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
<a href="" id="pcr0"></a>**PCR0**
|
<a href="" id="pcr0"></a>**PCR0**
|
||||||
<p>The measurement that is captured in PCR[0] typically represents a consistent view of the Host Platform between boot cycles. It contains a measurement of components that are provided by the host platform manufacturer.</p>
|
<p>The measurement that is captured in PCR[0] typically represents a consistent view of the Host Platform between boot cycles. It contains a measurement of components that are provided by the host platform manufacturer.</p>
|
||||||
|
|
||||||
<p>Enterprise managers can create a allow list of trusted PCR[0] values, compare the PCR[0] value of the managed devices (the value that is verified and reported by HAS) with the allow list, and then make a trust decision based on the result of the comparison.</p>
|
<p>Enterprise managers can create an allow list of trusted PCR[0] values, compare the PCR[0] value of the managed devices (the value that is verified and reported by HAS) with the allow list, and then make a trust decision based on the result of the comparison.</p>
|
||||||
|
|
||||||
<p>If your enterprise does not have a allow list of accepted PCR[0] values, then take no action.</p>
|
<p>If your enterprise does not have a allow list of accepted PCR[0] values, then take no action.</p>
|
||||||
|
|
||||||
@ -776,7 +1221,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
|
|
||||||
<p>If SBCPHash is not present, or is an accepted allow-listed value, then allow access.
|
<p>If SBCPHash is not present, or is an accepted allow-listed value, then allow access.
|
||||||
|
|
||||||
<p>If SBCPHash is present in DHA-Report, and is not a allow-listed value, then take one of the following actions that align with your enterprise policies:</p>
|
<p>If SBCPHash is present in DHA-Report, and is not an allow-listed value, then take one of the following actions that align with your enterprise policies:</p>
|
||||||
|
|
||||||
- Disallow all access
|
- Disallow all access
|
||||||
- Place the device in a watch list to monitor the device more closely for potential risks.
|
- Place the device in a watch list to monitor the device more closely for potential risks.
|
||||||
@ -786,7 +1231,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
|
|
||||||
<p>If CIPolicy is not present, or is an accepted allow-listed value, then allow access.</p>
|
<p>If CIPolicy is not present, or is an accepted allow-listed value, then allow access.</p>
|
||||||
|
|
||||||
<p>If CIPolicy is present and is not a allow-listed value, then take one of the following actions that align with your enterprise policies:</p>
|
<p>If CIPolicy is present and is not an allow-listed value, then take one of the following actions that align with your enterprise policies:</p>
|
||||||
|
|
||||||
- Disallow all access
|
- Disallow all access
|
||||||
- Place the device in a watch list to monitor the device more closely for potential risks.
|
- Place the device in a watch list to monitor the device more closely for potential risks.
|
||||||
@ -816,7 +1261,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
|
|
||||||
<p>In case of a detected issue a list of impacted DHA-report elements will be listed under the HealthStatusMismatchFlags attribute.</p>
|
<p>In case of a detected issue a list of impacted DHA-report elements will be listed under the HealthStatusMismatchFlags attribute.</p>
|
||||||
|
|
||||||
## **Device HealthAttestation CSP status and error codes**
|
### **Device HealthAttestation CSP status and error codes**
|
||||||
|
|
||||||
<table>
|
<table>
|
||||||
<tr>
|
<tr>
|
||||||
@ -962,7 +1407,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
<tr>
|
<tr>
|
||||||
<td>27</td>
|
<td>27</td>
|
||||||
<td>HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_HTTPHANDLE</td>
|
<td>HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_HTTPHANDLE</td>
|
||||||
<td>DHA-CSP failed to create a HTTP request handle.</td>
|
<td>DHA-CSP failed to create an HTTP request handle.</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>28</td>
|
<td>28</td>
|
||||||
@ -997,7 +1442,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
<tr>
|
<tr>
|
||||||
<td>34</td>
|
<td>34</td>
|
||||||
<td>HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_MISSING_RESPONSE</td>
|
<td>HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_MISSING_RESPONSE</td>
|
||||||
<td>DHA-CSP received an empty response along with a HTTP error code from DHA-Service.</td>
|
<td>DHA-CSP received an empty response along with an HTTP error code from DHA-Service.</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>35</td>
|
<td>35</td>
|
||||||
@ -1027,7 +1472,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
|
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
## DHA-Report V3 schema
|
### DHA-Report V3 schema
|
||||||
|
|
||||||
|
|
||||||
```xml
|
```xml
|
||||||
@ -1131,7 +1576,7 @@ Each of these are described in further detail in the following sections, along w
|
|||||||
</xs:schema>
|
</xs:schema>
|
||||||
```
|
```
|
||||||
|
|
||||||
## DHA-Report example
|
### DHA-Report example
|
||||||
|
|
||||||
|
|
||||||
```xml
|
```xml
|
||||||
|
|||||||
@ -22,193 +22,430 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
|
|||||||
The XML below is the current version for this CSP.
|
The XML below is the current version for this CSP.
|
||||||
|
|
||||||
```xml
|
```xml
|
||||||
<?xml version="1.0" encoding="UTF-8"?>
|
<?xml version='1.0' encoding='utf-8' standalone='yes'?>
|
||||||
<!DOCTYPE MgmtTree PUBLIC " -//OMA//DTD-DM-DDF 1.2//EN"
|
<identity
|
||||||
"http://www.openmobilealliance.org/tech/DTD/DM_DDF-V1_2.dtd"
|
xmlns="urn:Microsoft.CompPlat/ManifestSchema.v1.00"
|
||||||
[<?oma-dm-ddf-ver supported-versions="1.2"?>]>
|
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
|
||||||
<MgmtTree xmlns:MSFT="http://schemas.microsoft.com/MobileDevice/DM">
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||||
<VerDTD>1.2</VerDTD>
|
owner="Microsoft"
|
||||||
<Node>
|
namespace="Windows-DeviceManagement-CspDefinition"
|
||||||
|
name="HealthAttestation">
|
||||||
|
<cspDefinition>
|
||||||
|
<MgmtTree>
|
||||||
|
<VerDTD>1.2</VerDTD>
|
||||||
|
<BinaryPath>$(runtime.windows)\system32\hascsp.dll</BinaryPath>
|
||||||
|
<Diagnostics></Diagnostics>
|
||||||
|
<ComClsid>{9DCCCE22-C057-424E-B8D1-67935988B174}</ComClsid>
|
||||||
|
<Node>
|
||||||
<NodeName>HealthAttestation</NodeName>
|
<NodeName>HealthAttestation</NodeName>
|
||||||
<Path>./Vendor/MSFT</Path>
|
<Path>./Vendor/MSFT</Path>
|
||||||
<DFProperties>
|
<DFProperties>
|
||||||
<AccessType>
|
<AccessType>
|
||||||
<Get />
|
<Get />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<DFFormat>
|
<Description>The root node for the device HealthAttestation configuration service provider.</Description>
|
||||||
<node />
|
<DFFormat>
|
||||||
</DFFormat>
|
<node />
|
||||||
<Occurrence>
|
</DFFormat>
|
||||||
<One />
|
<Occurrence>
|
||||||
</Occurrence>
|
<One />
|
||||||
<Scope>
|
</Occurrence>
|
||||||
<Permanent />
|
<Scope>
|
||||||
</Scope>
|
<Permanent />
|
||||||
<DFType>
|
</Scope>
|
||||||
<MIME>com.microsoft/1.2/MDM/HealthAttestation</MIME>
|
<DFType>
|
||||||
</DFType>
|
<MIME>com.microsoft/1.4/MDM/HealthAttestation</MIME>
|
||||||
|
</DFType>
|
||||||
|
<Applicability>
|
||||||
|
<OsBuildVersion>10.0.10586</OsBuildVersion>
|
||||||
|
<CspVersion>1.0</CspVersion>
|
||||||
|
</Applicability>
|
||||||
|
<ExposedTo>
|
||||||
|
<Wmi />
|
||||||
|
<Mdm />
|
||||||
|
</ExposedTo>
|
||||||
</DFProperties>
|
</DFProperties>
|
||||||
<Node>
|
<Node>
|
||||||
<NodeName>VerifyHealth</NodeName>
|
<NodeName>VerifyHealth</NodeName>
|
||||||
<DFProperties>
|
<DFProperties>
|
||||||
<AccessType>
|
<AccessType>
|
||||||
<Exec />
|
<Exec />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<DFFormat>
|
<Description>Notifies the device to prepare a device health verification request.</Description>
|
||||||
<null />
|
<DFFormat>
|
||||||
</DFFormat>
|
<null />
|
||||||
<Occurrence>
|
</DFFormat>
|
||||||
<One />
|
<Occurrence>
|
||||||
</Occurrence>
|
<One />
|
||||||
<Scope>
|
</Occurrence>
|
||||||
<Permanent />
|
<Scope>
|
||||||
</Scope>
|
<Permanent />
|
||||||
</DFProperties>
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
<OneTimeExecution />
|
||||||
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
<Node>
|
<Node>
|
||||||
<NodeName>Status</NodeName>
|
<NodeName>Status</NodeName>
|
||||||
<DFProperties>
|
<DFProperties>
|
||||||
<AccessType>
|
<AccessType>
|
||||||
<Get />
|
<Get />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<DFFormat>
|
<Description>Provides the current status of the device health request. For the complete list of status see https://docs.microsoft.com/en-us/windows/client-management/mdm/healthattestation-csp#device-healthattestation-csp-status-and-error-codes</Description>
|
||||||
<int />
|
<DFFormat>
|
||||||
</DFFormat>
|
<int />
|
||||||
<Occurrence>
|
</DFFormat>
|
||||||
<One />
|
<Occurrence>
|
||||||
</Occurrence>
|
<One />
|
||||||
<Scope>
|
</Occurrence>
|
||||||
<Permanent />
|
<Scope>
|
||||||
</Scope>
|
<Permanent />
|
||||||
<DFType>
|
</Scope>
|
||||||
<MIME>text/plain</MIME>
|
<DFType>
|
||||||
</DFType>
|
<MIME>text/plain</MIME>
|
||||||
</DFProperties>
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
<Node>
|
<Node>
|
||||||
<NodeName>ForceRetrieve</NodeName>
|
<NodeName>ForceRetrieve</NodeName>
|
||||||
<DFProperties>
|
<DFProperties>
|
||||||
<AccessType>
|
<AccessType>
|
||||||
<Get />
|
<Get />
|
||||||
<Replace />
|
<Replace />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<DefaultValue>False</DefaultValue>
|
<DefaultValue>False</DefaultValue>
|
||||||
<DFFormat>
|
<Description>Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service.</Description>
|
||||||
<bool />
|
<DFFormat>
|
||||||
</DFFormat>
|
<bool />
|
||||||
<Occurrence>
|
</DFFormat>
|
||||||
<One />
|
<Occurrence>
|
||||||
</Occurrence>
|
<One />
|
||||||
<Scope>
|
</Occurrence>
|
||||||
<Permanent />
|
<Scope>
|
||||||
</Scope>
|
<Permanent />
|
||||||
<DFType>
|
</Scope>
|
||||||
<MIME>text/plain</MIME>
|
<DFType>
|
||||||
</DFType>
|
<MIME>text/plain</MIME>
|
||||||
</DFProperties>
|
</DFType>
|
||||||
|
<AllowedValues ValueType="ENUM">
|
||||||
|
<Enum>
|
||||||
|
<Value>false</Value>
|
||||||
|
<ValueDescription>False</ValueDescription>
|
||||||
|
</Enum>
|
||||||
|
<Enum>
|
||||||
|
<Value>true</Value>
|
||||||
|
<ValueDescription>True</ValueDescription>
|
||||||
|
</Enum>
|
||||||
|
</AllowedValues>
|
||||||
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
<Node>
|
<Node>
|
||||||
<NodeName>Certificate</NodeName>
|
<NodeName>Certificate</NodeName>
|
||||||
<DFProperties>
|
<DFProperties>
|
||||||
<AccessType>
|
<AccessType>
|
||||||
<Get />
|
<Get />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<DFFormat>
|
<Description>Instructs the DHA-CSP to forward DHA-Data to the MDM server.</Description>
|
||||||
<b64 />
|
<DFFormat>
|
||||||
</DFFormat>
|
<chr />
|
||||||
<Occurrence>
|
</DFFormat>
|
||||||
<One />
|
<Occurrence>
|
||||||
</Occurrence>
|
<One />
|
||||||
<Scope>
|
</Occurrence>
|
||||||
<Permanent />
|
<Scope>
|
||||||
</Scope>
|
<Permanent />
|
||||||
<DFType>
|
</Scope>
|
||||||
<DDFName></DDFName>
|
<DFType>
|
||||||
</DFType>
|
<MIME>text/plain</MIME>
|
||||||
</DFProperties>
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
<Node>
|
<Node>
|
||||||
<NodeName>Nonce</NodeName>
|
<NodeName>Nonce</NodeName>
|
||||||
<DFProperties>
|
<DFProperties>
|
||||||
<AccessType>
|
<AccessType>
|
||||||
<Get />
|
<Get />
|
||||||
<Replace />
|
<Replace />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<DefaultValue>\0</DefaultValue>
|
<DefaultValue>\0</DefaultValue>
|
||||||
<DFFormat>
|
<Description>Enables MDMs to protect the device health attestation communications from man-in-the-middle type (MITM) attacks with a crypt-protected random value that is generated by the MDM Server. The nonce is in hex format, with a minimum size of 8 bytes, and a maximum size of 32 bytes.</Description>
|
||||||
<chr />
|
<DFFormat>
|
||||||
</DFFormat>
|
<chr />
|
||||||
<Occurrence>
|
</DFFormat>
|
||||||
<One />
|
<Occurrence>
|
||||||
</Occurrence>
|
<One />
|
||||||
<Scope>
|
</Occurrence>
|
||||||
<Permanent />
|
<Scope>
|
||||||
</Scope>
|
<Permanent />
|
||||||
<DFType>
|
</Scope>
|
||||||
<MIME>text/plain</MIME>
|
<DFType>
|
||||||
</DFType>
|
<MIME>text/plain</MIME>
|
||||||
</DFProperties>
|
</DFType>
|
||||||
|
