mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-28 05:07:23 +00:00
Merge branch 'master' of https://github.com/MicrosoftDocs/windows-docs-pr into minorupdate
This commit is contained in:
Greg Lindsay
commit
168f02a20f
@ -15952,6 +15952,11 @@
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "devices/surface/using-the-sda-deployment-share.md",
|
||||
"redirect_url": "https://docs.microsoft.com/surface/microsoft-surface-deployment-accelerator",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction",
|
||||
"redirect_document_id": true
|
||||
|
||||
@ -41,7 +41,7 @@ When auto-enrollment is enabled, no additional manual enrollment is needed. When
|
||||
1. Select **Enroll into device management** and enter your organizational account. You will be redirected to your organization's sign in page.
|
||||
1. Upon successful authentication to the MDM server, a success message is shown.
|
||||
|
||||
Your device is now enrolled with your MDM server. The device will need to restart to acquire policies, certificates, and apps. The Settings app will now reflect that the device is enrolled in device management.
|
||||
Your device is now enrolled with your MDM server. The Settings app will now reflect that the device is enrolled in device management.
|
||||
|
||||
## Unenroll HoloLens from Intune
|
||||
|
||||
|
||||
@ -132,7 +132,7 @@ Many Windows apps now support both dark and light modes, and HoloLens 2 customer
|
||||
- 3D Viewer
|
||||
- Movies & TV
|
||||
|
||||
|
||||
|
||||
|
||||
### System voice commands
|
||||
|
||||
|
||||
BIN
devices/hololens/images/DarkMode.jpg
Normal file
BIN
devices/hololens/images/DarkMode.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 104 KiB |
@ -38,7 +38,6 @@
|
||||
### [Enable the Surface Laptop keyboard during MDT deployment](enable-surface-keyboard-for-windows-pe-deployment.md)
|
||||
### [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md)
|
||||
### [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)
|
||||
### [Using the Surface Deployment Accelerator deployment share](using-the-sda-deployment-share.md)
|
||||
### [Surface System SKU reference](surface-system-sku-reference.md)
|
||||
|
||||
## Manage
|
||||
|
||||
@ -8,14 +8,14 @@ ms.sitesec: library
|
||||
author: coveminer
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 5/06/2020
|
||||
ms.date: 5/29/2020
|
||||
ms.reviewer: brrecord
|
||||
manager: laurawi
|
||||
audience: itpro
|
||||
---
|
||||
# What’s new in Surface Dock 2
|
||||
|
||||
Surface Dock 2, the next generation Surface dock, lets users connect external monitors and multiple peripherals to obtain a fully modernized desktop experience from a Surface device. Built to maximize efficiency at the office, in a flexible workspace, or at home, Surface Dock 2 features seven ports, including two front-facing USB-C ports, with 15 watts of fast charging power for phone and accessories. Surface Dock 2 is designed to simplify IT management, enabling admins to automate firmware updates using Windows Update or centralize updates with internal software distribution tools. An extended set of management tools will be released via Windows update upon commercial distribution.
|
||||
Surface Dock 2, the next generation Surface dock, lets users connect external monitors and multiple peripherals to obtain a fully modernized desktop experience from a Surface device. Built to maximize efficiency at the office, in a flexible workspace, or at home, Surface Dock 2 features seven ports, including two front-facing USB-C ports, with 15 watts of fast charging power for phone and accessories. Surface Dock 2 is designed to simplify IT management, enabling admins to automate firmware updates using Windows Update or centralize updates with internal software distribution tools. Surface Enterprise Management Mode (SEMM) now enables IT admins to secure ports on Surface Dock 2. For more information, see [Secure Surface Dock 2 ports with Surface Enterprise Management Mode](https://techcommunity.microsoft.com/t5/surface-it-pro-blog/secure-surface-dock-2-ports-with-surface-enterprise-management/ba-p/1418999).
|
||||
|
||||
## General system requirements
|
||||
|
||||
@ -28,8 +28,7 @@ Surface Dock 2, the next generation Surface dock, lets users connect external mo
|
||||
- Surface Book 2
|
||||
- Surface Laptop 2
|
||||
- Surface Go
|
||||
- Surface Go with LTE Advanced
|
||||
- Surface Studio 2
|
||||
- Surface Go with LTE Advanced
|
||||
- Surface Pro 7
|
||||
- Surface Laptop 3
|
||||
- Surface Book 3
|
||||
@ -86,7 +85,7 @@ Surface Dock 2, the next generation Surface dock, lets users connect external mo
|
||||
|Surflink|Yes|Yes|
|
||||
|USB-A|2 front facing USB 3.1 Gen 1<br>2 rear facing USB 3.1 Gen 1|2 rear facing USB 3.2 Gen 2 (7.5W power)|
|
||||
|Mini Display port|2 rear facing (DP1.2)|None|
|
||||
|USB-C|None|2 front facing USB 3.2 Gen 2<br>[15W power]<br>2 rear facing USB 3.2 Gen 2 (DP1.4a)<br>[7.5W power]|
|
||||
|USB-C|None|2 front facing USB 3.2 Gen 2<br>(15W power)<br>2 rear facing USB 3.2 Gen 2 (DP1.4a)<br>(7.5W power)|
|
||||
|3.5 mm Audio in/out|Yes|Yes|
|
||||
|Ethernet|Yes, 1 gigabit|Yes 1 gigabit|
|
||||
|DC power in|Yes|Yes|
|
||||
@ -99,20 +98,18 @@ Surface Dock 2, the next generation Surface dock, lets users connect external mo
|
||||
|Wake-on-LAN from Connected Standby<sup>1</sup>|Yes|Yes|
|
||||
|Wake-on-LAN from S4/S5 sleep modes|No|Yes|
|
||||
|Network PXE boot|Yes|Yes|
|
||||
|SEMM host access control|No|Coming in Windows Update<sup>2</sup>|
|
||||
|SEMM port access control<sup>3</sup>|No|Coming in Windows Update|
|
||||
|SEMM host access control|No|Yes
|
||||
|SEMM port access control<sup>2</sup>|No|Yes|
|
||||
|Servicing support|MSI|Windows Update or MSI|
|
||||
||||
|
||||
|
||||
1. *Devices must be configured for Wake on LAN via Surface Enterprise Management Mode (SEMM) or Device Firmware Control Interface (DFCI) to wake from Hibernation or Power-Off states. Wake from Hibernation or Power-Off is supported on Surface Pro 7, Surface Laptop 3, Surface Pro X, Surface Book 3, and Surface Go 2. Software license required for some features. Sold separately.*
|
||||
|
||||
2. *Pending release via Windows Update.*
|
||||
|
||||
3. *Software license required for some features. Sold separately.*
|
||||
2. *Software license required for some features. Sold separately.*
|
||||
|
||||
## Streamlined device management
|
||||
|
||||
Following the public announcement of Surface Dock 2, Surface will release streamlined management functionality via Windows Update enabling IT admins to utilize the following enterprise-grade features:
|
||||
Surface has released streamlined management functionality via Windows Update enabling IT admins to utilize the following enterprise-grade features:
|
||||
|
||||
- **Frictionless updates**. Update your docks silently and automatically, with Windows Update or Microsoft Endpoint Configuration Manager, (formerly System Center Configuration Manager - SCCM) or other MSI deployment tools.
