mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-22 05:43:41 +00:00
Merge pull request #1986 from MicrosoftDocs/wdav-missed
New article about how to handle false postives/negatives in Windows Defender Antivirus
This commit is contained in:
Tina Burden
GitHub
@ -15,7 +15,7 @@ ms.date: 06/26/2017
|
||||
# Certificate authentication device enrollment
|
||||
|
||||
|
||||
This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
|
||||
> **Note** To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107).
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ This section provides an example of the mobile device enrollment protocol using
|
||||
|
||||
The <AuthenticationServiceURL> element the discovery response message specifies web authentication broker page start URL.
|
||||
|
||||
For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
|
||||
## In this topic
|
||||
|
||||
|
||||
@ -34,7 +34,7 @@ The enrollment process includes the following steps:
|
||||
## Enrollment protocol
|
||||
|
||||
|
||||
There are a number of changes made to the enrollment protocol to better support a variety of scenarios across all platforms. For detailed information about the mobile device enrollment protocol, see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
There are a number of changes made to the enrollment protocol to better support a variety of scenarios across all platforms. For detailed information about the mobile device enrollment protocol, see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
|
||||
The enrollment process involves the following steps:
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ ms.date: 06/26/2017
|
||||
|
||||
# On-premises authentication device enrollment
|
||||
|
||||
This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
|
||||
## In this topic
|
||||
|
||||
|
||||
@ -44,7 +44,7 @@
|
||||
#### [Attack surface reduction](microsoft-defender-atp/attack-surface-reduction.md)
|
||||
#### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md)
|
||||
|
||||
### [Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
|
||||
### [Next-generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
|
||||
#### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoft-antivirus.md)
|
||||
|
||||
### [Endpoint detection and response]()
|
||||
@ -187,7 +187,7 @@
|
||||
##### [Controlled folder access](microsoft-defender-atp/evaluate-controlled-folder-access.md)
|
||||
##### [Attack surface reduction](microsoft-defender-atp/evaluate-attack-surface-reduction.md)
|
||||
##### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md)
|
||||
##### [Evaluate next generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md)
|
||||
##### [Evaluate next-generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md)
|
||||
|
||||
### [Access the Windows Defender Security Center Community Center](microsoft-defender-atp/community.md)
|
||||
|
||||
@ -231,7 +231,7 @@
|
||||
|
||||
|
||||
|
||||
### [Configure next generation protection]()
|
||||
### [Configure next-generation protection]()
|
||||
#### [Configure Windows Defender Antivirus features](windows-defender-antivirus/configure-windows-defender-antivirus-features.md)
|
||||
|
||||
#### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md)
|
||||
@ -315,13 +315,14 @@
|
||||
##### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md)
|
||||
##### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md)
|
||||
|
||||
#### [Manage next generation protection in your business]()
|
||||
#### [Manage next-generation protection in your business]()
|
||||
##### [Handle false positives/negatives in Windows Defender Antivirus](windows-defender-antivirus/antivirus-false-positives-negatives.md)
|
||||
##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md)
|
||||
##### [Use Microsoft Intune and System Center Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md)
|
||||
##### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md)
|
||||
##### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md)
|
||||
##### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md)
|
||||
##### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md)
|
||||
##### [Use Group Policy settings to manage next-generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md)
|
||||
##### [Use PowerShell cmdlets to manage next-generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md)
|
||||
##### [Use Windows Management Instrumentation (WMI) to manage next-generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md)
|
||||
##### [Use the mpcmdrun.exe command line tool to manage next-generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md)
|
||||
|
||||
|
||||
### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md)
|
||||
@ -611,7 +612,7 @@
|
||||
#### [Network protection](microsoft-defender-atp/troubleshoot-np.md)
|
||||
#### [Attack surface reduction rules](microsoft-defender-atp/troubleshoot-asr.md)
|
||||
|
||||
### [Troubleshoot next generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md)
|
||||
### [Troubleshoot next-generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,75 @@
|
||||
---
|
||||
title: What to do with false positives/negatives in Windows Defender Antivirus
|
||||
description: Did Windows Defender Antivirus miss or wrongly detect something? Find out what you can do.
|
||||
keywords: Windows Defender Antivirus, false positives, false negatives, exclusions
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 02/05/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# What to do with false positives/negatives in Windows Defender Antivirus
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Windows Defender Antivirus is designed to keep your PC safe with built-in, trusted antivirus protection. With Windows Defender Antivirus, you get comprehensive, ongoing, and real-time protection against software threats like viruses, malware and spyware across email, apps, the cloud, and the web.