<AllowedValues ValueType="None">
|
||||||
|
</AllowedValues>
|
||||||
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
<Node>
|
<Node>
|
||||||
<NodeName>CorrelationID</NodeName>
|
<NodeName>CorrelationID</NodeName>
|
||||||
<DFProperties>
|
<DFProperties>
|
||||||
<AccessType>
|
<AccessType>
|
||||||
<Get />
|
<Get />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<DFFormat>
|
<Description>Identifies a unique device health attestation session. CorrelationId is used to correlate DHA-Service logs with the MDM server events and Client event logs for debug and troubleshooting.</Description>
|
||||||
<chr />
|
<DFFormat>
|
||||||
</DFFormat>
|
<chr />
|
||||||
<Occurrence>
|
</DFFormat>
|
||||||
<One />
|
<Occurrence>
|
||||||
</Occurrence>
|
<One />
|
||||||
<Scope>
|
</Occurrence>
|
||||||
<Permanent />
|
<Scope>
|
||||||
</Scope>
|
<Permanent />
|
||||||
<DFType>
|
</Scope>
|
||||||
<MIME>text/plain</MIME>
|
<DFType>
|
||||||
</DFType>
|
<MIME>text/plain</MIME>
|
||||||
</DFProperties>
|
</DFType>
|
||||||
|
<AllowedValues ValueType="None">
|
||||||
|
</AllowedValues>
|
||||||
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
<Node>
|
<Node>
|
||||||
<NodeName>HASEndpoint</NodeName>
|
<NodeName>HASEndpoint</NodeName>
|
||||||
<DFProperties>
|
<DFProperties>
|
||||||
<AccessType>
|
<AccessType>
|
||||||
<Get />
|
<Get />
|
||||||
<Replace />
|
<Replace />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<DFFormat>
|
<DefaultValue>has.spserv.microsoft.com.</DefaultValue>
|
||||||
<chr />
|
<Description>Identifies the fully qualified domain name (FQDN) of the DHA-Service that is assigned to perform attestation. If an FQDN is not assigned, DHA-Cloud (Microsoft owned and operated cloud service) will be used as the default attestation service.</Description>
|
||||||
</DFFormat>
|
<DFFormat>
|
||||||
<Scope>
|
<chr />
|
||||||
<Permanent />
|
</DFFormat>
|
||||||
</Scope>
|
<Occurrence>
|
||||||
<DFType>
|
<One />
|
||||||
<MIME>text/plain</MIME>
|
</Occurrence>
|
||||||
</DFType>
|
<Scope>
|
||||||
</DFProperties>
|
<Permanent />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
<AllowedValues ValueType="None">
|
||||||
|
</AllowedValues>
|
||||||
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
<Node>
|
<Node>
|
||||||
<NodeName>TpmReadyStatus</NodeName>
|
<NodeName>TpmReadyStatus</NodeName>
|
||||||
<DFProperties>
|
<DFProperties>
|
||||||
<AccessType>
|
<AccessType>
|
||||||
<Get />
|
<Get />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<DFFormat>
|
<Description> Returns a bitmask of information describing the state of TPM. It indicates whether the TPM of the device is in a ready and trusted state.</Description>
|
||||||
<int />
|
<DFFormat>
|
||||||
</DFFormat>
|
<int />
|
||||||
<Occurrence>
|
</DFFormat>
|
||||||
<One />
|
<Occurrence>
|
||||||
</Occurrence>
|
<One />
|
||||||
<Scope>
|
</Occurrence>
|
||||||
<Permanent />
|
<Scope>
|
||||||
</Scope>
|
<Permanent />
|
||||||
<DFType>
|
</Scope>
|
||||||
<MIME>text/plain</MIME>
|
<DFType>
|
||||||
</DFType>
|
<MIME>text/plain</MIME>
|
||||||
</DFProperties>
|
</DFType>
|
||||||
|
<Applicability>
|
||||||
|
<OsBuildVersion>10.0.14393</OsBuildVersion>
|
||||||
|
<CspVersion>1.1</CspVersion>
|
||||||
|
</Applicability>
|
||||||
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
</Node>
|
<Node>
|
||||||
</MgmtTree>
|
<NodeName>CurrentProtocolVersion</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Provides the current protocol version that the client is using to communicate with the Health Attestation Service.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<int />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Permanent />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
<Applicability>
|
||||||
|
<OsBuildVersion>10.0.16299</OsBuildVersion>
|
||||||
|
<CspVersion>1.3</CspVersion>
|
||||||
|
</Applicability>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>PreferredMaxProtocolVersion</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
<Replace />
|
||||||
|
</AccessType>
|
||||||
|
<DefaultValue>3</DefaultValue>
|
||||||
|
<Description>Provides the maximum preferred protocol version that the client is configured to communicate over. If this is higher than the protocol versions supported by the client it will use the highest protocol version available to it.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<int />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Permanent />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
<Applicability>
|
||||||
|
<OsBuildVersion>10.0.16299</OsBuildVersion>
|
||||||
|
<CspVersion>1.3</CspVersion>
|
||||||
|
</Applicability>
|
||||||
|
<AllowedValues ValueType="None">
|
||||||
|
</AllowedValues>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>MaxSupportedProtocolVersion</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Returns the maximum protocol version that this client can support.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<int />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Permanent />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
<Applicability>
|
||||||
|
<OsBuildVersion>10.0.16299</OsBuildVersion>
|
||||||
|
<CspVersion>1.3</CspVersion>
|
||||||
|
</Applicability>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>TriggerAttestation</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Exec />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Notifies the device to trigger an attestation session asynchronously.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<chr />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Permanent />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
<Applicability>
|
||||||
|
<OsBuildVersion>99.9.99999</OsBuildVersion>
|
||||||
|
<CspVersion>1.4</CspVersion>
|
||||||
|
</Applicability>
|
||||||
|
<AsynchronousTracking ResourceSuccessURI="AttestStatus" />
|
||||||
|
<OneTimeExecution />
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>GetAttestReport</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Retrieve attestation session report if exists.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<chr />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Permanent />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<DDFName></DDFName>
|
||||||
|
</DFType>
|
||||||
|
<Applicability>
|
||||||
|
<OsBuildVersion>99.9.99999</OsBuildVersion>
|
||||||
|
<CspVersion>1.4</CspVersion>
|
||||||
|
</Applicability>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>AttestStatus</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>AttestStatus maintains the success or failure status code for the last attestation session.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<int />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Permanent />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
<Applicability>
|
||||||
|
<OsBuildVersion>99.9.99999</OsBuildVersion>
|
||||||
|
<CspVersion>1.4</CspVersion>
|
||||||
|
</Applicability>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>GetServiceCorrelationIDs</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Retrieve service correlation IDs if exist.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<chr />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Permanent />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<DDFName></DDFName>
|
||||||
|
</DFType>
|
||||||
|
<Applicability>
|
||||||
|
<OsBuildVersion>99.9.99999</OsBuildVersion>
|
||||||
|
<CspVersion>1.4</CspVersion>
|
||||||
|
</Applicability>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
</Node>
|
||||||
|
</MgmtTree>
|
||||||
|
</cspDefinition>
|
||||||
|
</identity>
|
||||||
|
|
||||||
|
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|||||||
BIN
windows/client-management/mdm/images/maa-attestation-flow.png
Normal file
BIN
windows/client-management/mdm/images/maa-attestation-flow.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 81 KiB |
@ -1,6 +1,6 @@
|
|||||||
---
|
---
|
||||||
title: Mobile device management
|
title: Mobile device management
|
||||||
description: Windows 10 provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy
|
description: Windows 10 and Windows 11 provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy
|
||||||
MS-HAID:
|
MS-HAID:
|
||||||
- 'p\_phDeviceMgmt.provisioning\_and\_device\_management'
|
- 'p\_phDeviceMgmt.provisioning\_and\_device\_management'
|
||||||
- 'p\_phDeviceMgmt.mobile\_device\_management\_windows\_mdm'
|
- 'p\_phDeviceMgmt.mobile\_device\_management\_windows\_mdm'
|
||||||
@ -15,9 +15,9 @@ author: dansimp
|
|||||||
# Mobile device management
|
# Mobile device management
|
||||||
|
|
||||||
|
|
||||||
Windows 10 provides an enterprise management solution to help IT pros manage company security policies and business applications, while avoiding compromise of the users’ privacy on their personal devices. A built-in management component can communicate with the management server.
|
Windows 10 and Windows 11 provides an enterprise management solution to help IT pros manage company security policies and business applications, while avoiding compromise of the users’ privacy on their personal devices. A built-in management component can communicate with the management server.
|
||||||
|
|
||||||
There are two parts to the Windows 10 management component:
|
There are two parts to the Windows management component:
|
||||||
|
|
||||||
- The enrollment client, which enrolls and configures the device to communicate with the enterprise management server.
|
- The enrollment client, which enrolls and configures the device to communicate with the enterprise management server.
|
||||||
- The management client, which periodically synchronizes with the management server to check for updates and apply the latest policies set by IT.
|
- The management client, which periodically synchronizes with the management server to check for updates and apply the latest policies set by IT.
|
||||||
|
|||||||
@ -39,7 +39,7 @@ You can view the dynamic port range on a computer by using the following netsh c
|
|||||||
|
|
||||||
The range is set separately for each transport (TCP or UDP). The port range is now a range that has a starting point and an ending point. Microsoft customers who deploy servers that are running Windows Server may have problems that affect RPC communication between servers if firewalls are used on the internal network. In these situations, we recommend that you reconfigure the firewalls to allow traffic between servers in the dynamic port range of **49152** through **65535**. This range is in addition to well-known ports that are used by services and applications. Or, the port range that is used by the servers can be modified on each server. You adjust this range by using the netsh command, as follows. The above command sets the dynamic port range for TCP.
|
The range is set separately for each transport (TCP or UDP). The port range is now a range that has a starting point and an ending point. Microsoft customers who deploy servers that are running Windows Server may have problems that affect RPC communication between servers if firewalls are used on the internal network. In these situations, we recommend that you reconfigure the firewalls to allow traffic between servers in the dynamic port range of **49152** through **65535**. This range is in addition to well-known ports that are used by services and applications. Or, the port range that is used by the servers can be modified on each server. You adjust this range by using the netsh command, as follows. The above command sets the dynamic port range for TCP.
|
||||||
|
|
||||||
```cmd
|
```console
|
||||||
netsh int <ipv4|ipv6> set dynamic <tcp|udp> start=number num=range
|
netsh int <ipv4|ipv6> set dynamic <tcp|udp> start=number num=range
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -58,7 +58,7 @@ Since outbound connections start to fail, you will see a lot of the below behavi
|
|||||||
|
|
||||||
- Unable to sign in to the machine with domain credentials, however sign-in with local account works. Domain sign-in will require you to contact the DC for authentication which is again an outbound connection. If you have cache credentials set, then domain sign-in might still work.
|
- Unable to sign in to the machine with domain credentials, however sign-in with local account works. Domain sign-in will require you to contact the DC for authentication which is again an outbound connection. If you have cache credentials set, then domain sign-in might still work.