|
||||
- **Wake from the network**. Manage and access corporate devices without depending on users to keep their devices powered on. Even when a docked device is in sleep, hibernation, or power off mode, your team can wake from the network for service and management, using Endpoint Configuration Manager or other enterprise management tools.
|
||||
@ -120,5 +117,6 @@ Following the public announcement of Surface Dock 2, Surface will release stream
|
||||
|
||||
## Next steps
|
||||
|
||||
- [Secure Surface Dock 2 ports with Surface Enterprise Management Mode](https://techcommunity.microsoft.com/t5/surface-it-pro-blog/secure-surface-dock-2-ports-with-surface-enterprise-management/ba-p/1418999)
|
||||
- [Surface Enterprise Management Mode](surface-enterprise-management-mode.md)
|
||||
- [Best practice power settings for Surface devices](maintain-optimal-power-settings-on-Surface-devices.md)
|
||||
|
||||
@ -1,172 +0,0 @@
|
||||
---
|
||||
title: Using the Microsoft Surface Deployment Accelerator deployment share (Surface)
|
||||
description: Explore the scenarios where you can use SDA to meet the deployment needs of your organization including Proof of Concept, pilot deployment, as well as import additional drivers and applications.
|
||||
keywords: deploy, install, automate, deployment solution
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: surface, devices
|
||||
ms.sitesec: library
|
||||
author: coveminer
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.audience: itpro
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
---
|
||||
|
||||
# Using the Microsoft Surface Deployment Accelerator deployment share
|
||||
|
||||
With Microsoft Surface Deployment Accelerator (SDA), you can quickly and easily set up a deployment solution that is ready to deploy Windows to Surface devices. The prepared environment is built on powerful deployment technologies available from Microsoft, such as the [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/windows/dn475741), and is capable of immediately performing a deployment after configuration. See [Step-by-Step: Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator) for a comprehensive walkthrough of using the SDA wizard to set up a deployment share and perform a deployment.
|
||||
|
||||
For more information about SDA and information on how to download SDA, see [Microsoft Surface Deployment Accelerator (SDA)](https://technet.microsoft.com/itpro/surface/microsoft-surface-deployment-accelerator).
|
||||
|
||||
> [!NOTE]
|
||||
> SDA is not supported on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information refer to [Deploy Surface devices](deploy.md).
|
||||
|
||||
Using SDA provides these primary benefits:
|
||||
|
||||
* With SDA, you can create a ready-to-deploy environment that can deploy to target devices as fast as your download speeds allow. The wizard experience enables you to check a few boxes and then the automated process builds your deployment environment for you.
|
||||
|
||||
* With SDA, you prepare a deployment environment built on the industry leading deployment solution of MDT. With MDT you can scale from a relatively basic deployment of a few Surface devices to a solution capable of deploying to thousands of devices including all of the different makes and models in your organization and all of the applications required by each device and user.
|
||||
|
||||
This article explores four scenarios where you can use SDA to meet the needs of your organization. See [Deploy Windows 10](https://technet.microsoft.com/itpro/windows/deploy/index) to explore the capabilities of MDT and the Windows deployment technologies available from Microsoft in greater detail.
|
||||
|
||||
## Perform a Proof of Concept deployment
|
||||
|
||||
One of the primary scenarios for use of SDA is as a Proof of Concept. A *Proof of Concept* (PoC) enables you to test or evaluate the capabilities of a solution or technology. A PoC is often used to illustrate the benefits of the solution or technology to decision makers. For example, if you want to recommend Surface devices as a replacement of older point of sale (POS) systems, you could perform a PoC to demonstrate how Surface devices provide superior computing power, flexibility, and connectivity when compared to alternate options.
|
||||
|
||||
Using SDA to prepare a PoC of Surface devices enables you to very quickly prepare a demonstration of Surface device or devices, which gives you more time for customization or preparation. The flexibility of SDA even lets you import resources, like applications and drivers, from existing MDT deployment infrastructure. See the [Work with existing deployment shares](#work-with-existing-deployment-shares) section later in this article for more information.
|
||||
|
||||
SDA is also an excellent PoC of the capabilities of MDT. SDA demonstrates just how quickly an MDT deployment environment can be prepared and made ready for deployment to devices. It also shows just how flexible and customizable the MDT solution can be, with support for Windows 10 and Windows 8.1, for Microsoft Store and desktop applications, and several models of Surface devices.
|
||||
|
||||
Some recommendations for a successful PoC with SDA are:
|
||||
|
||||
* Keep your SDA deployment environment separate from your production network. This ensures optimal performance and reduces potential for conflicts during your PoC deployment.
|
||||
|
||||
* Use a fresh and updated instance of Windows Server to house your SDA deployment share to maintain the simplicity and performance of the demonstration environment.
|
||||
|
||||
* Test the deployment process before you demonstrate your PoC. This reduces the potential for unexpected situations and keeps the demonstration focused on the deployment process and Surface devices.
|
||||
|
||||
* Use offline files with SDA to further reduce installation times.
|
||||
|
||||
* For help with your PoC, contact [Surface Support](https://www.microsoft.com/surface/support/contact-us-business).
|
||||
|
||||
## Perform a pilot deployment
|
||||
|
||||
A pilot deployment differs from a PoC. Where a PoC is usually a closed demonstration that is performed prior to the deployment process in order to get approval for the use of certain technologies or solutions, a *pilot deployment* is performed during the deployment process as a limited scope deployment for testing and validation. The focus of a pilot deployment can be as narrow as only a handful of devices, or wide enough to include a significant portion of your organization.
