diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index d77896805e..c90eee3566 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -168,6 +168,7 @@ #### [AppRuntime](policy-csp-appruntime.md) #### [AppVirtualization](policy-csp-appvirtualization.md) #### [AttachmentManager](policy-csp-attachmentmanager.md) +#### [Audit](policy-csp-audit.md) #### [Authentication](policy-csp-authentication.md) #### [Autoplay](policy-csp-autoplay.md) #### [Bitlocker](policy-csp-bitlocker.md) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 0e6b603e24..9fca236820 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -56,6 +56,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [What is dmwappushsvc?](#what-is-dmwappushsvc) - **Change history in MDM documentation** + - [September 2019](#september-2019) - [August 2019](#august-2019) - [July 2019](#july-2019) - [June 2019](#june-2019) @@ -137,7 +138,11 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • WindowsLogon/AllowAutomaticRestartSignOn
  • WindowsLogon/ConfigAutomaticRestartSignOn
  • WindowsLogon/EnableFirstLogonAnimation
    • - + +Policy CSP - Audit +

    Added new Audit policies in Windows 10, version 1903.

    + + ApplicationControl CSP @@ -470,7 +475,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam
  • ShellLauncher
  • StatusConfiguration
    • -

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

    +

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    MultiSIM CSP @@ -830,7 +835,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam Messaging CSP -

    Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enteprise editions.

    +

    Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions.

    @@ -940,7 +945,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam
  • WirelessDisplay/AllowProjectionToPCOverInfrastructure
  • WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver

    • Removed TextInput/AllowLinguisticDataCollection

    -

    Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enteprise and IoT Enterprise

    +

    Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise

    Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.

    Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.

    Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.

    @@ -1529,7 +1534,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam -

    Management tool for the Micosoft Store for Business

    +

    Management tool for the Microsoft Store for Business

    New topics. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates.

    @@ -1899,6 +1904,12 @@ How do I turn if off? | The service can be stopped from the "Services" console o ## Change history in MDM documentation +### September 2019 + +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| + ### August 2019 |New or updated topic | Description| @@ -2189,8 +2200,8 @@ How do I turn if off? | The service can be stopped from the "Services" console o
  • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
  • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
  • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
    • -
  • System/AllowFontProviders is not supported in Windows Holographic for Business.
    • -
  • Security/RequireDeviceEncryption is suported in the Home SKU.
    • +
  • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
    • +
  • Security/RequireDeviceEncryption is supported in the Home SKU.
  • Start/StartLayout - added a table of SKU support information.
  • Start/ImportEdgeAssets - added a table of SKU support information.
    • @@ -2424,7 +2435,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o
  • ShellLauncher
  • StatusConfiguration
    • -

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

    +

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    MultiSIM CSP @@ -2739,7 +2750,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o

    For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

    -EntepriseAPN CSP +EnterpriseAPN CSP

    Added a SyncML example.

    diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 05ec05440b..61718b8d22 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -343,6 +343,188 @@ The following diagram shows the Policy configuration service provider in tree fo +### Audit policies + +
    +
    + Audit/AccountLogonLogoff_AuditAccountLockout +
    +
    + Audit/AccountLogonLogoff_AuditGroupMembership +
    +
    + Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
    +
    + Audit/AccountLogonLogoff_AuditIPsecMainMode +
    +
    + Audit/AccountLogonLogoff_AuditIPsecQuickMode +
    +
    + Audit/AccountLogonLogoff_AuditLogoff +
    +
    + Audit/AccountLogonLogoff_AuditLogon +
    +
    + Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
    +
    + Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
    +
    + Audit/AccountLogonLogoff_AuditSpecialLogon +
    +
    + Audit/AccountLogonLogoff_AuditUserDeviceClaims +
    +
    + Audit/AccountLogon_AuditCredentialValidation +
    +
    + Audit/AccountLogon_AuditKerberosAuthenticationService +
    +
    + Audit/AccountLogon_AuditKerberosServiceTicketOperations +
    +
    + Audit/AccountLogon_AuditOtherAccountLogonEvents +
    +
    + Audit/AccountManagement_AuditApplicationGroupManagement +
    +
    + Audit/AccountManagement_AuditComputerAccountManagement +
    +
    + Audit/AccountManagement_AuditDistributionGroupManagement +
    +
    + Audit/AccountManagement_AuditOtherAccountManagementEvents +
    +
    + Audit/AccountManagement_AuditSecurityGroupManagement +
    +
    + Audit/AccountManagement_AuditUserAccountManagement +
    +
    + Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
    +
    + Audit/DSAccess_AuditDirectoryServiceAccess +
    +
    + Audit/DSAccess_AuditDirectoryServiceChanges +
    +
    + Audit/DSAccess_AuditDirectoryServiceReplication +
    +
    + Audit/DetailedTracking_AuditDPAPIActivity +
    +
    + Audit/DetailedTracking_AuditPNPActivity +
    +
    + Audit/DetailedTracking_AuditProcessCreation +
    +
    + Audit/DetailedTracking_AuditProcessTermination +
    +
    + Audit/DetailedTracking_AuditRPCEvents +
    +
    + Audit/DetailedTracking_AuditTokenRightAdjusted +
    +
    + Audit/ObjectAccess_AuditApplicationGenerated +
    +
    + Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
    +
    + Audit/ObjectAccess_AuditCertificationServices +
    +
    + Audit/ObjectAccess_AuditDetailedFileShare +
    +
    + Audit/ObjectAccess_AuditFileShare +
    +
    + Audit/ObjectAccess_AuditFileSystem +
    +
    + Audit/ObjectAccess_AuditFilteringPlatformConnection +
    +
    + Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
    +
    + Audit/ObjectAccess_AuditHandleManipulation +
    +
    + Audit/ObjectAccess_AuditKernelObject +
    +
    + Audit/ObjectAccess_AuditOtherObjectAccessEvents +
    +
    + Audit/ObjectAccess_AuditRegistry +
    +
    + Audit/ObjectAccess_AuditRemovableStorage +
    +
    + Audit/ObjectAccess_AuditSAM +
    +
    + Audit/PolicyChange_AuditAuthenticationPolicyChange +
    +
    + Audit/PolicyChange_AuditAuthorizationPolicyChange +
    +
    + Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
    +
    + Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
    +
    + Audit/PolicyChange_AuditOtherPolicyChangeEvents +
    +
    + Audit/PolicyChange_AuditPolicyChange +
    +
    + Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
    +
    + Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
    +
    + Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
    +
    + Audit/System_AuditIPsecDriver +
    +
    + Audit/System_AuditOtherSystemEvents +
    +
    + Audit/System_AuditSecurityStateChange +
    +
    + Audit/System_AuditSecuritySystemExtension +
    +
    + Audit/System_AuditSystemIntegrity +
    +
    + ### Authentication policies
    @@ -1131,6 +1313,9 @@ The following diagram shows the Policy configuration service provider in tree fo ### Education policies
    +
    + Education/AllowGraphingCalculator +
    Education/DefaultPrinterName
    diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md new file mode 100644 index 0000000000..5d46a69134 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -0,0 +1,4334 @@ +--- +title: Policy CSP - Audit +description: Policy CSP - Audit +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/24/2019 +--- + +# Policy CSP - Audit + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## Audit policies + +
    +
    + Audit/AccountLogonLogoff_AuditAccountLockout +
    +
    + Audit/AccountLogonLogoff_AuditGroupMembership +
    +
    + Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
    +
    + Audit/AccountLogonLogoff_AuditIPsecMainMode +
    +
    + Audit/AccountLogonLogoff_AuditIPsecQuickMode +
    +
    + Audit/AccountLogonLogoff_AuditLogoff +
    +
    + Audit/AccountLogonLogoff_AuditLogon +
    +
    + Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
    +
    + Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