|
||||||
|
|
||||||
|
:::image type="content" alt-text="Screenshot of error for NETLOGON in Event Viewer." source="images/tcp-ts-14.png" lightbox="images/tcp-ts-14.png":::
|
||||||
|
|
||||||
- Group Policy update failures:
|
- Group Policy update failures:
|
||||||
|
|
||||||
@ -82,32 +82,32 @@ If you suspect that the machine is in a state of port exhaustion:
|
|||||||
|
|
||||||
2. Open event viewer and under the system logs, look for the events which clearly indicate the current state:
|
2. Open event viewer and under the system logs, look for the events which clearly indicate the current state:
|
||||||
|
|
||||||
a. **Event ID 4227**
|
1. **Event ID 4227**
|
||||||
|
|
||||||
|
:::image type="content" alt-text="Screenshot of event ID 4227 in Event Viewer." source="images/tcp-ts-18.png" lightbox="images/tcp-ts-18.png":::
|
||||||
|
|
||||||
b. **Event ID 4231**
|
1. **Event ID 4231**
|
||||||
|
|
||||||
|
:::image type="content" alt-text="Screenshot of event ID 4231 in Event Viewer." source="images/tcp-ts-19.png" lightbox="images/tcp-ts-19.png":::
|
||||||
|
|
||||||
3. Collect a `netstat -anob` output from the server. The netstat output will show you a huge number of entries for TIME_WAIT state for a single PID.
|
3. Collect a `netstat -anob` output from the server. The netstat output will show you a huge number of entries for TIME_WAIT state for a single PID.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
After a graceful closure or an abrupt closure of a session, after a period of 4 minutes (default), the port used the process or application would be released back to the available pool. During this 4 minutes, the TCP connection state will be TIME_WAIT state. In a situation where you suspect port exhaustion, an application or process will not be able to release all the ports that it has consumed and will remain in the TIME_WAIT state.
|
After a graceful closure or an abrupt closure of a session, after a period of 4 minutes (default), the port used the process or application would be released back to the available pool. During this 4 minutes, the TCP connection state will be TIME_WAIT state. In a situation where you suspect port exhaustion, an application or process will not be able to release all the ports that it has consumed and will remain in the TIME_WAIT state.
|
||||||
|
|
||||||
You may also see CLOSE_WAIT state connections in the same output, however CLOSE_WAIT state is a state when one side of the TCP peer has no more data to send (FIN sent) but is able to receive data from the other end. This state does not necessarily indicate port exhaustion.
|
You may also see CLOSE_WAIT state connections in the same output, however CLOSE_WAIT state is a state when one side of the TCP peer has no more data to send (FIN sent) but is able to receive data from the other end. This state does not necessarily indicate port exhaustion.
|
||||||
|
|
||||||
>[!Note]
|
>[!Note]
|
||||||
>Having huge connections in TIME_WAIT state does not always indicate that the server is currently out of ports unless the first two points are verified. Having lot of TIME_WAIT connections does indicate that the process is creating lot of TCP connections and may eventually lead to port exhaustion.
|
>Having huge connections in TIME_WAIT state does not always indicate that the server is currently out of ports unless the first two points are verified. Having lot of TIME_WAIT connections does indicate that the process is creating lot of TCP connections and may eventually lead to port exhaustion.
|
||||||
>
|
>
|
||||||
>Netstat has been updated in Windows 10 with the addition of the **-Q** switch to show ports that have transitioned out of time wait as in the BOUND state. An update for Windows 8.1 and Windows Server 2012 R2 has been released that contains this functionality. The PowerShell cmdlet `Get-NetTCPConnection` in Windows 10 also shows these BOUND ports.
|
>Netstat has been updated in Windows 10 with the addition of the **-Q** switch to show ports that have transitioned out of time wait as in the BOUND state. An update for Windows 8.1 and Windows Server 2012 R2 has been released that contains this functionality. The PowerShell cmdlet `Get-NetTCPConnection` in Windows 10 also shows these BOUND ports.
|
||||||
>
|
>
|
||||||
>Until 10/2016, netstat was inaccurate. Fixes for netstat, back-ported to 2012 R2, allowed Netstat.exe and Get-NetTcpConnection to correctly report TCP or UDP port usage in Windows Server 2012 R2. See [Windows Server 2012 R2: Ephemeral ports hotfixes](https://support.microsoft.com/help/3123245/update-improves-port-exhaustion-identification-in-windows-server-2012) to learn more.
|
>Until 10/2016, netstat was inaccurate. Fixes for netstat, back-ported to 2012 R2, allowed Netstat.exe and Get-NetTcpConnection to correctly report TCP or UDP port usage in Windows Server 2012 R2. See [Windows Server 2012 R2: Ephemeral ports hotfixes](https://support.microsoft.com/help/3123245/update-improves-port-exhaustion-identification-in-windows-server-2012) to learn more.
|
||||||
|
|
||||||
4. Open a command prompt in admin mode and run the below command
|
4. Open a command prompt in admin mode and run the below command
|
||||||
|
|
||||||
```cmd
|
```console
|
||||||
Netsh trace start scenario=netconnection capture=yes tracefile=c:\Server.etl
|
Netsh trace start scenario=netconnection capture=yes tracefile=c:\Server.etl
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -119,15 +119,15 @@ The key is to identify which process or application is using all the ports. Belo
|
|||||||
|
|
||||||
### Method 1
|
### Method 1
|
||||||
|
|
||||||
Start by looking at the netstat output. If you are using Windows 10 or Windows Server 2016, then you can run the command `netstat -anobq` and check for the process ID which has maximum entries as BOUND. Alternately, you can also run the below Powershell command to identify the process:
|
Start by looking at the netstat output. If you are using Windows 10 or Windows Server 2016, then you can run the command `netstat -anobq` and check for the process ID which has maximum entries as BOUND. Alternately, you can also run the below PowerShell command to identify the process:
|
||||||
|
|
||||||
```Powershell
|
```powershell
|
||||||
Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending
|
Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending
|
||||||
```
|
```
|
||||||
|
|
||||||
Most port leaks are caused by user-mode processes not correctly closing the ports when an error was encountered. At the user-mode level ports (actually sockets) are handles. Both **TaskManager** and **ProcessExplorer** are able to display handle counts which allows you to identify which process is consuming all of the ports.
|
Most port leaks are caused by user-mode processes not correctly closing the ports when an error was encountered. At the user-mode level ports (actually sockets) are handles. Both **TaskManager** and **ProcessExplorer** are able to display handle counts which allows you to identify which process is consuming all of the ports.
|
||||||
|
|
||||||
For Windows 7 and Windows Server 2008 R2, you can update your Powershell version to include the above cmdlet.
|
For Windows 7 and Windows Server 2008 R2, you can update your PowerShell version to include the above cmdlet.
|
||||||
|
|
||||||
### Method 2
|
### Method 2
|
||||||
|
|
||||||
@ -157,7 +157,7 @@ Steps to use Process explorer:
|
|||||||
|
|
||||||
File \Device\AFD
|
File \Device\AFD
|
||||||
|
|
||||||
|
:::image type="content" alt-text="Screenshot of Process Explorer." source="images/tcp-ts-22.png" lightbox="images/tcp-ts-22.png":::
|
||||||
|
|
||||||
10. Some are normal, but large numbers of them are not (hundreds to thousands). Close the process in question. If that restores outbound connectivity, then you have further proven that the app is the cause. Contact the vendor of that app.
|
10. Some are normal, but large numbers of them are not (hundreds to thousands). Close the process in question. If that restores outbound connectivity, then you have further proven that the app is the cause. Contact the vendor of that app.
|
||||||
|
|
||||||
@ -165,7 +165,7 @@ Finally, if the above methods did not help you isolate the process, we suggest y
|
|||||||
|
|
||||||
As a workaround, rebooting the computer will get the it back in normal state and would help you resolve the issue for the time being. However, when a reboot is impractical, you can also consider increasing the number of ports on the machine using the below commands:
|
As a workaround, rebooting the computer will get the it back in normal state and would help you resolve the issue for the time being. However, when a reboot is impractical, you can also consider increasing the number of ports on the machine using the below commands:
|
||||||
|
|
||||||
```cmd
|
```console
|
||||||
netsh int ipv4 set dynamicport tcp start=10000 num=1000
|
netsh int ipv4 set dynamicport tcp start=10000 num=1000
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -176,7 +176,7 @@ This will set the dynamic port range to start at port 10000 and to end at port 1
|
|||||||
|
|
||||||
For Windows 7 and Windows Server 2008 R2, you can use the below script to collect the netstat output at defined frequency. From the outputs, you can see the port usage trend.
|
For Windows 7 and Windows Server 2008 R2, you can use the below script to collect the netstat output at defined frequency. From the outputs, you can see the port usage trend.
|
||||||
|
|
||||||
```
|
```console
|
||||||
@ECHO ON
|
@ECHO ON
|
||||||
set v=%1
|
set v=%1
|
||||||
:loop
|
:loop
|
||||||
@ -195,5 +195,5 @@ goto loop
|
|||||||
## Useful links
|
## Useful links
|
||||||
|
|
||||||
- [Port Exhaustion and You!](/archive/blogs/askds/port-exhaustion-and-you-or-why-the-netstat-tool-is-your-friend) - this article gives a detail on netstat states and how you can use netstat output to determine the port status
|
- [Port Exhaustion and You!](/archive/blogs/askds/port-exhaustion-and-you-or-why-the-netstat-tool-is-your-friend) - this article gives a detail on netstat states and how you can use netstat output to determine the port status
|
||||||
|
- [Detecting ephemeral port exhaustion](/archive/blogs/yongrhee/windows-server-2012-r2-ephemeral-ports-a-k-a-dynamic-ports-hotfixes): this article has a script which will run in a loop to report the port status. (Applicable for Windows 2012 R2, Windows 8, Windows 10 and Windows 11)
|
||||||
|
|
||||||
- [Detecting ephemeral port exhaustion](/archive/blogs/yongrhee/windows-server-2012-r2-ephemeral-ports-a-k-a-dynamic-ports-hotfixes): this article has a script which will run in a loop to report the port status. (Applicable for Windows 2012 R2, Windows 8, Windows 10, and Windows 11)
|
|
||||||
|
|||||||
@ -35,6 +35,10 @@ For more general information, see [Configuration service provider (CSP) referenc
|
|||||||
- Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Do not allow pinning programs to the Taskbar`
|
- Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Do not allow pinning programs to the Taskbar`
|
||||||
- Local setting: None
|
- Local setting: None
|
||||||
|
|
||||||
|
- [Experience/ConfigureChatIcon](/windows/client-management/mdm/policy-csp-experience#experience-configurechaticonvisibilityonthetaskbar)
|
||||||
|
- Group policy: `Computer Configuration\Administrative Templates\Windows Components\Chat`
|
||||||
|
- Local setting: Settings > Personalization > Taskbar > Chat
|
||||||
|
|
||||||
## Existing CSP policies that Windows 11 doesn't support
|
## Existing CSP policies that Windows 11 doesn't support
|
||||||
|
|
||||||
The following list includes some of the CSP policies that aren't supported on Windows 11:
|
The following list includes some of the CSP policies that aren't supported on Windows 11:
|
||||||
|
|||||||
@ -45,9 +45,11 @@ Refer to the following list for what each state means:
|
|||||||
|
|
||||||
Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *safeguard hold* is generated to delay the device's upgrade and protect the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all safeguard holds on the Windows client release information pages for any given release.
|
Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *safeguard hold* is generated to delay the device's upgrade and protect the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all safeguard holds on the Windows client release information pages for any given release.
|
||||||
|
|
||||||
## Queries for safeguard holds
|
### Queries for safeguard holds
|
||||||
|
|
||||||
Update Compliance reporting offers two queries to help you retrieve data related to safeguard holds. The first query shows the device data for all devices that are affected by safeguard holds. The second query shows data specific to devices running the target build.
|
Update Compliance reporting offers two queries to help you retrieve data related to safeguard holds. These queries show data for devices that are configured to send diagnostic data at the *Optional* level (previously *Full*). For Windows 10 devices, devices configured to send diagnostic data at *Enhanced* level are also included.
|
||||||
|
|
||||||
|
The first query shows the device data for all devices that are affected by safeguard holds. The second query shows data specific to devices running the target build.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -44,7 +44,7 @@ Before you begin the process to add Update Compliance to your Azure subscription
|
|||||||
|
|
||||||
- **Compatible operating systems and editions**: Update Compliance works only with Windows 10 or Windows 11 Professional, Education, and Enterprise editions. Update Compliance supports both the typical Windows 10 or Windows 11 Enterprise edition, as well as [Windows 10 Enterprise multi-session](/azure/virtual-desktop/windows-10-multisession-faq). Update Compliance only provides data for the standard Desktop Windows client version and is not currently compatible with Windows Server, Surface Hub, IoT, or other versions.
|
- **Compatible operating systems and editions**: Update Compliance works only with Windows 10 or Windows 11 Professional, Education, and Enterprise editions. Update Compliance supports both the typical Windows 10 or Windows 11 Enterprise edition, as well as [Windows 10 Enterprise multi-session](/azure/virtual-desktop/windows-10-multisession-faq). Update Compliance only provides data for the standard Desktop Windows client version and is not currently compatible with Windows Server, Surface Hub, IoT, or other versions.
|
||||||
- **Compatible Windows client servicing channels**: Update Compliance supports Windows client devices on the General Availability Channel and the Long-term Servicing Channel (LTSC). Update Compliance *counts* Windows Insider Preview devices, but does not currently provide detailed deployment insights for them.