|
||||
|
||||
>[!NOTE]
|
||||
>A pilot deployment should not replace the testing process that should be performed regularly in the lab as the deployment environment is built and developed. A deployment solution should be tested in virtual and physical environments as new applications and drivers are added and when task sequences are modified and before a pilot deployment is performed.
|
||||
|
||||
For example, you are tasked with deploying Surface devices to mobile workers and you want to test the organization’s MDT deployment process by providing a small number of devices to executives. You can use SDA to create an isolated Surface deployment environment and then copy the task sequence, applications, and drivers needed from the production deployment share. This not only enables you to quickly create a Surface deployment, but it also minimizes the risk to the production deployment process used for other types of devices.
|
||||
|
||||
For small organizations, the pilot deployment environment of SDA may suffice as a complete deployment solution. Even if you do not have an existing deployment environment, you can import drivers and applications (covered later in this article) to provide a complete deployment solution based on MDT. Even without previous knowledge of MDT or Windows deployment, you can follow the [Step-by-Step: Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator) article to get started with a deployment to Surface devices.
|
||||
|
||||
## Import additional drivers
|
||||
|
||||
The SDA deployment share includes all of the drivers needed for Surface devices. This includes the drivers for the components inside the Surface device, such as the wireless network adapter and the main chipset, as well as drivers for Surface accessories, such as the Surface Dock or Surface USB Ethernet adapters. The SDA deployment share does not, however, include drivers for third-party devices or peripherals.
|
||||
|
||||
For example, you may intend to use your Surface device with a thermal printer, credit card reader, and barcode scanner as a POS terminal. In this scenario, the thermal printer, credit card reader, and barcode scanner will very likely require installation of drivers to operate properly. You could potentially download and install these drivers from Windows Update when each peripheral is connected, or you could install the driver package from the manufacturer manually on each Surface device, but the ideal solution is to have these drivers already present in Windows so that when the peripheral is connected, it will just work.
|
||||
|
||||
Because SDA is built on MDT, adding the drivers to the SDA deployment share is easy and simple.
|
||||
|
||||
>[!NOTE]
|
||||
>The drivers must be in the Setup Information File (.inf) format. If the drivers for your device come as an executable file (.exe), they may need to be extracted or installed to procure the .inf file. Some device drivers come packaged with applications, for example an all-in-one printer bundled with scan software. These applications will need to be installed separately from the drivers.
|
||||
|
||||
To import drivers for a peripheral device:
|
||||
|
||||
1. Download the drivers for your device from the manufacturer web site.
|
||||
|
||||
2. Open the MDT Deployment Workbench.
|
||||
|
||||
3. Expand the **Deployment Shares** node and expand the SDA deployment share.
|
||||
|
||||
4. Expand the **Out-of-Box Drivers** folder.
|
||||
|
||||
5. Select the folder of the Surface model for which you would like to include this driver.
|
||||
|
||||
6. Click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 1.
|
||||
|
||||
|
||||
|
||||
*Figure 1. Provide the location of your driver files*
|
||||
|
||||
7. The Import Drivers Wizard presents a series of steps:
|
||||
|
||||
- **Specify Directory** – Click **Browse** and navigate to the folder where you stored the drivers in Step 1.
|
||||
- **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
|
||||
- **Progress** – While the drivers are imported, a progress bar is displayed on this page.
|
||||
- **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Drivers Wizard.
|
||||
|
||||
8. Repeat Steps 5-7 for each Surface model on which you would like to include this driver.
|
||||
|
||||
9. Close the Deployment Workbench.
|
||||
|
||||
After the drivers are imported for the Surface model, the deployment task sequence will automatically select the drivers during the deployment process and include them in the Windows environment. When you connect your device, such as the barcode scanner in the example, Windows should automatically detect the device and you should be able to use it immediately.
|
||||
|
||||
>[!NOTE]
|
||||
>You can even import drivers for other computer makes and models to support other devices. See **Step 5: Prepare the drivers repository** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt) for more information about how to import drivers for other makes and models.
|
||||
|
||||
## Import additional applications
|
||||
|
||||
As with drivers, the SDA deployment share can be pre-configured with apps like the Surface App and Microsoft Office 365. You can also add applications to the SDA deployment share and configure them to be installed on your Surface devices during deployment of Windows. In the ideal scenario, your Surface devices deployed with the SDA deployment share will include all of the applications needed to be ready for your end users.
|
||||
|
||||
In the previous example for including drivers for a POS system, you would also need to include POS software for processing transactions and recording the input from the barcode scanner and credit card reader. To import an application and prepare it for installation on your Surface devices during Windows deployment:
|
||||
|
||||
1. Download the application installation files or locate the installation media for your application.
|
||||
|
||||
2. Determine the command line instruction for silent installation, usually provided by the developer of the application. For Windows Installer files (.msi), see [Standard Installer Command-Line Options](https://msdn.microsoft.com/library/windows/desktop/aa372024) in the Windows Dev Center.
|
||||
|
||||
3. Open the MDT Deployment Workbench.
|
||||
|
||||
4. Expand the **Deployment Shares** node and expand the SDA deployment share.
|
||||
|
||||
5. Expand the **Applications** folder.
|
||||
|
||||
6. Click **New Application** to start the New Application Wizard, as shown in Figure 2.
|
||||
|
||||
|
||||
|
||||
*Figure 2: Provide the command to install your application*
|
||||
|
||||
7. Follow the steps of the New Application Wizard:
|
||||
|
||||
- **Application Type** – Click **Application with Source Files**, and then click **Next**.
|
||||
- **Details** – Enter a name for the application in the **Application Name** field. Enter publisher, version, and language information in the **Publisher**, **Version**, and **Language** fields if desired. Click **Next**.
|
||||
- **Source** – Click **Browse** to navigate to and select the folder with the application installation files procured in Step 1, and then click **Next**.
|
||||
- **Destination** – Enter a name for the folder where the application files will be stored in the **Specify the Name of the Directory that Should Be Created** field or click **Next** to accept the default name.
|
||||
- **Command Details** – Enter the silent command-line instruction, for example `setup.msi /quiet /norestart`
|
||||
- **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
|
||||
- **Progress** – While the installation files are imported, a progress bar is displayed on this page.
|
||||
- **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Application Wizard.
|
||||
|
||||
8. Click the **Task Sequences** folder, right-click **1 - Deploy Microsoft Surface**, and then click **Properties**.
|
||||
|
||||
9. Click the **Task Sequence** tab to view the steps that are included in the new task sequence.
|
||||
|
||||
10. Select the **Windows Update (Pre-Application Installation)** step, and then click **Add**.
|
||||
|
||||
11. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3.