|
||||
|
||||
But what if something gets detected wrongly as malware, or something is missed? We call these false positives and false negatives. Fortunately, there are some steps you can take to deal with these things. You can:
|
||||
- [Submit a file to Microsoft for analysis](#submit-a-file-to-microsoft-for-analysis);
|
||||
- [Create an "Allow" indicator to prevent a false positive from recurring](#create-an-allow-indicator-to-prevent-a-false-positive-from-recurring); or
|
||||
- [Define an exclusion on an individual Windows device to prevent an item from being scanned](#define-an-exclusion-on-an-individual-windows-device-to-prevent-an-item-from-being-scanned) by Windows Defender Antivirus.
|
||||
|
||||
## Submit a file to Microsoft for analysis
|
||||
|
||||
1. Review the [submission guidelines](../intelligence/submission-guide.md).
|
||||
2. [Submit your file or sample](https://www.microsoft.com/wdsi/filesubmission).
|
||||
|
||||
> [!TIP]
|
||||
> We recommend signing in at the submission portal so you can track the results of your submissions.
|
||||
|
||||
## Create an "Allow" indicator to prevent a false positive from recurring
|
||||
|
||||
If a file, IP address, URL, or domain is treated as malware on a device, even though it's safe, you can create an "Allow" indicator. This indicator tells Windows Defender Antivirus (and Microsoft Defender Advanced Threat Protection) that the item is safe.
|
||||
|
||||
To set up your "Allow" indicator, follow the guidance in [Manage indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators).
|
||||
|
||||
## Define an exclusion on an individual Windows device to prevent an item from being scanned
|
||||
|
||||
When you define an exclusion for Windows Defender Antivirus, you configure your antivirus to skip that item.
|
||||
|
||||
1. On your Windows 10 device, open the Windows Security app.
|
||||
2. Select **Virus & threat protection** > **Virus & threat protection settings**.
|
||||
3. Under **Exclusions**, select **Add or remove exclusions**.
|
||||
4. Select **+ Add an exclusion**, and specify its type (**File**, **Folder**, **File type**, or **Process**).
|
||||
|
||||
The following table summarizes exclusion types, how they're defined, and what happens when they're in effect.
|
||||
|
||||
|Exclusion type |Defined by |What happens |
|
||||
|---------|---------|---------|
|
||||
|**File** |Location <br/>Example: `c:\sample\sample.test` |The specified file is skipped by Windows Defender Antivirus. |
|
||||
|**Folder** |Location <br/>Example: `c:\test\sample` |All items in the specified folder are skipped by Windows Defender Antivirus. |
|
||||
|**File type** |File extension <br/>Example: `.test` |All files with the specified extension anywhere on your device are skipped by Windows Defender Antivirus. |
|
||||
|**Process** |Executable file path <br>Example: `c:\test\process.exe` |The specified process and any files that are opened by that process are skipped by Windows Defender Antivirus. |
|
||||
|
||||
To learn more, see:
|
||||
- [Configure and validate exclusions based on file extension and folder location](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus)
|
||||
- [Configure exclusions for files opened by processes](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus)
|
||||
|
||||
## Related articles
|
||||
|
||||
[What is Microsoft Defender Advanced Threat Protection?](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection)
|
||||
|
||||
[Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection)
|
||||
@ -12,7 +12,7 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 09/03/2018
|
||||
ms.date: 02/05/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -23,21 +23,15 @@ manager: dansimp
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
You can exclude certain files, folders, processes, and process-opened files from Windows Defender Antivirus scans.
|
||||
|
||||
The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). Exclusions for process-opened files only apply to real-time protection.
|
||||
|
||||
Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization.
|
||||
|
||||
Windows Server 2016 also features automatic exclusions that are defined by the server roles you enable. See the [Windows Defender Antivirus exclusions on Windows Server 2016](configure-server-exclusions-windows-defender-antivirus.md) topic for more information and a list of the automatic exclusions.
|
||||
You can exclude certain files, folders, processes, and process-opened files from Windows Defender Antivirus scans. Such exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). Exclusions for process-opened files only apply to real-time protection.
|
||||
|
||||
>[!WARNING]
|
||||
>Defining exclusions lowers the protection offered by Windows Defender Antivirus. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious.