|
- **Compatible Windows client servicing channels**: Update Compliance supports Windows client devices on the General Availability Channel and the Long-term Servicing Channel (LTSC). Update Compliance *counts* Windows Insider Preview devices, but does not currently provide detailed deployment insights for them.
|
||||||
- **Diagnostic data requirements**: Update Compliance requires devices be configured to send diagnostic data at *Required* level (previously *Basic*). To learn more about what's included in different diagnostic levels, see [Diagnostics, feedback, and privacy in Windows 10](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy).
|
- **Diagnostic data requirements**: Update Compliance requires devices to send diagnostic data at *Required* level (previously *Basic*). Some queries in Update Compliance require devices to send diagnostic data at *Optional* level (previously *Full*) for Windows 11 devices or *Enhanced* level for Windows 10 devices. To learn more about what's included in different diagnostic levels, see [Diagnostics, feedback, and privacy in Windows](https://support.microsoft.com/windows/diagnostics-feedback-and-privacy-in-windows-28808a2b-a31b-dd73-dcd3-4559a5199319).
|
||||||
- **Data transmission requirements**: Devices must be able to contact specific endpoints required to authenticate and send diagnostic data. These are enumerated in detail at [Configuring Devices for Update Compliance manually](update-compliance-configuration-manual.md).
|
- **Data transmission requirements**: Devices must be able to contact specific endpoints required to authenticate and send diagnostic data. These are enumerated in detail at [Configuring Devices for Update Compliance manually](update-compliance-configuration-manual.md).
|
||||||
- **Showing device names in Update Compliance**: For Windows 10, version 1803 or later, device names will not appear in Update Compliance unless you individually opt-in devices by using policy. The steps to accomplish this is outlined in [Configuring Devices for Update Compliance](update-compliance-configuration-manual.md).
|
- **Showing device names in Update Compliance**: For Windows 10, version 1803 or later, device names will not appear in Update Compliance unless you individually opt-in devices by using policy. The steps to accomplish this is outlined in [Configuring Devices for Update Compliance](update-compliance-configuration-manual.md).
|
||||||
|
|
||||||
|
|||||||
122
windows/privacy/essential-services-and-connected-experiences.md
Normal file
122
windows/privacy/essential-services-and-connected-experiences.md
Normal file
@ -0,0 +1,122 @@
|
|||||||
|
---
|
||||||
|
title: Essential services and connected experiences for Windows
|
||||||
|
description: Explains what the essential services and connected experiences are for Windows
|
||||||
|
keywords: privacy, manage connections to Microsoft
|
||||||
|
ms.prod: w10
|
||||||
|
ms.mktglfcycl: manage
|
||||||
|
ms.sitesec: library
|
||||||
|
ms.localizationpriority: high
|
||||||
|
audience: ITPro
|
||||||
|
author: siosulli
|
||||||
|
ms.author: dansimp
|
||||||
|
manager: dansimp
|
||||||
|
ms.date:
|
||||||
|
---
|
||||||
|
|
||||||
|
# Essential services and connected experiences for Windows
|
||||||
|
|
||||||
|
**Applies to**
|
||||||
|
|
||||||
|
- Windows 11
|
||||||
|
- Windows 10, version 1903 and later
|
||||||
|
|
||||||
|
Windows includes features that connect to the internet to provide enhanced experiences and additional service-based capabilities. These features are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure.
|
||||||
|
|
||||||
|
When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. Required service data can also include information needed by a connected experience to perform its task, such as configuration information about Windows.
|
||||||
|
|
||||||
|
The connected experiences you choose to use in Windows will impact what required service data is sent to us.
|
||||||
|
|
||||||
|
Required service data is also collected and sent to Microsoft for essential services. Essential services are used to keep the product **secure, up to date, performing as expected** or are **integral** to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows.
|
||||||
|
|
||||||
|
Although enterprise admins can turn off most essential services, we recommend, where applicable, you consider hosting the services on-premises and carefully assess the impact of turning off remaining services. The following list describes the essential services and connected experiences that are available to you in Windows and provides links to further information about each one.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves.
|
||||||
|
|
||||||
|
## Windows essential services
|
||||||
|
|
||||||
|
| **Essential service** | **Description** |
|
||||||
|
| --- | --- |
|
||||||
|
|Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in. <br/>To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#12-microsoft-account).|
|
||||||
|
|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. <br/>If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. <br/>To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update).|
|
||||||
|
| Services Configuration | Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working. <br/>To turn it off, see [Services Configuration](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#31-services-configuration).|
|
||||||
|
| Licensing | Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows and store applications. <br/>To turn off licensing services, see [License Manager](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#9-license-manager) and [Software Protection Platform](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#19-software-protection-platform).|
|
||||||
|
| Networking | Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows devices will lose network connectivity. <br/>To turn off Network Adapters, see [Disable-NetAdapter](/powershell/module/netadapter/disable-netadapter).|
|
||||||
|
| Device setup | The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed. <br/>To customize the initial setup experience, see [Customize Setup](/windows-hardware/customize/desktop/customize-oobe).|
|
||||||
|
| Diagnostic Data | Microsoft collects diagnostic data including error data about your devices with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows behaves in the real world, focus on user priorities, find and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft. <br/>To turn it off, see [Telemetry Services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#1816-feedback--diagnostics).|
|
||||||
|
| Update | Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date. Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats. <br/>Other services like Device metadata retrieval and Font streaming also ensure that the content on your devices is kept up to date. <br/>To turn off updates, see [Windows Update](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#29-windows-update), [Device Metadata Retrieval](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#4-device-metadata-retrieval), and [Font Streaming](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#6-font-streaming).|
|
||||||
|
| Microsoft Store | Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps. <br/>To turn it off, see [Microsoft Store](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#26-microsoft-store).|
|
||||||
|
|
||||||
|
## Windows connected experiences
|
||||||
|
|
||||||
|
| **Connected experience** | **Description** |
|
||||||
|
| --- | --- |
|
||||||
|
|Activity History|Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user. Synchronization across devices only works when a user signs in with the same account. <br/>To turn it off, see [Activity History](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1822-activity-history). |
|
||||||
|
|Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.<br/>To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard). |
|
||||||
|
| Date and Time | The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It's installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start. <br/>To turn it off, see [Date and Time](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#3-date--time). |
|
||||||
|
| Delivery Optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources, such as other peers on the network, in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date. <br/>If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet. By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network. <br/>To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). |
|
||||||
|
| Emojis and more | The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs, symbols, and clipboard history. This connected experience is new in Windows 11. <br/>To turn it off, see [Emojis availability](/windows/client-management/mdm/policy-csp-textinpu.md#textinput-touchkeyboardemojibuttonavailability). |
|
||||||
|
| Find My Device | Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to sign in to the device, the user is an administrator on the device, and when location is turned on for the device. Users can find their device by logging in to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) under the Find My Device tab. <br/>To turn it off, see [Find My Device](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#5-find-my-device). |
|
||||||
|
| Location services | The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely. <br/>To turn it off, see [Location services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#182-location). |
|
||||||
|
| Microsoft Defender Antivirus | Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization. Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats. <br/>To turn it off, see [Microsoft Defender Antivirus](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-defender). |
|
||||||
|
| Microsoft Defender SmartScreen | Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files. Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site. <br/>To turn it off, see [Microsoft Defender SmartScreen](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#241-microsoft-defender-smartscreen). |
|
||||||
|
| OneDrive | OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere. <br/>To turn off OneDrive, see [OneDrive](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#16-onedrive). |
|
||||||
|
| Troubleshooting Service | Windows troubleshooting service will automatically fix critical issues like corrupt settings that keep critical services from running. The service will also make adjustments to work with your hardware, or make other specific changes required for Windows to operate with the hardware, apps, and settings you’ve selected. In addition, it will recommend troubleshooting for other problems that aren’t critical to normal Windows operation but might impact your experience. <br/>To turn it off, see [Troubleshooting service](/windows/client-management/mdm/policy-csp-troubleshooting). |
|
||||||
|
| Voice Typing | Voice typing (also referred to as Windows dictation in earlier versions of Windows) allows users to write text by speaking by using Microsoft’s online speech recognition technology. <br/>To turn it off, see [Speech recognition](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#186-speech). |
|
||||||
|
| Windows backup | When settings synchronization is turned on, a user's settings are synced across all Windows devices when they sign in with the same account. <br/>To turn it off, see [Sync your settings](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#21-sync-your-settings). |
|
||||||
|
| Windows Dashboard Widgets | Windows Dashboard widget is a dynamic view that shows users personalized content like news, weather, their calendar and to-do list, and recent photos. It provides a quick glance view, which allows users to be productive without needing to go to multiple apps or websites. This connected experience is new in Windows 11. |
|
||||||
|
| Windows Insider Program | The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to builds of Windows. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s [website](https://insider.windows.com/). <br/>To turn it off, see [Windows Insider Program](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#7-insider-preview-builds). |
|
||||||
|
| Windows Search | Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account (including OneDrive, SharePoint, and other Microsoft services), and the internet. <br/>To turn it off, see [Windows Search](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#2-cortana-and-search). |
|
||||||
|
| Windows Spotlight | Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background. <br/>Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background. <br/>To turn it off, see [Windows Spotlight](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#25-windows-spotlight). |
|
||||||
|
|
||||||
|
## Microsoft Edge essential services and connected experiences
|
||||||
|
|
||||||
|
Windows ships with Microsoft Edge and Internet Explorer on Windows devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience.</br> You can find details on all of Microsoft Edge's connected experiences and essential services [here](/microsoft-edge/privacy-whitepaper). To turn off specific Microsoft Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge).
|
||||||
|
|
||||||
|
## IE essential services and connected experiences
|
||||||
|
|
||||||
|
Internet Explorer shares many of the Windows essential services listed above. The following table provides more details on the essential services and connected experiences specific to Internet Explorer.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> Apart from ActiveX Filtering, which is an essential service, all other features listed below are connected experiences.</br> To turn off specific connected experiences, see [Internet Explorer](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#8-internet-explorer).
|
||||||
|
|
||||||
|
| **Connected experience** | **Description** |
|
||||||
|
| --- | --- |
|
||||||
|
|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without a user's permission.</br> ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps which, can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on. <br/>Note: To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. |
|
||||||
|
|Suggested Sites|Suggested Sites is an online experience that recommends websites, images, or videos a user might be interested in. When Suggested Sites is turned on, a user’s web browsing history is periodically sent to Microsoft.|
|
||||||
|
| Address Bar and Search suggestions | With search suggestions enabled, users will be offered suggested search terms as they type in the Address Bar. As users type information, it will be sent to the default search provider. |
|
||||||
|
| Auto-complete feature for web addresses | The auto-complete feature suggests possible matches when users are typing web addresses in the browser address bar. |
|
||||||
|
| Compatibility logging | This feature is designed for use by developers and IT professionals to determine the compatibility of their websites with Internet Explorer. It is disabled by default and needs to be enabled to start logging Internet Explorer events in the Windows Event Viewer. These events describe failures that might have happened on the site and can include information about specific controls and webpages that failed. |
|
||||||
|
| Compatibility View | Compatibility View helps make websites designed for older browsers look better when viewed in Internet Explorer. The compatibility view setting allows you to choose whether an employee can fix website display problems they encounter while browsing. |
|
||||||
|
| Flip ahead | Flip ahead enables users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting, users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website. |
|
||||||
|
| Web Slices | A Web Slice enables users to subscribe to and automatically receive updates to content directly within a web page. Disabling the RSS Feeds setting will turn off background synchronization for feeds and Web Slices. |
|
||||||
|
| Accelerators | Accelerators are menu options in Internet Explorer that help automate common browser-related tasks. In Internet Explorer, when you right-click selected text, Accelerators appear in the list of available options. <br/>For example, if you select a word, you can use the "Translate with Bing" Accelerator to obtain a translation of that word. |
|
||||||
|
| Pinning websites to Start | When a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email website might send updates to the tile indicating how many new messages a user has. |
|
||||||
|
|
||||||
|
## Related links
|
||||||
|
|
||||||
|
- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
|
||||||
|
- [Connected Experiences in Office](/deployoffice/privacy/connected-experiences.md)
|
||||||
|
- [Essential Services in Office](/deployoffice/privacy/essential-services.md)
|
||||||
|
|
||||||
|
To view endpoints for Windows Enterprise, see:
|
||||||
|
|
||||||
|
- [Manage connection endpoints for Windows 11](manage-windows-11-endpoints.md)
|
||||||
|
- [Manage connection endpoints for Windows 10, version 21H1](manage-windows-21H1-endpoints.md)
|
||||||
|
- [Manage connection endpoints for Windows 10, version 20H2](manage-windows-20h2-endpoints.md)
|
||||||
|
- [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md)
|
||||||
|
- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md)
|
||||||
|
- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md)
|
||||||
|
- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md)
|
||||||
|
- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md)
|
||||||
|
|
||||||
|
To view endpoints for non-Enterprise Windows editions, see:
|
||||||
|
|
||||||
|
- [Windows 11 connection endpoints for non-Enterprise editions](windows-11-endpoints-non-enterprise-editions.md)
|
||||||
|
- [Windows 10, version 21H1, connection endpoints for non-Enterprise editions](windows-endpoints-21H1-non-enterprise-editions.md)
|
||||||
|
- [Windows 10, version 20H2, connection endpoints for non-Enterprise editions](windows-endpoints-20H2-non-enterprise-editions.md)
|
||||||
|
- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md)
|
||||||
|
- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md)
|
||||||
|
- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md)
|
||||||
|
- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md)
|
||||||
|
- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md)
|
||||||
@ -37,12 +37,14 @@
|
|||||||
href: windows-diagnostic-data-1703.md
|
href: windows-diagnostic-data-1703.md
|
||||||
- name: Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy
|
- name: Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy
|
||||||
href: enhanced-diagnostic-data-windows-analytics-events-and-fields.md
|
href: enhanced-diagnostic-data-windows-analytics-events-and-fields.md
|
||||||
- name: Manage Windows connection endpoints
|
- name: Manage Windows connected experiences
|
||||||
items:
|
items:
|
||||||
- name: Manage connections from Windows operating system components to Microsoft services
|
- name: Manage connections from Windows operating system components to Microsoft services
|
||||||
href: manage-connections-from-windows-operating-system-components-to-microsoft-services.md
|
href: manage-connections-from-windows-operating-system-components-to-microsoft-services.md
|
||||||
- name: Manage connections from Windows operating system components to Microsoft services using MDM
|
- name: Manage connections from Windows operating system components to Microsoft services using MDM
|
||||||
href: manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md
|
href: manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md
|
||||||
|
- name: Essential services and connected experiences for Windows
|
||||||
|
href: essential-services-and-connected-experiences.md
|
||||||
- name: Connection endpoints for Windows 11
|
- name: Connection endpoints for Windows 11
|
||||||
href: manage-windows-11-endpoints.md
|
href: manage-windows-11-endpoints.md
|
||||||
- name: Connection endpoints for Windows 10, version 21H1
|
- name: Connection endpoints for Windows 10, version 21H1
|
||||||
|
|||||||
@ -29,13 +29,13 @@ Applies to:
|
|||||||
|
|
||||||
At Microsoft, we are committed to data privacy across all our products and services. With this guide, we provide administrators and compliance professionals with data privacy considerations for Windows.