|
||||
|
||||
|
||||
|
||||
*Figure 3. A new Install Application step for Sample POS App*
|
||||
|
||||
12. On the **Properties** tab of the new **Install Application** step, enter **Install - Sample POS App** in the **Name** field, where *Sample POS App* is the name of your app.
|
||||
|
||||
13. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share.
|
||||
|
||||
14. Select your app from the list of applications, and then click **OK**.
|
||||
|
||||
15. Click **OK** to close the task sequence properties.
|
||||
|
||||
16. Close the Deployment Workbench.
|
||||
|
||||
## Work with existing deployment shares
|
||||
|
||||
One of the many benefits of an MDT deployment share is the simplicity of how deployment resources are stored. The MDT deployment share is, at its core, just a standard network file share. All deployment resources, such as Windows images, application installation files, and drivers, are stored in a share that can be browsed with File Explorer, copied and pasted, and moved just like any other file share, provided that you have the necessary permissions. This makes working with deployment resources extremely easy. MDT even allows you to make it easier by allowing you to open multiple deployment shares from the Deployment Workbench and to transfer or copy resources between them.
|
||||
|
||||
This ability gives SDA some extra capabilities when used in an environment with an existing MDT infrastructure. For example, if you install SDA on an isolated server to prepare a PoC and then log on to your production MDT deployment share from the Deployment Workbench on your SDA server, you can copy applications, drivers, task sequences, and other components into the SDA deployment share that is prepared with Surface apps and drivers. With this process, in a very short amount time, you can have a deployment environment ready to deploy your organization’s precise requirements to Surface devices.
|
||||
|
||||
You can also use this capability in reverse. For example, you can copy the Surface drivers, deployment task sequences, and apps directly into a lab or testing environment following a successful PoC. Using these resources, you can immediately begin to integrate Surface deployment into your existing deployment infrastructure.
|
||||
@ -4,7 +4,6 @@ title: How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6
|
||||
description: How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User
|
||||
ms.assetid: f1d2ab1f-0831-4976-b49f-169511d3382a
|
||||
author: dansimp
|
||||
ms.assetid: f1d2ab1f-0831-4976-b49f-169511d3382a
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -4,7 +4,6 @@ title: How to Use an App-V 4.6 Application From an App-V 5.0 Application
|
||||
description: How to Use an App-V 4.6 Application From an App-V 5.0 Application
|
||||
ms.assetid: 4e78cb32-9c8b-478e-ae8b-c474a7e42487
|
||||
author: msfttracyp
|
||||
ms.assetid: 4e78cb32-9c8b-478e-ae8b-c474a7e42487
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -2,11 +2,10 @@
|
||||
title: Upgrading from MBAM 2.5 to MBAM 2.5 SP1 Servicing Release Update
|
||||
author: dansimp
|
||||
ms.author: ksharma
|
||||
manager:
|
||||
manager: miaposto
|
||||
audience: ITPro
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
manager: miaposto
|
||||
ms.localizationpriority: Normal
|
||||
---
|
||||
|
||||
|
||||
@ -14,11 +14,13 @@ ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool
|
||||
|
||||
```powershell
|
||||
# Script to find out if machine is Device Guard compliant
|
||||
# requires driver verifier on system.
|
||||
# Script to find out if a machine is Device Guard compliant.
|
||||
# The script requires a driver verifier present on the system.
|
||||
|
||||
param([switch]$Capable, [switch]$Ready, [switch]$Enable, [switch]$Disable, $SIPolicyPath, [switch]$AutoReboot, [switch]$DG, [switch]$CG, [switch]$HVCI, [switch]$HLK, [switch]$Clear, [switch]$ResetVerifier)
|
||||
|
||||
$path = "C:\DGLogs\"
|
||||
@ -36,7 +38,7 @@ $DGVerifySuccess = New-Object System.Text.StringBuilder
|
||||
$Sys32Path = "$env:windir\system32"
|
||||
$DriverPath = "$env:windir\system32\drivers"
|
||||
|
||||
#generated by certutil -encode
|
||||
#generated by certutil -encode
|
||||
$SIPolicy_Encoded = "BQAAAA43RKLJRAZMtVH2AW5WMHbk9wcuTBkgTbfJb0SmxaI0BACNkAgAAAAAAAAA
|
||||
HQAAAAIAAAAAAAAAAAAKAEAAAAAMAAAAAQorBgEEAYI3CgMGDAAAAAEKKwYBBAGC
|
||||
NwoDBQwAAAABCisGAQQBgjc9BAEMAAAAAQorBgEEAYI3PQUBDAAAAAEKKwYBBAGC
|
||||
@ -114,7 +116,7 @@ function LogAndConsoleSuccess($message)
|
||||
|
||||
function LogAndConsoleError($message)
|
||||
{
|
||||
Write-Host $message -foregroundcolor "Red"
|
||||
Write-Host $message -foregroundcolor "Red"
|
||||
Log $message
|
||||
}
|
||||
|
||||
@ -132,16 +134,16 @@ function IsExempted([System.IO.FileInfo] $item)
|
||||
Log $cert.ToString()
|
||||
return 0
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function CheckExemption($_ModName)
|
||||
{
|
||||
$mod1 = Get-ChildItem $Sys32Path $_ModName
|
||||
$mod2 = Get-ChildItem $DriverPath $_ModName
|
||||
if($mod1)
|
||||
{
|
||||
{
|
||||
Log "NonDriver module" + $mod1.FullName
|
||||
return IsExempted($mod1)
|
||||
return IsExempted($mod1)
|
||||
}
|
||||
elseif($mod2)
|
||||
{
|
||||
@ -184,15 +186,15 @@ function CheckFailedDriver($_ModName, $CIStats)
|
||||
}
|
||||
if($Result.Contains("PASS"))
|
||||
{
|
||||
$CompatibleModules.AppendLine($_ModName.Trim()) | Out-Null
|
||||
$CompatibleModules.AppendLine($_ModName.Trim()) | Out-Null
|
||||
}
|
||||
elseif($FailingStat.Trim().Contains("execute-write"))
|
||||
{
|
||||
$FailingExecuteWriteCheck.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
$FailingExecuteWriteCheck.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
}
|
||||
else
|
||||
{
|
||||
$FailingModules.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
$FailingModules.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
}
|
||||
Log "Result: " $Result
|
||||
}
|
||||
@ -204,7 +206,7 @@ function ListCIStats($_ModName, $str1)
|
||||