|
||||
|
||||
## In this section
|
||||
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md). This enables you to exclude files from Windows Defender Antivirus scans based on their file extension, file name, or location.
|
||||
|
||||
Topic | Description
|
||||
---|---
|
||||
[Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) | Exclude files from Windows Defender Antivirus scans based on their file extension, file name, or location
|
||||
[Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) | Exclude files from scans that have been opened by a specific process
|
||||
[Configure Windows Defender Antivirus exclusions on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) | Windows Server 2016 includes automatic exclusions, based on the defined server role. You can also add custom exclusions.
|
||||
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md). This enables you to exclude files from scans that have been opened by a specific process.
|
||||
|
||||
## Related articles
|
||||
|
||||
[Windows Defender Antivirus exclusions on Windows Server 2016](configure-server-exclusions-windows-defender-antivirus.md)
|
||||
@ -364,3 +364,4 @@ You can also copy the string into a blank text file and attempt to save it with
|
||||
- [Configure Windows Defender Antivirus exclusions on Windows Server](configure-server-exclusions-windows-defender-antivirus.md)
|
||||
- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
|
||||
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
|
||||
- [Handling false positives/negatives](antivirus-false-positives-negatives.md)
|
||||
|
||||
|
Before Width: | Height: | Size: 120 KiB After Width: | Height: | Size: 120 KiB |
@ -147,7 +147,7 @@ Tamper protection integrates with [Threat & Vulnerability Management](https://do
|
||||
|
||||
In the results, you can select **Turn on Tamper Protection** to learn more and turn it on.
|
||||
|
||||
|
||||
|
||||
|
||||
To learn more about Threat & Vulnerability Management, see [Threat & Vulnerability Management in Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights#threat--vulnerability-management-in-microsoft-defender-security-center).
|
||||
|
||||
|
||||
@ -27,18 +27,14 @@ In Windows 10, version 1703 and later, the Windows Defender app is part of the W
|
||||
Settings that were previously part of the Windows Defender client and main Windows Settings have been combined and moved to the new app, which is installed by default as part of Windows 10, version 1703.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date.
|
||||
|
||||
> [!WARNING]
|
||||
> If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device.
|
||||
> Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date.<br/>If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device.
|
||||
>It may also prevent Windows Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed.
|
||||
>This will significantly lower the protection of your device and could lead to malware infection.
|
||||
|
||||
|
||||
See the [Windows Security topic](/windows/threat-protection/windows-defender-security-center/windows-defender-security-center) for more information on other Windows security features that can be monitored in the app.
|
||||
See the [Windows Security article](/windows/threat-protection/windows-defender-security-center/windows-defender-security-center) for more information on other Windows security features that can be monitored in the app.
|
||||
|
||||
>[!NOTE]
|
||||
>The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal that is used to review and manage [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md).
|
||||
The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal that is used to review and manage [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md).
|
||||
|
||||
## Review virus and threat protection settings in the Windows Security app
|
||||
|
||||
@ -130,6 +126,19 @@ This section describes how to perform some of the most common tasks when reviewi
|
||||
5. Click the plus icon to choose the type and set the options for each exclusion.
|
||||
<a id="detection-history"></a>
|
||||
|
||||
The following table summarizes exclusion types and what happens:
|
||||
|
||||
|Exclusion type |Defined by |What happens |
|
||||
|---------|---------|---------|
|
||||
|**File** |Location <br/>Example: `c:\sample\sample.test` |The specific file is skipped by Windows Defender Antivirus. |
|
||||
|**Folder** |Location <br/>Example: `c:\test\sample` |All items in the specified folder are skipped by Windows Defender Antivirus. |
|
||||
|**File type** |File extension <br/>Example: `.test` |All files with the `.test` extension anywhere on your device are skipped by Windows Defender Antivirus. |
|
||||
|**Process** |Executable file path <br>Example: `c:\test\process.exe` |The specific process and any files that are opened by that process are skipped by Windows Defender Antivirus. |
|
||||
|
||||
To learn more, see:
|
||||
- [Configure and validate exclusions based on file extension and folder location](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus)
|
||||
- [Configure exclusions for files opened by processes](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus)
|
||||
|
||||
### Review threat detection history in the Windows Defender Security Center app
|
||||
|
||||
1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or
|
||||
|
||||
Reference in New Issue
Block a user