|
At Microsoft, we are committed to data privacy across all our products and services. With this guide, we provide administrators and compliance professionals with data privacy considerations for Windows.
|
||||||
|
|
||||||
Microsoft collects data through multiple interactions with users of Windows devices. This information can contain personal data that may be used to provide, secure, and improve Windows services. To help users and organizations control the collection of personal data, Windows provides comprehensive transparency features, settings choices, controls, and support for data subject requests, all of which are detailed in this article.
|
Microsoft collects data through multiple interactions with users of Windows devices. This information can contain personal data that may be used to provide, secure and improve Windows, and to provide connected experiences. To help users and organizations control the collection of personal data, Windows provides comprehensive transparency features, settings choices, controls, and support for data subject requests, all of which are detailed in this article.
|
||||||
|
|
||||||
This information allows administrators and compliance professionals to work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR).
|
This information allows administrators and compliance professionals to work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR).
|
||||||
|
|
||||||
## 1. Windows data collection transparency
|
## 1. Windows data collection transparency
|
||||||
|
|
||||||
Transparency is an important part of the data collection process in Windows. Comprehensive information about the features and processes used to collect data is available to users and administrators directly within Windows, both during and after device set up.
|
Transparency is an important part of the data collection process in Windows. Comprehensive information about the features and processes used to collect data is available to users and administrators directly within Windows, both during and after device setup.
|
||||||
|
|
||||||
### 1.1 Device set up experience and support for layered transparency
|
### 1.1 Device set up experience and support for layered transparency
|
||||||
|
|
||||||
@ -44,9 +44,9 @@ When setting up a device, a user can configure their privacy settings. Those pri
|
|||||||
The following table provides an overview of the Windows 10 and Windows 11 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information.
|
The following table provides an overview of the Windows 10 and Windows 11 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> This table is limited to the privacy settings that are most commonly avaialable when setting up a current version of Windows 10 or newer. For the full list of settings that involve data collection, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
|
> This table is limited to the privacy settings that are most commonly available when setting up a current version of Windows 10 or newer. For the full list of settings that involve data collection, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
|
||||||
|
|
||||||
| Feature/Setting | Description | Supporting Content | Privacy Statement |
|
| Feature/Setting | Description | Supporting content | Privacy statement |
|
||||||
| --- | --- | --- | --- |
|
| --- | --- | --- | --- |
|
||||||
| Diagnostic Data | <p>Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft to quickly identify and address issues affecting its customers.</p><p>Diagnostic data is categorized into the following:<ul><li>**Required diagnostic data**<br />Required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](./required-windows-diagnostic-data-events-and-fields-2004.md).</li><li>**Optional diagnostic data**<br />Optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](./windows-diagnostic-data.md).</li></ul></p> | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)<br /><br />[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
|
| Diagnostic Data | <p>Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft to quickly identify and address issues affecting its customers.</p><p>Diagnostic data is categorized into the following:<ul><li>**Required diagnostic data**<br />Required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](./required-windows-diagnostic-data-events-and-fields-2004.md).</li><li>**Optional diagnostic data**<br />Optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](./windows-diagnostic-data.md).</li></ul></p> | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)<br /><br />[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
|
||||||
| Inking & typing | Microsoft collects optional inking and typing diagnostic data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
|
| Inking & typing | Microsoft collects optional inking and typing diagnostic data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
|
||||||
@ -71,7 +71,7 @@ Windows provides the ability to manage privacy settings through several differen
|
|||||||
|
|
||||||
### 2.1 Privacy setting options for users
|
### 2.1 Privacy setting options for users
|
||||||
|
|
||||||
Once a Windows device is set up, a user can manage data collection settings by opening the Settings app in Windows. Administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says **Some settings are hidden or managed by your organization** when they navigate to the Settings page. In this case, the user can only change settings in accordance with the policies that the administrator has applied to the device.
|
Once a Windows device is set up, a user can manage data collection settings by opening the Settings app in Windows. Administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says **Some settings are hidden or managed by your organization** when they navigate to the settings page. In this case, the user can only change settings in accordance with the policies that the administrator has applied to the device.
|
||||||
|
|
||||||
### 2.2 Privacy setting controls for administrators
|
### 2.2 Privacy setting controls for administrators
|
||||||
|
|
||||||
@ -80,14 +80,14 @@ Administrators can configure and control privacy settings across their organizat
|
|||||||
The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these policies. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting by using policy and suppress the Out-of-box Experience (OOBE) during device setup. If you’re interested in minimizing data collection, we also provide the recommended value to set.
|
The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these policies. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting by using policy and suppress the Out-of-box Experience (OOBE) during device setup. If you’re interested in minimizing data collection, we also provide the recommended value to set.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> This is not a complete list of settings that involve managing data collection or connecting to Microsoft services. For a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
|
> This is not a complete list of settings that involve managing data collection or connecting to connected experiences in Windows. For a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
|
||||||
|
|
||||||
| Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection |
|
| Connected experience /setting | GP/MDM documentation | Default state if the setup experience is suppressed | State to stop/minimize data collection |
|
||||||
|---|---|---|---|
|
|---|---|---|---|
|
||||||
| [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:<br />**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**<br /><br />MDM: [Privacy/AllowInputPersonalization](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off |
|
| [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:<br />**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**<br /><br />MDM: [Privacy/AllowInputPersonalization](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off |
|
||||||
| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:<br />**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**<br /><br />MDM: [Privacy/LetAppsAccessLocation](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later and Windows 11) | Off |
|
| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:<br />**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**<br /><br />MDM: [Privacy/LetAppsAccessLocation](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later and Windows 11) | Off |
|
||||||
| [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:<br />**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**<br /><br />MDM: [Experience/AllFindMyDevice](/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off |
|
| [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:<br />**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**<br /><br />MDM: [Experience/AllFindMyDevice](/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off |
|
||||||
| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md) | Group Policy:<br />**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry** (or **Allow diagnostic data** in Windows 11 or Windows Server 2022)<br /><br />MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)<br /><br />**Note**: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the state to minimize data collection is not recommended. See [Enabling the Windows diagnostic data processor configuration](#238-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration) below for more information. | Required diagnostic data (Windows 10, version 1903 and later and Windows 11)<br /><br />Server editions:<br />Enhanced diagnostic data | Security (Off) and block endpoints |
|
| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md) | Group Policy:<br />**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry** (or **Allow diagnostic data** in Windows 11 or Windows Server 2022)<br /><br />MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)<br /><br />**Note**: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the state to minimize data collection is not recommended. For more information, see [Enabling the Windows diagnostic data processor configuration](#237-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration). | Required diagnostic data (Windows 10, version 1903 and later and Windows 11)<br /><br />Server editions:<br />Enhanced diagnostic data | Security (Off) and block endpoints |
|
||||||
| [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:<br />**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**<br /><br />MDM: [TextInput/AllowLinguisticDataCollection](/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later and Windows 11) | Off |
|
| [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:<br />**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**<br /><br />MDM: [TextInput/AllowLinguisticDataCollection](/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later and Windows 11) | Off |
|
||||||
| Tailored Experiences | Group Policy:<br />**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**<br /><br />MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off |
|
| Tailored Experiences | Group Policy:<br />**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**<br /><br />MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off |
|
||||||
| Advertising ID | Group Policy:<br />**Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**<br /><br />MDM: [Privacy/DisableAdvertisingId](/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off |
|
| Advertising ID | Group Policy:<br />**Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**<br /><br />MDM: [Privacy/DisableAdvertisingId](/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off |
|
||||||
@ -111,19 +111,19 @@ You can use the following articles to learn more about Autopilot and how to use
|
|||||||
- [Overview of Windows Autopilot](/windows/deployment/windows-Autopilot/windows-Autopilot)
|
- [Overview of Windows Autopilot](/windows/deployment/windows-Autopilot/windows-Autopilot)
|
||||||
- [Windows Autopilot deployment process](/windows/deployment/windows-Autopilot/deployment-process)
|
- [Windows Autopilot deployment process](/windows/deployment/windows-Autopilot/deployment-process)
|
||||||
|
|
||||||
#### _2.3.2 Managing connections from Windows components to Microsoft services_
|
#### _2.3.2 Managing Windows connected experiences and essential services_
|
||||||
|
|
||||||
Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows components.
|
Windows includes features that connect to the internet to provide enhanced experiences and additional service-based capabilities. These features are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure.
|
||||||
|
|
||||||
For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable.
|
Essential services are services in the product that connect to Microsoft to keep the product secure, up to date and performing as expected, or are integral to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows.
|
||||||
|
|
||||||
#### _2.3.3 Managing Windows connections_
|
[Windows essential services and connected experiences](essential-services-and-connected-experiences.md) provides a list of the most common Windows essential services and connected experiences.
|
||||||
|
|
||||||
Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints for their organization to meet their specific compliance objectives.
|
When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. Administrators can manage the data sent from their organization to Microsoft by configuring settings that are associated with the functionality provided by Windows connected experiences and essential services. For more information, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This article includes the different methods available to configure each setting, the impact to functionality, and the versions of Windows that are applicable.
|
||||||
|
|
||||||
The **Manage Windows connection endpoints** section on the left-hand navigation menu provides a list of endpoints for the latest Windows releases, along with descriptions of any functionality that would be impacted by restricting data collection.
|
The article [Manage connection endpoints for Windows 11 Enterprise](manage-windows-11-endpoints.md) provides a list of endpoints to which data is transferred by Windows connected experiences for the latest Windows release, along with descriptions of any functionality that would be impacted by restricting data collection.
|
||||||
|
|
||||||
#### _2.3.4 Limited functionality baseline_
|
#### _2.3.3 Limited functionality baseline_
|
||||||
|
|
||||||
An organization may want to minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization.
|
An organization may want to minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization.
|
||||||
|
|
||||||
@ -131,15 +131,15 @@ An organization may want to minimize the amount of data sent back to Microsoft o
|
|||||||
> - We recommend that you fully test any modifications to these settings before deploying them in your organization.
|
> - We recommend that you fully test any modifications to these settings before deploying them in your organization.
|
||||||
> - We also recommend that if you plan to enable the Windows diagnostic data processor configuration, adjust the limited configuration baseline before deploying it to ensure the Windows diagnostic setting is not turned off.
|
> - We also recommend that if you plan to enable the Windows diagnostic data processor configuration, adjust the limited configuration baseline before deploying it to ensure the Windows diagnostic setting is not turned off.
|
||||||
|
|
||||||
#### _2.3.5 Diagnostic data: Managing notifications for change of level at logon_
|
#### _2.3.4 Diagnostic data: Managing notifications for change of level at logon_
|
||||||
|
|
||||||
Starting with Windows 10, version 1803 and Windows 11, if an administrator modifies the diagnostic data collection setting, users are notified of this change during the initial device sign in. For example, if you configure the device to send optional diagnostic data, users will be notified the next time they sign into the device. You can disable these notifications by using the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`.