{
|
||||
Log "String := " $str1
|
||||
Log "Warning! CI Stats are missing for " $_ModName
|
||||
return
|
||||
return
|
||||
}
|
||||
$temp_str1 = $str1.Substring($i1)
|
||||
$CIStats = $temp_str1.Substring(0).Trim()
|
||||
@ -245,7 +247,7 @@ function ListDrivers($str)
|
||||
}
|
||||
|
||||
$DriverScanCompletedMessage = "Completed scan. List of Compatible Modules can be found at " + $LogFile
|
||||
LogAndConsole $DriverScanCompletedMessage
|
||||
LogAndConsole $DriverScanCompletedMessage
|
||||
|
||||
if($FailingModules.Length -gt 0 -or $FailingExecuteWriteCheck.Length -gt 0 )
|
||||
{
|
||||
@ -254,7 +256,7 @@ function ListDrivers($str)
|
||||
{
|
||||
LogAndConsoleError $WarningMessage
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
LogAndConsoleWarning $WarningMessage
|
||||
}
|
||||
@ -321,7 +323,7 @@ function ListSummary()
|
||||
}
|
||||
else
|
||||
{
|
||||
LogAndConsoleSuccess "Machine is Device Guard / Credential Guard Ready.`n"
|
||||
LogAndConsoleSuccess "Machine is Device Guard / Credential Guard Ready.`n"
|
||||
if(!$HVCI -and !$DG)
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Capable" /t REG_DWORD /d 2 /f '
|
||||
@ -336,56 +338,56 @@ function ListSummary()
|
||||
|
||||
|
||||
function Instantiate-Kernel32 {
|
||||
try
|
||||
try
|
||||
{
|
||||
Add-Type -TypeDefinition @"
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
|
||||
public static class Kernel32
|
||||
{
|
||||
[DllImport("kernel32", SetLastError=true, CharSet = CharSet.Ansi)]
|
||||
public static extern IntPtr LoadLibrary(
|
||||
[MarshalAs(UnmanagedType.LPStr)]string lpFileName);
|
||||
|
||||
|
||||
[DllImport("kernel32", CharSet=CharSet.Ansi, ExactSpelling=true, SetLastError=true)]
|
||||
public static extern IntPtr GetProcAddress(
|
||||
IntPtr hModule,
|
||||
string procName);
|
||||
}
|
||||
|
||||
|
||||
"@
|
||||
}
|
||||
catch
|
||||
{
|
||||
Log $_.Exception.Message
|
||||
Log $_.Exception.Message
|
||||
LogAndConsole "Instantiate-Kernel32 failed"
|
||||
}
|
||||
}
|
||||
|
||||
function Instantiate-HSTI {
|
||||
try
|
||||
try
|
||||
{
|
||||
Add-Type -TypeDefinition @"
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Net;
|
||||
|
||||
|
||||
public static class HstiTest3
|
||||
{
|
||||
[DllImport("hstitest.dll", CharSet = CharSet.Unicode)]
|
||||
public static extern int QueryHSTIdetails(
|
||||
ref HstiOverallError pHstiOverallError,
|
||||
public static extern int QueryHSTIdetails(
|
||||
ref HstiOverallError pHstiOverallError,
|
||||
[In, Out] HstiProviderErrorDuple[] pHstiProviderErrors,
|
||||
ref uint pHstiProviderErrorsCount,
|
||||
byte[] hstiPlatformSecurityBlob,
|
||||
ref uint pHstiPlatformSecurityBlobBytes);
|
||||
|
||||
[DllImport("hstitest.dll", CharSet = CharSet.Unicode)]
|
||||
public static extern int QueryHSTI(ref bool Pass);
|
||||
|
||||
public static extern int QueryHSTI(ref bool Pass);
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
|
||||
public struct HstiProviderErrorDuple
|
||||
{
|
||||
@ -397,7 +399,7 @@ function Instantiate-HSTI {
|
||||
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 4096)]
|
||||
internal string ErrorString;
|
||||
}
|
||||
|
||||
|
||||
[FlagsAttribute]
|
||||
public enum HstiProviderErrors : int
|
||||
{
|
||||
@ -425,8 +427,8 @@ function Instantiate-HSTI {
|
||||
BlobVersionMismatch = 0x00000080,
|
||||
PlatformSecurityVersionMismatch = 0x00000100,
|
||||
ProviderError = 0x00000200
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
"@
|
||||
|
||||
@ -434,9 +436,9 @@ function Instantiate-HSTI {
|
||||
$FuncHandle = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTIdetails")
|
||||
$FuncHandle2 = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTI")
|
||||
|
||||
if ([System.IntPtr]::Size -eq 8)
|
||||
if ([System.IntPtr]::Size -eq 8)
|
||||
{
|
||||
#assuming 64 bit
|
||||
#assuming 64 bit
|
||||
Log "`nKernel32::LoadLibrary 64bit --> 0x$("{0:X16}" -f $LibHandle.ToInt64())"
|
||||
Log "HstiTest2::QueryHSTIdetails 64bit --> 0x$("{0:X16}" -f $FuncHandle.ToInt64())"
|
||||
}
|
||||
@ -450,7 +452,7 @@ function Instantiate-HSTI {
|
||||
$hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $null, [ref] $providerErrorDupleCount, $null, [ref] $blobByteSize)
|
||||
|
||||
[byte[]]$blob = New-Object byte[] $blobByteSize
|
||||
[HstiTest3+HstiProviderErrorDuple[]]$providerErrors = New-Object HstiTest3+HstiProviderErrorDuple[] $providerErrorDupleCount
|
||||
[HstiTest3+HstiProviderErrorDuple[]]$providerErrors = New-Object HstiTest3+HstiProviderErrorDuple[] $providerErrorDupleCount
|
||||
$hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $providerErrors, [ref] $providerErrorDupleCount, $blob, [ref] $blobByteSize)
|
||||
$string = $null
|
||||
$blob | foreach { $string = $string + $_.ToString("X2")+"," }
|
||||
@ -479,7 +481,7 @@ function Instantiate-HSTI {
|
||||
LogAndConsoleError $ErrorMessage
|
||||
$DGVerifyCrit.AppendLine($ErrorMessage) | Out-Null
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
LogAndConsoleWarning $ErrorMessage
|
||||
$DGVerifyWarn.AppendLine("HSTI is absent") | Out-Null
|
||||
@ -487,9 +489,9 @@ function Instantiate-HSTI {
|
||||
}
|
||||
|
||||
}
|
||||
catch
|
||||
catch
|
||||
{
|
||||
LogAndConsoleError $_.Exception.Message
|
||||
LogAndConsoleError $_.Exception.Message
|
||||
LogAndConsoleError "Instantiate-HSTI failed"
|
||||
}
|
||||
}
|
||||
@ -613,10 +615,10 @@ function ExecuteCommandAndLog($_cmd)
|
||||
$CmdOutput = Invoke-Expression $_cmd | Out-String
|
||||
Log "Output: $CmdOutput"
|
||||
}
|
||||
catch
|
||||
catch
|
||||
{
|
||||
Log "Exception while exectuing $_cmd"
|
||||
Log $_.Exception.Message
|
||||
Log $_.Exception.Message
|
||||
}
|
||||
|
||||
|
||||
@ -676,7 +678,7 @@ function CheckDriverCompat
|
||||
verifier.exe /flags 0x02000000 /all /log.code_integrity
|
||||
|
||||
LogAndConsole "Enabling Driver Verifier and Rebooting system"
|
||||
Log $verifier_state
|
||||
Log $verifier_state
|
||||
LogAndConsole "Please re-execute this script after reboot...."
|
||||
if($AutoReboot)
|
||||
{
|
||||
@ -692,7 +694,7 @@ function CheckDriverCompat
|
||||
else
|
||||
{
|
||||
LogAndConsole "Driver verifier already enabled"
|
||||
Log $verifier_state
|
||||
Log $verifier_state
|
||||
ListDrivers($verifier_state.Trim().ToLowerInvariant())
|
||||
}
|
||||
}
|
||||
@ -700,23 +702,23 @@ function IsDomainController
|
||||
{
|
||||
$_isDC = 0
|
||||
$CompConfig = Get-WmiObject Win32_ComputerSystem
|
||||
foreach ($ObjItem in $CompConfig)
|
||||
foreach ($ObjItem in $CompConfig)
|
||||
{
|
||||
$Role = $ObjItem.DomainRole
|
||||
Log "Role=$Role"
|
||||
Switch ($Role)
|
||||
Switch ($Role)
|
||||
{
|
||||
0 { Log "Standalone Workstation" }
|
||||
1 { Log "Member Workstation" }
|
||||
2 { Log "Standalone Server" }
|
||||
3 { Log "Member Server" }
|
||||
4
|
||||
4
|
||||
{
|
||||
Log "Backup Domain Controller"
|
||||
$_isDC=1
|
||||
break
|
||||
}
|
||||
5
|
||||
5
|
||||
{
|
||||
Log "Primary Domain Controller"
|
||||
$_isDC=1
|
||||
@ -735,7 +737,7 @@ function CheckOSSKU
|
||||
Log "OSNAME:$osname"
|
||||
$SKUarray = @("Enterprise", "Education", "IoT", "Windows Server", "Pro", "Home")
|
||||
$HLKAllowed = @("microsoft windows 10 pro")
|
||||
foreach ($SKUent in $SKUarray)
|
||||
foreach ($SKUent in $SKUarray)
|
||||
{
|
||||
if($osname.ToString().Contains($SKUent.ToLower()))
|
||||
{
|
||||
@ -762,7 +764,7 @@ function CheckOSSKU
|
||||
}
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "OSSKU" /t REG_DWORD /d 2 /f '
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
LogAndConsoleError "This PC edition is Unsupported for Device Guard"
|
||||
$DGVerifyCrit.AppendLine("OS SKU unsupported") | Out-Null
|
||||
@ -773,14 +775,14 @@ function CheckOSSKU
|
||||
function CheckOSArchitecture
|
||||
{
|
||||
$OSArch = $(gwmi win32_operatingsystem).OSArchitecture.ToLower()
|
||||
Log $OSArch
|
||||
if($OSArch.Contains("64-bit"))
|
||||
Log $OSArch
|
||||
if($OSArch -match ("^64\-?\s?bit"))
|
||||
{
|
||||
LogAndConsoleSuccess "64 bit archictecture"
|
||||
LogAndConsoleSuccess "64 bit architecture"
|
||||
}
|
||||
elseif($OSArch.Contains("32-bit"))
|
||||
elseif($OSArch -match ("^32\-?\s?bit"))
|
||||
{
|
||||
LogAndConsoleError "32 bit archictecture"
|
||||
LogAndConsoleError "32 bit architecture"
|
||||
$DGVerifyCrit.AppendLine("32 Bit OS, OS Architecture failure.") | Out-Null
|
||||
}
|
||||
else
|
||||
@ -878,7 +880,7 @@ function CheckTPM
|
||||
function CheckSecureMOR
|
||||
{
|
||||
$isSecureMOR = CheckDGFeatures(4)
|
||||
Log "isSecureMOR= $isSecureMOR "
|
||||
Log "isSecureMOR= $isSecureMOR "
|
||||
if($isSecureMOR -eq 1)
|
||||
{
|
||||
LogAndConsoleSuccess "Secure MOR is available"
|
||||
@ -904,7 +906,7 @@ function CheckSecureMOR
|
||||
function CheckNXProtection
|
||||
{
|
||||
$isNXProtected = CheckDGFeatures(5)
|
||||
Log "isNXProtected= $isNXProtected "
|
||||
Log "isNXProtected= $isNXProtected "
|
||||
if($isNXProtected -eq 1)
|
||||
{
|
||||
LogAndConsoleSuccess "NX Protector is available"
|
||||
@ -921,7 +923,7 @@ function CheckNXProtection
|
||||
function CheckSMMProtection
|
||||
{
|
||||
$isSMMMitigated = CheckDGFeatures(6)
|
||||
Log "isSMMMitigated= $isSMMMitigated "
|
||||
Log "isSMMMitigated= $isSMMMitigated "
|
||||
if($isSMMMitigated -eq 1)
|
||||
{
|
||||
LogAndConsoleSuccess "SMM Mitigation is available"
|
||||
@ -938,15 +940,15 @@ function CheckSMMProtection
|
||||
function CheckHSTI
|
||||
{
|
||||
LogAndConsole "Copying HSTITest.dll"
|
||||
try
|
||||
try
|
||||
{
|
||||
$HSTITest_Decoded = [System.Convert]::FromBase64String($HSTITest_Encoded)
|
||||
[System.IO.File]::WriteAllBytes("$env:windir\System32\hstitest.dll",$HSTITest_Decoded)
|
||||
|
||||
}
|
||||
catch
|
||||
catch
|
||||
{
|
||||
LogAndConsole $_.Exception.Message
|
||||
LogAndConsole $_.Exception.Message
|
||||
LogAndConsole "Copying and loading HSTITest.dll failed"
|
||||
}
|
||||
|
||||
@ -959,7 +961,7 @@ function PrintToolVersion
|
||||
LogAndConsole ""
|
||||
LogAndConsole "###########################################################################"
|
||||
LogAndConsole ""
|
||||
LogAndConsole "Readiness Tool Version 3.7.1 Release. `nTool to check if your device is capable to run Device Guard and Credential Guard."