|
Starting with Windows 10, version 1803 and Windows 11, if an administrator modifies the diagnostic data collection setting, users are notified of this change during the initial device sign in. For example, if you configure the device to send optional diagnostic data, users will be notified the next time they sign into the device. You can disable these notifications by using the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`.
|
||||||
|
|
||||||
#### _2.3.6 Diagnostic data: Managing end user choice for changing the setting_
|
#### _2.3.5 Diagnostic data: Managing end user choice for changing the setting_
|
||||||
|
|
||||||
Windows 10, version 1803 and later and Windows 11 allows users to change their diagnostic data level to a lower setting than what their administrator has set. For example, if you have configured the device to send optional diagnostic data, a user can change the setting so that only required diagnostic data is sent by opening the Settings app in Windows. Administrators can restrict a user’s ability to change the setting by enabling the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`.
|
Windows 10, version 1803 and later and Windows 11 allows users to change their diagnostic data level to a lower setting than what their administrator has set. For example, if you have configured the device to send optional diagnostic data, a user can change the setting so that only required diagnostic data is sent by opening the Settings app in Windows and navigating to **Diagnostic & feedback**. Administrators can restrict a user’s ability to change the setting by enabling the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`.
|
||||||
|
|
||||||
#### _2.3.7 Diagnostic data: Managing device-based data delete_
|
#### _2.3.6 Diagnostic data: Managing device-based data delete_
|
||||||
|
|
||||||
Windows 10, version 1809 and later and Windows 11 allow a user to delete diagnostic data collected from their device by opening the Settings app in Windows and navigating to **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. An administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData) PowerShell cmdlet.
|
Windows 10, version 1809 and later and Windows 11 allow a user to delete diagnostic data collected from their device by opening the Settings app in Windows and navigating to **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. An administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData) PowerShell cmdlet.
|
||||||
|
|
||||||
@ -148,7 +148,7 @@ An administrator can disable a user’s ability to delete their device’s diagn
|
|||||||
>[!Note]
|
>[!Note]
|
||||||
>If the Windows diagnostic data processor configuration is enabled, the Delete diagnostic data button will be disabled and the powershell cmdlet will not delete data collected under this configuration. IT administrators can instead delete diagnostic data collected by invoking a delete request from the admin portal.
|
>If the Windows diagnostic data processor configuration is enabled, the Delete diagnostic data button will be disabled and the powershell cmdlet will not delete data collected under this configuration. IT administrators can instead delete diagnostic data collected by invoking a delete request from the admin portal.
|
||||||
|
|
||||||
#### _2.3.8 Diagnostic data: Enabling the Windows diagnostic data processor configuration_
|
#### _2.3.7 Diagnostic data: Enabling the Windows diagnostic data processor configuration_
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
|
|||||||
@ -22,6 +22,7 @@ ms.reviewer:
|
|||||||
- Windows 11
|
- Windows 11
|
||||||
- Windows Server 2016
|
- Windows Server 2016
|
||||||
- Windows Server 2019
|
- Windows Server 2019
|
||||||
|
- Windows Server 2022
|
||||||
|
|
||||||
```powershell
|
```powershell
|
||||||
# Script to find out if a machine is Device Guard compliant.
|
# Script to find out if a machine is Device Guard compliant.
|
||||||
@ -780,7 +781,7 @@ function CheckOSSKU
|
|||||||
|
|
||||||
function CheckOSArchitecture
|
function CheckOSArchitecture
|
||||||
{
|
{
|
||||||
$OSArch = $(gwmi win32_operatingsystem).OSArchitecture.ToLower()
|
$OSArch = $(Get-WmiObject win32_operatingsystem).OSArchitecture.ToLower()
|
||||||
Log $OSArch
|
Log $OSArch
|
||||||
if($OSArch -match ("^64\-?\s?bit"))
|
if($OSArch -match ("^64\-?\s?bit"))
|
||||||
{
|
{
|
||||||
@ -818,9 +819,9 @@ function CheckSecureBootState
|
|||||||
|
|
||||||
function CheckVirtualization
|
function CheckVirtualization
|
||||||
{
|
{
|
||||||
$_vmmExtension = $(gwmi -Class Win32_processor).VMMonitorModeExtensions
|
$_vmmExtension = $(Get-WMIObject -Class Win32_processor).VMMonitorModeExtensions
|
||||||
$_vmFirmwareExtension = $(gwmi -Class Win32_processor).VirtualizationFirmwareEnabled
|
$_vmFirmwareExtension = $(Get-WMIObject -Class Win32_processor).VirtualizationFirmwareEnabled
|
||||||
$_vmHyperVPresent = (gcim -Class Win32_ComputerSystem).HypervisorPresent
|
$_vmHyperVPresent = (Get-CimInstance -Class Win32_ComputerSystem).HypervisorPresent
|
||||||
Log "VMMonitorModeExtensions $_vmmExtension"
|
Log "VMMonitorModeExtensions $_vmmExtension"
|
||||||
Log "VirtualizationFirmwareEnabled $_vmFirmwareExtension"
|
Log "VirtualizationFirmwareEnabled $_vmFirmwareExtension"
|
||||||
Log "HyperVisorPresent $_vmHyperVPresent"
|
Log "HyperVisorPresent $_vmHyperVPresent"
|
||||||
@ -1046,7 +1047,7 @@ if(!$TestForAdmin)
|
|||||||
exit
|
exit
|
||||||
}
|
}
|
||||||
|
|
||||||
$isRunningOnVM = (get-wmiobject win32_computersystem).model
|
$isRunningOnVM = (Get-WmiObject win32_computersystem).model
|
||||||
if($isRunningOnVM.Contains("Virtual"))
|
if($isRunningOnVM.Contains("Virtual"))
|
||||||
{
|
{
|
||||||
LogAndConsoleWarning "Running on a Virtual Machine. DG/CG is supported only if both guest VM and host machine are running with Windows 10, version 1703 or later with English localization."
|
LogAndConsoleWarning "Running on a Virtual Machine. DG/CG is supported only if both guest VM and host machine are running with Windows 10, version 1703 or later with English localization."
|
||||||
|
|||||||
@ -31,7 +31,7 @@ You may wish to disable the automatic Windows Hello for Business enrollment prom
|
|||||||
|
|
||||||
Cloud only deployments will use Azure AD multi-factor authentication (MFA) during Windows Hello for Business (WHfB) enrollment and there's no additional MFA configuration needed. If you aren't already registered in Azure AD MFA, you will be guided though the MFA registration as part of the Windows Hello for Business enrollment process.
|
Cloud only deployments will use Azure AD multi-factor authentication (MFA) during Windows Hello for Business (WHfB) enrollment and there's no additional MFA configuration needed. If you aren't already registered in Azure AD MFA, you will be guided though the MFA registration as part of the Windows Hello for Business enrollment process.
|
||||||
|
|
||||||
The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](hello-identity-verification.md#cloud-only-deployment).
|
The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](hello-identity-verification.md#azure-ad-cloud-only-deployment).
|
||||||
|
|
||||||
Also note that it's possible for federated domains to enable the “Supports MFA” flag in your federated domain settings. This flag tells Azure AD that the federated IDP will perform the MFA challenge.
|
Also note that it's possible for federated domains to enable the “Supports MFA” flag in your federated domain settings. This flag tells Azure AD that the federated IDP will perform the MFA challenge.
|
||||||
|
|
||||||
|
|||||||
@ -50,7 +50,10 @@ Do not begin your deployment until the hosting servers and infrastructure (not r
|
|||||||
|
|
||||||
## Deployment and trust models
|
## Deployment and trust models
|
||||||
|
|
||||||
Windows Hello for Business has three deployment models: Cloud, hybrid, and on-premises. Hybrid and on-premises deployment models have two trust models: *Key trust* and *certificate trust*.
|
Windows Hello for Business has three deployment models: Azure AD cloud only, hybrid, and on-premises. Hybrid and on-premises deployment models have two trust models: *Key trust* and *certificate trust*.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available.
|
||||||
|
|
||||||
Hybrid deployments are for enterprises that use Azure Active Directory. On-premises deployments are for enterprises who exclusively use on-premises Active Directory. Remember that the environments that use Azure Active Directory must use the hybrid deployment model for all domains in that forest.
|
Hybrid deployments are for enterprises that use Azure Active Directory. On-premises deployments are for enterprises who exclusively use on-premises Active Directory. Remember that the environments that use Azure Active Directory must use the hybrid deployment model for all domains in that forest.
|
||||||
|
|
||||||
|
|||||||
@ -14,7 +14,7 @@ metadata:
|
|||||||
ms.collection: M365-identity-device-management
|
ms.collection: M365-identity-device-management
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
localizationpriority: medium
|
localizationpriority: medium
|
||||||
ms.date: 01/14/2021
|
ms.date: 10/15/2021
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
|
|
||||||
title: Windows Hello for Business Frequently Asked Questions (FAQ)
|
title: Windows Hello for Business Frequently Asked Questions (FAQ)
|
||||||
@ -25,6 +25,10 @@ summary: |
|
|||||||
sections:
|
sections:
|
||||||
- name: Ignored
|
- name: Ignored
|
||||||
questions:
|
questions:
|
||||||
|
- question: What is Windows Hello for Business cloud trust?
|
||||||
|
answer: |
|
||||||
|
Windows Hello for Business cloud trust is a new trust model that is planned to be introduced in early 2022. This trust model will enable Windows Hello for Business deployment using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available.
|
||||||
|
|
||||||
- question: What about virtual smart cards?
|
- question: What about virtual smart cards?
|
||||||
answer: |
|
answer: |
|
||||||
Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends that new Windows 10 deployments use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8.
|
Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends that new Windows 10 deployments use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8.
|
||||||
@ -208,7 +212,7 @@ sections:
|
|||||||
|
|
||||||
- question: Does Windows Hello for Business work with third-party federation servers?
|
- question: Does Windows Hello for Business work with third-party federation servers?
|
||||||
answer: |
|
answer: |
|
||||||
Windows Hello for Business works with any third-party federation servers that support the protocols used during the provisioning experience. Interested third-parties can inquiry at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration).<br><br>
|
Windows Hello for Business works with any third-party federation servers that support the protocols used during the provisioning experience.<br><br>
|
||||||
|
|
||||||
| Protocol | Description |
|
| Protocol | Description |
|
||||||
| :---: | :--- |
|
| :---: | :--- |
|
||||||
@ -219,5 +223,10 @@ sections:
|
|||||||
|
|
||||||
- question: Does Windows Hello for Business work with Mac and Linux clients?
|
- question: Does Windows Hello for Business work with Mac and Linux clients?
|
||||||
answer: |
|
answer: |
|
||||||
Windows Hello for Business is a feature of the Windows platform. At this time, Microsoft is not developing clients for other platforms.
|
Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration).
|
||||||
|
Windows Hello for Business is a feature of the Windows platform. At this time, Microsoft is not developing clients for other platforms.
|
||||||
|
|
||||||
|
- question: Does Windows Hello for Business work with Azure Active Directory Domain Services (Azure AD DS) clients?
|
||||||
|
answer: |
|
||||||
|
No, Azure AD DS is a separately managed environment in Azure, and hybrid device registration with cloud Azure AD is not available for it via Azure AD Connect. Hence, Windows Hello for Business does not work with Azure AD.
|
||||||
|
|
||||||
|
|||||||
@ -22,7 +22,7 @@ ms.date: 1/22/2021
|
|||||||
|
|
||||||
This article lists the infrastructure requirements for the different deployment models for Windows Hello for Business.
|
This article lists the infrastructure requirements for the different deployment models for Windows Hello for Business.
|
||||||
|
|
||||||
## Cloud Only Deployment
|
## Azure AD Cloud Only Deployment
|
||||||
|
|
||||||
* Windows 10, version 1511 or later, or Windows 11
|
* Windows 10, version 1511 or later, or Windows 11
|
||||||
* Microsoft Azure Account
|
* Microsoft Azure Account
|
||||||
@ -35,37 +35,42 @@ This article lists the infrastructure requirements for the different deployment
|
|||||||
|
|
||||||
The table shows the minimum requirements for each deployment. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process.
|
The table shows the minimum requirements for each deployment. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process.
|
||||||
|
|
||||||
| Key trust</br>Group Policy managed | Certificate trust</br>Mixed managed | Key trust</br>Modern managed | Certificate trust</br>Modern managed |
|
> [!NOTE]
|
||||||
|
> Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available.