|
||||
LogAndConsole "Readiness Tool Version 3.7.2 Release. `nTool to check if your device is capable to run Device Guard and Credential Guard."
|
||||
LogAndConsole ""
|
||||
LogAndConsole "###########################################################################"
|
||||
LogAndConsole ""
|
||||
@ -1030,7 +1032,7 @@ if(!($Ready) -and !($Capable) -and !($Enable) -and !($Disable) -and !($Clear) -a
|
||||
}
|
||||
|
||||
$user = [Security.Principal.WindowsIdentity]::GetCurrent();
|
||||
$TestForAdmin = (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
|
||||
$TestForAdmin = (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
|
||||
|
||||
if(!$TestForAdmin)
|
||||
{
|
||||
@ -1065,7 +1067,7 @@ if($Ready)
|
||||
{
|
||||
Log "_CGState: $_CGState"
|
||||
PrintCGDetails $_CGState
|
||||
|
||||
|
||||
if($_CGState)
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Running" /t REG_DWORD /d 1 /f'
|
||||
@ -1077,28 +1079,28 @@ if($Ready)
|
||||
}
|
||||
elseif($DG)
|
||||
{
|
||||
Log "_HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
Log "_HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
|
||||
PrintHVCIDetails $_HVCIState
|
||||
PrintConfigCIDetails $_ConfigCIState
|
||||
PrintConfigCIDetails $_ConfigCIState
|
||||
|
||||
if($_ConfigCIState -and $_HVCIState)
|
||||
{
|
||||
LogAndConsoleSuccess "HVCI, and Config-CI are enabled and running."
|
||||
|
||||
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 1 /f'
|
||||
}
|
||||
else
|
||||
{
|
||||
LogAndConsoleWarning "Not all services are running."
|
||||
|
||||
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 0 /f'
|
||||
}
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
Log "_CGState: $_CGState, _HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
|
||||
Log "_CGState: $_CGState, _HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
|
||||
PrintCGDetails $_CGState
|
||||
PrintHVCIDetails $_HVCIState
|
||||
PrintConfigCIDetails $_ConfigCIState
|
||||
@ -1147,7 +1149,7 @@ if($Enable)
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f'
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f'
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f'
|
||||
@ -1158,8 +1160,8 @@ if($Enable)
|
||||
{
|
||||
if(!$HVCI -and !$CG)
|
||||
{
|
||||
if(!$SIPolicyPath)
|
||||
{
|
||||
if(!$SIPolicyPath)
|
||||
{
|
||||
Log "Writing Decoded SIPolicy.p7b"
|
||||
$SIPolicy_Decoded = [System.Convert]::FromBase64String($SIPolicy_Encoded)
|
||||
[System.IO.File]::WriteAllBytes("$env:windir\System32\CodeIntegrity\SIPolicy.p7b",$SIPolicy_Decoded)
|
||||
@ -1182,7 +1184,7 @@ if($Enable)
|
||||
if(!$_isRedstone)
|
||||
{
|
||||
LogAndConsole "OS Not Redstone, enabling IsolatedUserMode separately"
|
||||
#Enable/Disable IOMMU seperately
|
||||
#Enable/Disable IOMMU separately
|
||||
ExecuteCommandAndLog 'DISM.EXE /Online /Enable-Feature:IsolatedUserMode /NoRestart'
|
||||
}
|
||||
$CmdOutput = DISM.EXE /Online /Enable-Feature:Microsoft-Hyper-V-Hypervisor /All /NoRestart | Out-String
|
||||
@ -1251,7 +1253,7 @@ if($Disable)
|
||||
if(!$_isRedstone)
|
||||
{
|
||||
LogAndConsole "OS Not Redstone, disabling IsolatedUserMode separately"
|
||||
#Enable/Disable IOMMU seperately
|
||||
#Enable/Disable IOMMU separately
|
||||
ExecuteCommandAndLog 'DISM.EXE /Online /disable-Feature /FeatureName:IsolatedUserMode /NoRestart'
|
||||
}
|
||||
$CmdOutput = DISM.EXE /Online /disable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /NoRestart | Out-String
|
||||
@ -1270,7 +1272,7 @@ if($Disable)
|
||||
}
|
||||
|
||||
#set of commands to run SecConfig.efi to delete UEFI variables if were set in pre OS
|
||||
#these steps can be performed even if the UEFI variables were not set - if not set it will lead to No-Op but this can be run in general always
|
||||
#these steps can be performed even if the UEFI variables were not set - if not set it will lead to No-Op but this can be run in general always
|
||||
#this requires a reboot and accepting the prompt in the Pre-OS which is self explanatory in the message that is displayed in pre-OS
|
||||
$FreeDrive = ls function:[s-z]: -n | ?{ !(test-path $_) } | random
|
||||
Log "FreeDrive=$FreeDrive"
|
||||
@ -1314,7 +1316,7 @@ if($Capable)
|
||||
}
|
||||
$_StepCount = 1
|
||||
if(!$CG)
|
||||
{
|
||||
{
|
||||
LogAndConsole " ====================== Step $_StepCount Driver Compat ====================== "
|
||||
$_StepCount++
|
||||
CheckDriverCompat
|
||||
@ -1323,15 +1325,15 @@ if($Capable)
|
||||
LogAndConsole " ====================== Step $_StepCount Secure boot present ====================== "
|
||||
$_StepCount++
|
||||
CheckSecureBootState
|
||||
|
||||
|
||||
if(!$HVCI -and !$DG -and !$CG)
|
||||
{
|
||||
{
|
||||
#check only if sub-options are absent
|
||||
LogAndConsole " ====================== Step $_StepCount MS UEFI HSTI tests ====================== "
|
||||
$_StepCount++
|
||||
CheckHSTI
|
||||
}
|
||||
|
||||
|
||||
LogAndConsole " ====================== Step $_StepCount OS Architecture ====================== "
|
||||
$_StepCount++
|
||||
CheckOSArchitecture
|
||||
@ -1345,11 +1347,11 @@ if($Capable)
|
||||
CheckVirtualization
|
||||
|
||||
if(!$HVCI -and !$DG)
|
||||
{
|
||||
{
|
||||
LogAndConsole " ====================== Step $_StepCount TPM version ====================== "
|
||||
$_StepCount++
|
||||
CheckTPM
|
||||
|
||||
|
||||
LogAndConsole " ====================== Step $_StepCount Secure MOR ====================== "
|
||||
$_StepCount++
|
||||
CheckSecureMOR
|
||||
@ -1358,11 +1360,11 @@ if($Capable)
|
||||
LogAndConsole " ====================== Step $_StepCount NX Protector ====================== "
|
||||
$_StepCount++
|
||||
CheckNXProtection
|
||||
|
||||
|
||||
LogAndConsole " ====================== Step $_StepCount SMM Mitigation ====================== "
|
||||
$_StepCount++
|
||||
CheckSMMProtection
|
||||
|
||||
|
||||
LogAndConsole " ====================== End Check ====================== "
|
||||
|
||||
LogAndConsole " ====================== Summary ====================== "
|
||||
@ -1371,7 +1373,6 @@ if($Capable)
|
||||
}
|
||||
|
||||
|
||||
|
||||
# SIG # Begin signature block
|
||||
## REPLACE
|
||||
# SIG # End signature block
|
||||
|
||||
@ -63,7 +63,7 @@ The Windows Hello for Business deployment depends on an enterprise public key in
|
||||
|
||||
Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object.
|
||||
|
||||
The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below.
|
||||
The minimum required Enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party Enterprise certification authority. The requirements for the domain controller certificate are shown below. For more details, see [Requirements for domain controller certificates from a third-party CA](https://support.microsoft.com/help/291010/requirements-for-domain-controller-certificates-from-a-third-party-ca).
|
||||
|
||||
* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL.
|
||||
* The certificate Subject section should contain the directory path of the server object (the distinguished name).
|
||||
@ -71,7 +71,7 @@ The minimum required enterprise certificate authority that can be used with Wind
|
||||
* Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None].
|
||||
* The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5).
|
||||
* The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name.
|
||||
* The certificate template must have an extension that has the BMP data value "DomainController".
|
||||
* The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](https://docs.microsoft.com/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template.
|
||||
* The domain controller certificate must be installed in the local computer's certificate store.
|
||||
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 06/27/2019
|
||||
ms.date: 05/29/2020
|
||||
---
|
||||
|
||||
# Domain member: Maximum machine account password age
|
||||
@ -42,8 +42,7 @@ For more information, see [Machine Account Password Process](https://techcommuni
|
||||
|
||||
### Best practices
|
||||
|
||||
1. We recommend that you set **Domain member: Maximum machine account password age** to about 30 days. Setting the value to fewer days can increase replication and affect domain controllers. For example, in Windows NT domains, machine passwords were changed every 7 days. The additional replication churn would affect domain controllers in large organizations that have many computers or slow links between sites.
|
||||
2. Some organizations pre-build computers and then store them for later use or ship them to remote locations. When a computer is turned on after being offline more than 30 days, the Netlogon service notices the password age and initiates a secure channel to a domain controller to change it. If the secure channel cannot be established, the computer does not authenticate with the domain. For this reason, some organizations might want to create a special organizational unit (OU) for computers that are prebuilt, and then configure the value for this policy setting to a greater number of days.
|
||||
We recommend that you set **Domain member: Maximum machine account password age** to about 30 days. Setting the value to fewer days can increase replication and affect domain controllers. For example, in Windows NT domains, machine passwords were changed every 7 days. The additional replication churn would affect domain controllers in large organizations that have many computers or slow links between sites.
|
||||
|
||||
### Location
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 05/14/2019
|
||||
ms.date: 05/29/2020
|
||||
---
|
||||
|
||||
# Manage Packaged Apps with Windows Defender Application Control
|
||||
@ -65,8 +65,10 @@ Below are the list of steps you can follow to block one or more packaged apps in
|
||||
1. Get the app identifier for an installed package
|
||||
|
||||
```powershell
|
||||
$package = Get-AppxPackage -name <example_app>
|
||||
$package = Get-AppxPackage -name *<example_app>*
|
||||
```
|
||||
Where the name of the app is surrounded by asterisks, for example *windowsstore*
|
||||
|
||||
2. Make a rule by using the New-CIPolicyRule cmdlet
|
||||
|
||||
```powershell
|
||||
@ -119,9 +121,9 @@ If the app you intend to block is not installed on the system you are using the
|
||||
|
||||
3. Copy the GUID in the URL for the app
|
||||
- Example: the GUID for the Microsoft To-Do app is 9nblggh5r558
|
||||
- https://www.microsoft.com/p/microsoft-to-do-list-task-reminder/9nblggh5r558?activetab=pivot:overviewtab
|
||||
- `https://www.microsoft.com/p/microsoft-to-do-list-task-reminder/9nblggh5r558?activetab=pivot:overviewtab`
|
||||
4. Use the GUID in the following REST query URL to retrieve the identifiers for the app
|
||||
- Example: for the Microsoft To-Do app, the URL would be https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblggh5r558/applockerdata
|
||||
- Example: for the Microsoft To-Do app, the URL would be `https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblggh5r558/applockerdata`
|
||||
- The URL will return:
|
||||
|
||||
```
|
||||
@ -141,4 +143,4 @@ The method for allowing specific packaged apps is similar to the method outlined
|
||||
$Rule = New-CIPolicyRule -Package $package -allow
|
||||
```
|
||||
|
||||
Since a lot of system apps are packaged apps, it is generally advised that customers rely on the sample policies in C:\Windows\schemas\CodeIntegrity\ExamplePolicies to help allow all inbox apps by the Store signature already included in the policies and control apps with deny rules.
|
||||
Since a lot of system apps are packaged apps, it is generally advised that customers rely on the sample policies in `C:\Windows\schemas\CodeIntegrity\ExamplePolicies` to help allow all inbox apps by the Store signature already included in the policies and control apps with deny rules.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user