|
||||||
|
|
||||||
|
| Key trust<br/>Group Policy managed | Certificate trust<br/>Mixed managed | Key trust<br/>Modern managed | Certificate trust<br/>Modern managed |
|
||||||
| --- | --- | --- | --- |
|
| --- | --- | --- | --- |
|
||||||
| Windows 10, version 1511 or later| **Hybrid Azure AD Joined:**<br> *Minimum:* Windows 10, version 1703<br> *Best experience:* Windows 10, version 1709 or later (supports synchronous certificate enrollment).</br>**Azure AD Joined:**<br> Windows 10, version 1511 or later| Windows 10, version 1511 or later | Windows 10, version 1511 or later |
|
| Windows 10, version 1511 or later| **Hybrid Azure AD Joined:**<br> *Minimum:* Windows 10, version 1703<br> *Best experience:* Windows 10, version 1709 or later (supports synchronous certificate enrollment).<br/>**Azure AD Joined:**<br> Windows 10, version 1511 or later| Windows 10, version 1511 or later | Windows 10, version 1511 or later |
|
||||||
| Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema |
|
| Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema |
|
||||||
| Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level| Windows Server 2008 R2 Domain/Forest functional level |Windows Server 2008 R2 Domain/Forest functional level |
|
| Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level| Windows Server 2008 R2 Domain/Forest functional level |Windows Server 2008 R2 Domain/Forest functional level |
|
||||||
| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers |
|
| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers |
|
||||||
| Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority |
|
| Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority |
|
||||||
| N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),<br> and</br>Windows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service |
|
| N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),<br> and<br/>Windows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service |
|
||||||
| Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter |
|
| Azure MFA tenant, or<br/>AD FS w/Azure MFA adapter, or<br/>AD FS w/Azure MFA Server adapter, or<br/>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or<br/>AD FS w/Azure MFA adapter, or<br/>AD FS w/Azure MFA Server adapter, or<br/>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or<br/>AD FS w/Azure MFA adapter, or<br/>AD FS w/Azure MFA Server adapter, or<br/>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or<br/>AD FS w/Azure MFA adapter, or<br/>AD FS w/Azure MFA Server adapter, or<br/>AD FS w/3rd Party MFA Adapter |
|
||||||
| Azure Account | Azure Account | Azure Account | Azure Account |
|
| Azure Account | Azure Account | Azure Account | Azure Account |
|
||||||
| Azure Active Directory | Azure Active Directory | Azure Active Directory | Azure Active Directory |
|
| Azure Active Directory | Azure Active Directory | Azure Active Directory | Azure Active Directory |
|
||||||
| Azure AD Connect | Azure AD Connect | Azure AD Connect | Azure AD Connect |
|
| Azure AD Connect | Azure AD Connect | Azure AD Connect | Azure AD Connect |
|
||||||
| Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional for automatic MDM enrollment | Azure AD Premium, optional for automatic MDM enrollment |
|
| Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional for automatic MDM enrollment | Azure AD Premium, optional for automatic MDM enrollment |
|
||||||
|
|
||||||
> [!Important]
|
> [!Important]
|
||||||
> 1. Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models. </br>
|
> - Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
|
||||||
> **Requirements:**</br>
|
|
||||||
> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903</br>
|
|
||||||
> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
|
||||||
>
|
>
|
||||||
> 2. On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.</br>
|
> **Requirements:**
|
||||||
> **Requirements:**</br>
|
> - Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
|
||||||
> Reset from settings - Windows 10, version 1703, Professional</br>
|
> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
||||||
> Reset above lock screen - Windows 10, version 1709, Professional</br>
|
>
|
||||||
> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
> - On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
|
||||||
|
>
|
||||||
|
> **Requirements:**
|
||||||
|
> - Reset from settings - Windows 10, version 1703, Professional
|
||||||
|
> - Reset above lock screen - Windows 10, version 1709, Professional
|
||||||
|
> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
||||||
|
|
||||||
## On-premises Deployments
|
## On-premises Deployments
|
||||||
|
|
||||||
The table shows the minimum requirements for each deployment.
|
The table shows the minimum requirements for each deployment.
|
||||||
|
|
||||||
| Key trust </br> Group Policy managed | Certificate trust </br> Group Policy managed|
|
| Key trust <br/> Group Policy managed | Certificate trust <br/> Group Policy managed|
|
||||||
| --- | --- |
|
| --- | --- |
|
||||||
| Windows 10, version 1703 or later | Windows 10, version 1703 or later |
|
| Windows 10, version 1703 or later | Windows 10, version 1703 or later |
|
||||||
| Windows Server 2016 Schema | Windows Server 2016 Schema|
|
| Windows Server 2016 Schema | Windows Server 2016 Schema|
|
||||||
|
|||||||
@ -70,7 +70,7 @@ In Windows 10, Windows Hello replaces passwords. When the identity provider sup
|
|||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>Windows Hello as a convenience sign-in uses regular user name and password authentication, without the user entering the password.
|
>Windows Hello as a convenience sign-in uses regular user name and password authentication, without the user entering the password.
|
||||||
|
|
||||||
|
:::image type="content" alt-text="How authentication works in Windows Hello." source="images/authflow.png" lightbox="images/authflow.png":::
|
||||||
|
|
||||||
Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device.
|
Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device.
|
||||||
|
|
||||||
@ -81,12 +81,19 @@ Windows Hello helps protect user identities and user credentials. Because the us
|
|||||||
## How Windows Hello for Business works: key points
|
## How Windows Hello for Business works: key points
|
||||||
|
|
||||||
- Windows Hello credentials are based on certificate or asymmetrical key pair. Windows Hello credentials can be bound to the device, and the token that is obtained using the credential is also bound to the device.
|
- Windows Hello credentials are based on certificate or asymmetrical key pair. Windows Hello credentials can be bound to the device, and the token that is obtained using the credential is also bound to the device.
|
||||||
|
|
||||||
- Identity provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps the Windows Hello public key to a user account during the registration step.
|
- Identity provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps the Windows Hello public key to a user account during the registration step.
|
||||||
|
|
||||||
- Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy.
|
- Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy.
|
||||||
|
|
||||||
- Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (biometrics). The Windows Hello gesture does not roam between devices and is not shared with the server. Biometrics templates are stored locally on a device. The PIN is never stored or shared.
|
- Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (biometrics). The Windows Hello gesture does not roam between devices and is not shared with the server. Biometrics templates are stored locally on a device. The PIN is never stored or shared.
|
||||||
|
|
||||||
- The private key never leaves a device when using TPM. The authenticating server has a public key that is mapped to the user account during the registration process.
|
- The private key never leaves a device when using TPM. The authenticating server has a public key that is mapped to the user account during the registration process.
|
||||||
|
|
||||||
- PIN entry and biometric gesture both trigger Windows 10 to use the private key to cryptographically sign data that is sent to the identity provider. The identity provider verifies the user's identity and authenticates the user.
|
- PIN entry and biometric gesture both trigger Windows 10 to use the private key to cryptographically sign data that is sent to the identity provider. The identity provider verifies the user's identity and authenticates the user.
|
||||||
|
|
||||||
- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy.
|
- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy.
|
||||||
|
|
||||||
- Certificate private keys can be protected by the Windows Hello container and the Windows Hello gesture.
|
- Certificate private keys can be protected by the Windows Hello container and the Windows Hello gesture.
|
||||||
|
|
||||||
For details, see [How Windows Hello for Business works](hello-how-it-works.md).
|
For details, see [How Windows Hello for Business works](hello-how-it-works.md).
|
||||||
@ -97,6 +104,9 @@ Windows Hello for Business can use either keys (hardware or software) or certifi
|
|||||||
|
|
||||||
Windows Hello for Business with a key does not support supplied credentials for RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments as a supplied credential. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md).
|
Windows Hello for Business with a key does not support supplied credentials for RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments as a supplied credential. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md).
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available.
|
||||||
|
|
||||||
## Learn more
|
## Learn more
|
||||||
|
|
||||||
[Implementing strong user authentication with Windows Hello for Business](https://www.microsoft.com/en-us/itshowcase/implementing-strong-user-authentication-with-windows-hello-for-business)
|
[Implementing strong user authentication with Windows Hello for Business](https://www.microsoft.com/en-us/itshowcase/implementing-strong-user-authentication-with-windows-hello-for-business)
|
||||||
|
|||||||
@ -74,20 +74,22 @@ The hybrid deployment model is for organizations that:
|
|||||||
- Use applications hosted in Azure Active Directory, and want a single sign-in user experience for both on-premises and Azure Active Directory resources
|
- Use applications hosted in Azure Active Directory, and want a single sign-in user experience for both on-premises and Azure Active Directory resources
|
||||||
|
|
||||||
> [!Important]
|
> [!Important]
|
||||||
> Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.</br>
|
> Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
|
||||||
> **Requirements:**</br>
|
>
|
||||||
> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903</br>
|
> **Requirements:**
|
||||||
> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
> - Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
|
||||||
|
> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
||||||
|
|
||||||
##### On-premises
|
##### On-premises
|
||||||
The on-premises deployment model is for organizations that do not have cloud identities or use applications hosted in Azure Active Directory.
|
The on-premises deployment model is for organizations that do not have cloud identities or use applications hosted in Azure Active Directory.
|
||||||
|
|
||||||
> [!Important]
|
> [!Important]
|
||||||
> On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.</br>
|
> On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
|
||||||
> **Requirements:**</br>
|
>
|
||||||
> Reset from settings - Windows 10, version 1703, Professional</br>
|
> **Requirements:**
|
||||||
> Reset above lock screen - Windows 10, version 1709, Professional</br>
|
> - Reset from settings - Windows 10, version 1703, Professional
|
||||||
> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
> - Reset above lock screen - Windows 10, version 1709, Professional
|
||||||
|
> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
||||||
|
|
||||||
It's fundamentally important to understand which deployment model to use for a successful deployment. Some aspects of the deployment may have already been decided for you based on your current infrastructure.
|
It's fundamentally important to understand which deployment model to use for a successful deployment. Some aspects of the deployment may have already been decided for you based on your current infrastructure.
|
||||||
|
|
||||||
@ -95,6 +97,9 @@ It's fundamentally important to understand which deployment model to use for a s
|
|||||||
|
|
||||||
A deployment's trust type defines how each Windows Hello for Business client authenticates to the on-premises Active Directory. There are two trust types: key trust and certificate trust.
|
A deployment's trust type defines how each Windows Hello for Business client authenticates to the on-premises Active Directory. There are two trust types: key trust and certificate trust.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available.
|
||||||
|
|
||||||
The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during the built-in provisioning experience. This requires an adequate distribution of Windows Server 2016 or later domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more.
|
The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during the built-in provisioning experience. This requires an adequate distribution of Windows Server 2016 or later domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more.
|
||||||
|
|
||||||
The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires [Windows Server 2016 or later Active Directory schema](./hello-hybrid-cert-trust-prereqs.md#directories)). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller.
|
The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires [Windows Server 2016 or later Active Directory schema](./hello-hybrid-cert-trust-prereqs.md#directories)). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller.
|
||||||
|
|||||||
@ -54,8 +54,11 @@ Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP]
|
|||||||
### Enable HVCI using Group Policy
|
### Enable HVCI using Group Policy
|
||||||
|
|
||||||
1. Use Group Policy Editor (gpedit.msc) to either edit an existing GPO or create a new one.
|
1. Use Group Policy Editor (gpedit.msc) to either edit an existing GPO or create a new one.
|
||||||
|
|
||||||
2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**.
|
2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**.
|
||||||
|
|
||||||
3. Double-click **Turn on Virtualization Based Security**.
|
3. Double-click **Turn on Virtualization Based Security**.
|
||||||
|
|
||||||
4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be disabled remotely or select **Enabled without UEFI lock**.
|
4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be disabled remotely or select **Enabled without UEFI lock**.
|
||||||
|
|
||||||
|
|
||||||
@ -71,14 +74,17 @@ Set the following registry keys to enable HVCI. This provides exactly the same s
|
|||||||
<!--This comment ensures that the Important above and the Warning below don't merge together. -->
|
<!--This comment ensures that the Important above and the Warning below don't merge together. -->
|
||||||
|
|
||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled.<br>In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can still have WDAC enabled.<br>
|
> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled.
|
||||||
|
>
|
||||||
|
> In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can still have WDAC enabled.
|
||||||
|
>
|
||||||
> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers.
|
> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers.
|
||||||
|
|
||||||
#### For Windows 10 version 1607 and later
|
#### For Windows 10 version 1607 and later
|
||||||
|
|
||||||
Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock):
|
Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock):
|
||||||
|
|
||||||
``` commands
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
||||||
|
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
||||||
@ -94,49 +100,49 @@ If you want to customize the preceding recommended settings, use the following s
|
|||||||
|
|
||||||
**To enable VBS**
|
**To enable VBS**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
**To enable VBS and require Secure boot only (value 1)**
|
**To enable VBS and require Secure boot only (value 1)**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
**To enable VBS with Secure Boot and DMA (value 3)**
|
**To enable VBS with Secure Boot and DMA (value 3)**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 3 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 3 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
**To enable VBS without UEFI lock (value 0)**
|
**To enable VBS without UEFI lock (value 0)**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
**To enable VBS with UEFI lock (value 1)**
|
**To enable VBS with UEFI lock (value 1)**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 1 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
**To enable virtualization-based protection of Code Integrity policies**
|
**To enable virtualization-based protection of Code Integrity policies**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
**To enable virtualization-based protection of Code Integrity policies without UEFI lock (value 0)**
|
**To enable virtualization-based protection of Code Integrity policies without UEFI lock (value 0)**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
**To enable virtualization-based protection of Code Integrity policies with UEFI lock (value 1)**
|
**To enable virtualization-based protection of Code Integrity policies with UEFI lock (value 1)**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 1 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -144,7 +150,7 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorE
|
|||||||
|
|
||||||
Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock):
|
Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock):
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
||||||
|
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
||||||
@ -158,31 +164,31 @@ If you want to customize the preceding recommended settings, use the following s
|
|||||||
|
|
||||||
**To enable VBS (it is always locked to UEFI)**
|
**To enable VBS (it is always locked to UEFI)**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
**To enable VBS and require Secure boot only (value 1)**
|
**To enable VBS and require Secure boot only (value 1)**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
**To enable VBS with Secure Boot and DMA (value 3)**
|
**To enable VBS with Secure Boot and DMA (value 3)**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 3 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 3 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
**To enable virtualization-based protection of Code Integrity policies (with the default, UEFI lock)**
|
**To enable virtualization-based protection of Code Integrity policies (with the default, UEFI lock)**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
**To enable virtualization-based protection of Code Integrity policies without UEFI lock**
|
**To enable virtualization-based protection of Code Integrity policies without UEFI lock**
|
||||||
|
|
||||||
``` command
|
```console
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG_DWORD /d 1 /f
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG_DWORD /d 1 /f
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -190,7 +196,9 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG
|
|||||||
|
|
||||||
Windows 10 and Windows Server 2016 have a WMI class for related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command:
|
Windows 10 and Windows Server 2016 have a WMI class for related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command:
|
||||||
|
|
||||||
`Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard`
|
```powershell
|
||||||
|
Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard
|
||||||
|
```
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10.
|
> The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10.
|
||||||
@ -279,7 +287,7 @@ This field lists the computer name. All valid values for computer name.
|
|||||||
|
|
||||||
Another method to determine the available and enabled Windows Defender Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Windows Defender Device Guard properties are displayed at the bottom of the **System Summary** section.
|
Another method to determine the available and enabled Windows Defender Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Windows Defender Device Guard properties are displayed at the bottom of the **System Summary** section.
|
||||||
|
|
||||||
|
:::image type="content" alt-text="Windows Defender Device Guard properties in the System Summary." source="../images/dg-fig11-dgproperties.png" lightbox="../images/dg-fig11-dgproperties.png":::
|
||||||
|
|
||||||
## Troubleshooting
|
## Troubleshooting
|
||||||
|
|
||||||
@ -291,12 +299,15 @@ C. If you experience a critical error during boot or your system is unstable aft
|
|||||||
|
|
||||||
## How to turn off HVCI
|
## How to turn off HVCI
|
||||||
|
|
||||||
1. Run the following command from an elevated prompt to set the HVCI registry key to off
|
1. Run the following command from an elevated prompt to set the HVCI registry key to off:
|
||||||
```ini
|
|
||||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
|
```console
|
||||||
```
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
|
||||||
2. Restart the device.
|
```
|
||||||
3. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed.
|
|
||||||
|
1. Restart the device.
|
||||||
|
|
||||||
|
1. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed.
|
||||||
|
|
||||||
## HVCI deployment in virtual machines
|
## HVCI deployment in virtual machines
|
||||||
|
|
||||||
@ -311,6 +322,6 @@ Set-VMSecurity -VMName <VMName> -VirtualizationBasedSecurityOptOut $true
|
|||||||
### Requirements for running HVCI in Hyper-V virtual machines
|
### Requirements for running HVCI in Hyper-V virtual machines
|
||||||
- The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607.
|
- The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607.
|
||||||
- The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10.
|
- The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10.
|
||||||
- HVCI and [nested virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time
|
- HVCI and [nested virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time. To enable the HyperV role on the virtual machine, you must first install the HyperV role in a Windows nested virtualization environment.
|
||||||
- Virtual Fibre Channel adapters are not compatible with HVCI. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of virtualization-based security using `Set-VMSecurity`.
|
- Virtual Fibre Channel adapters are not compatible with HVCI. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of virtualization-based security using `Set-VMSecurity`.
|
||||||
- The AllowFullSCSICommandSet option for pass-through disks is not compatible with HVCI. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of virtualization-based security using `Set-VMSecurity`.
|
- The AllowFullSCSICommandSet option for pass-through disks is not compatible with HVCI. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of virtualization-based security using `Set-VMSecurity`.
|
||||||
|
|||||||
@ -14,7 +14,7 @@ author: jsuther1974
|
|||||||
ms.reviewer: isbrahm
|
ms.reviewer: isbrahm
|
||||||
ms.author: dansimp
|
ms.author: dansimp
|
||||||
manager: dansimp
|
manager: dansimp
|
||||||
ms.date: 08/10/2021
|
ms.date: 10/19/2021
|
||||||
ms.technology: mde
|
ms.technology: mde
|
||||||
---
|
---
|
||||||
|
|
||||||
@ -26,8 +26,8 @@ ms.technology: mde
|
|||||||
- Windows 11
|
- Windows 11
|
||||||
- Windows Server 2016 and above
|
- Windows Server 2016 and above
|
||||||
|
|
||||||
>[!NOTE]
|
> [!NOTE]
|
||||||
>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md).
|
> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md).
|
||||||
|
|
||||||
Windows 10, version 1703 introduced a new option for Windows Defender Application Control (WDAC), called _managed installer_, that helps balance security and manageability when enforcing application control policies. This option lets you automatically allow applications installed by a designated software distribution solution such as Microsoft Endpoint Configuration Manager.
|
Windows 10, version 1703 introduced a new option for Windows Defender Application Control (WDAC), called _managed installer_, that helps balance security and manageability when enforcing application control policies. This option lets you automatically allow applications installed by a designated software distribution solution such as Microsoft Endpoint Configuration Manager.
|
||||||
|
|
||||||
@ -41,8 +41,7 @@ Ensure that the WDAC policy allows the system/boot components and any other auth
|
|||||||
|
|
||||||
## Security considerations with managed installer
|
## Security considerations with managed installer
|
||||||
|
|
||||||
Since managed installer is a heuristic-based mechanism, it doesn't provide the same security guarantees that explicit allow or deny rules do.
|
Since managed installer is a heuristic-based mechanism, it doesn't provide the same security guarantees that explicit allow or deny rules do. The managed installer is best suited for use where each user operates as a standard user and where all software is deployed and installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager (MEMCM).
|
||||||
It's best suited for use where each user operates as a standard user and where all software is deployed and installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager (MEMCM).
|
|
||||||
|
|
||||||
Users with administrator privileges, or malware running as an administrator user on the system, may be able to circumvent the intent of Windows Defender Application Control when the managed installer option is allowed.
|
Users with administrator privileges, or malware running as an administrator user on the system, may be able to circumvent the intent of Windows Defender Application Control when the managed installer option is allowed.
|
||||||
|
|
||||||
@ -85,19 +84,19 @@ Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerS
|
|||||||
|
|
||||||
2. Manually rename the rule collection to ManagedInstaller
|
2. Manually rename the rule collection to ManagedInstaller
|
||||||
|
|
||||||
Change
|
Change:
|
||||||
|
|
||||||
```powershell
|
```powershell
|
||||||
<RuleCollection Type="Exe" EnforcementMode="NotConfigured">
|
<RuleCollection Type="Exe" EnforcementMode="NotConfigured">
|
||||||
```
|
```
|
||||||
|
|
||||||
to
|
to:
|
||||||
|
|
||||||
```powershell
|
```powershell
|
||||||
<RuleCollection Type="ManagedInstaller" EnforcementMode="AuditOnly">
|
<RuleCollection Type="ManagedInstaller" EnforcementMode="AuditOnly">
|
||||||
```
|
```
|
||||||
|
|
||||||
An example of a valid Managed Installer rule collection, using Microsoft Endpoint Config Manager (MEMCM), MEM (Intune), Powershell, and PowerShell ISE, is shown below. Remove any rules that you do not wish to designate as a Managed Installer.
|
An example of a valid Managed Installer rule collection, using Microsoft Endpoint Config Manager (MEMCM), MEM (Intune), PowerShell, and PowerShell ISE, is shown below. Remove any rules that you do not wish to designate as a Managed Installer.
|
||||||
|
|
||||||
```xml
|
```xml
|
||||||
<AppLockerPolicy Version="1">
|
<AppLockerPolicy Version="1">
|
||||||
@ -177,45 +176,9 @@ An example of a valid Managed Installer rule collection, using Microsoft Endpoin
|
|||||||
</RuleCollection>
|
</RuleCollection>
|
||||||
</AppLockerPolicy>
|
</AppLockerPolicy>
|
||||||
```
|
```
|
||||||
### Enable service enforcement in AppLocker policy
|
|
||||||
|
|
||||||
Since many installation processes rely on services, it is typically necessary to enable tracking of services.
|
>[!NOTE]
|
||||||
Correct tracking of services requires the presence of at least one rule in the rule collection. So, a simple audit-only rule will suffice. The audit rule can be added to the policy created above, which specifies the rule collection of your managed installer.
|
>Since many installation processes rely on services, it is typically necessary to enable tracking of services. Correct tracking of services requires the presence of at least one rule in the rule collection. So, a simple audit-only rule will suffice.
|
||||||
|
|
||||||
For example:
|
|
||||||
|
|
||||||
```xml
|
|
||||||
<RuleCollection Type="Dll" EnforcementMode="AuditOnly" >
|
|
||||||
<FilePathRule Id="86f235ad-3f7b-4121-bc95-ea8bde3a5db5" Name="Dummy Rule" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
|
|
||||||
<Conditions>
|
|
||||||
<FilePathCondition Path="%OSDRIVE%\ThisWillBeBlocked.dll" />
|
|
||||||
</Conditions>
|
|
||||||
</FilePathRule>
|
|
||||||
<RuleCollectionExtensions>
|
|
||||||
<ThresholdExtensions>
|
|
||||||
<Services EnforcementMode="Enabled" />
|
|
||||||
</ThresholdExtensions>
|
|
||||||
<RedstoneExtensions>
|
|
||||||
<SystemApps Allow="Enabled"/>
|
|
||||||
</RedstoneExtensions>
|
|
||||||
</RuleCollectionExtensions>
|
|
||||||
</RuleCollection>
|
|
||||||
<RuleCollection Type="Exe" EnforcementMode="AuditOnly">
|
|
||||||
<FilePathRule Id="9420c496-046d-45ab-bd0e-455b2649e41e" Name="Dummy Rule" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
|
|
||||||
<Conditions>
|
|
||||||
<FilePathCondition Path="%OSDRIVE%\ThisWillBeBlocked.exe" />
|
|
||||||
</Conditions>
|
|
||||||
</FilePathRule>
|
|
||||||
<RuleCollectionExtensions>
|
|
||||||
<ThresholdExtensions>
|
|
||||||
<Services EnforcementMode="Enabled" />
|
|
||||||
</ThresholdExtensions>
|
|
||||||
<RedstoneExtensions>
|
|
||||||
<SystemApps Allow="Enabled"/>
|
|
||||||
</RedstoneExtensions>
|
|
||||||
</RuleCollectionExtensions>
|
|
||||||
</RuleCollection>
|
|
||||||
```
|
|
||||||
|
|
||||||
## Enable the managed installer option in WDAC policy
|
## Enable the managed installer option in WDAC policy
|
||||||
|
|
||||||
@ -234,7 +197,7 @@ Below are steps to create a WDAC policy that allows Windows to boot and enables
|
|||||||
Set-CIPolicyIdInfo -FilePath <XML filepath> -PolicyName "<friendly name>" -ResetPolicyID
|
Set-CIPolicyIdInfo -FilePath <XML filepath> -PolicyName "<friendly name>" -ResetPolicyID
|
||||||
```
|
```
|
||||||
|
|
||||||
3. Set Option 13 (Enabled:Managed Installer)
|
3. Set Option 13 (Enabled:Managed Installer).
|
||||||
|
|
||||||
```powershell
|
```powershell
|
||||||
Set-RuleOption -FilePath <XML filepath> -Option 13
|
Set-RuleOption -FilePath <XML filepath> -Option 13
|
||||||
@ -305,4 +268,4 @@ Once you've completed configuring your chosen Managed Installer, by specifying w
|
|||||||
```powershell
|
```powershell
|
||||||
Get-AppLockerPolicy -Effective -Xml -ErrorVariable ev -ErrorAction SilentlyContinue
|
Get-AppLockerPolicy -Effective -Xml -ErrorVariable ev -ErrorAction SilentlyContinue
|
||||||
```
|
```
|
||||||
This command will show the raw XML to verify the individual rules that were set.
|
This command will show the raw XML to verify the individual rules that were set.
|
||||||
|
|||||||
Reference in New Issue
Block a user