    +
    + Audit/AccountLogonLogoff_AuditSpecialLogon +
    +
    + Audit/AccountLogonLogoff_AuditUserDeviceClaims +
    +
    + Audit/AccountLogon_AuditCredentialValidation +
    +
    + Audit/AccountLogon_AuditKerberosAuthenticationService +
    +
    + Audit/AccountLogon_AuditKerberosServiceTicketOperations +
    +
    + Audit/AccountLogon_AuditOtherAccountLogonEvents +
    +
    + Audit/AccountManagement_AuditApplicationGroupManagement +
    +
    + Audit/AccountManagement_AuditComputerAccountManagement +
    +
    + Audit/AccountManagement_AuditDistributionGroupManagement +
    +
    + Audit/AccountManagement_AuditOtherAccountManagementEvents +
    +
    + Audit/AccountManagement_AuditSecurityGroupManagement +
    +
    + Audit/AccountManagement_AuditUserAccountManagement +
    +
    + Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
    +
    + Audit/DSAccess_AuditDirectoryServiceAccess +
    +
    + Audit/DSAccess_AuditDirectoryServiceChanges +
    +
    + Audit/DSAccess_AuditDirectoryServiceReplication +
    +
    + Audit/DetailedTracking_AuditDPAPIActivity +
    +
    + Audit/DetailedTracking_AuditPNPActivity +
    +
    + Audit/DetailedTracking_AuditProcessCreation +
    +
    + Audit/DetailedTracking_AuditProcessTermination +
    +
    + Audit/DetailedTracking_AuditRPCEvents +
    +
    + Audit/DetailedTracking_AuditTokenRightAdjusted +
    +
    + Audit/ObjectAccess_AuditApplicationGenerated +
    +
    + Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
    +
    + Audit/ObjectAccess_AuditCertificationServices +
    +
    + Audit/ObjectAccess_AuditDetailedFileShare +
    +
    + Audit/ObjectAccess_AuditFileShare +
    +
    + Audit/ObjectAccess_AuditFileSystem +
    +
    + Audit/ObjectAccess_AuditFilteringPlatformConnection +
    +
    + Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
    +
    + Audit/ObjectAccess_AuditHandleManipulation +
    +
    + Audit/ObjectAccess_AuditKernelObject +
    +
    + Audit/ObjectAccess_AuditOtherObjectAccessEvents +
    +
    + Audit/ObjectAccess_AuditRegistry +
    +
    + Audit/ObjectAccess_AuditRemovableStorage +
    +
    + Audit/ObjectAccess_AuditSAM +
    +
    + Audit/PolicyChange_AuditAuthenticationPolicyChange +
    +
    + Audit/PolicyChange_AuditAuthorizationPolicyChange +
    +
    + Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
    +
    + Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
    +
    + Audit/PolicyChange_AuditOtherPolicyChangeEvents +
    +
    + Audit/PolicyChange_AuditPolicyChange +
    +
    + Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
    +
    + Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
    +
    + Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
    +
    + Audit/System_AuditIPsecDriver +
    +
    + Audit/System_AuditOtherSystemEvents +
    +
    + Audit/System_AuditSecurityStateChange +
    +
    + Audit/System_AuditSecuritySystemExtension +
    +
    + Audit/System_AuditSystemIntegrity +
    +
    + + +
    + + +**Audit/AccountLogonLogoff_AuditAccountLockout** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + +Volume: Low. + + + +GP Info: +- GP English name: *Audit Account Lockout* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditGroupMembership** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit the group membership information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group membership information cannot fit in a single security audit event. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit Group Membership* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditIPsecExtendedMode** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + +Volume: High. + + + +GP Info: +- GP English name: *Audit IPsec Extended Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditIPsecMainMode** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + +Volume: High. + + +GP Info: +- GP English name: *Audit IPsec Main Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditIPsecQuickMode** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + +Volume: High. + + +GP Info: +- GP English name: *Audit IPsec Quick Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditLogoff** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Logoff* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditLogon** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +The following events are included: +- Successful logon attempts. +- Failed logon attempts. +- Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. +- Security identifiers (SIDs) were filtered and not allowed to log on. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditNetworkPolicyServer** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + +Volume: Medium or High on NPS and IAS server. No volume on other computers. + + +GP Info: +- GP English name: *Audit Network Policy Server* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: +- Terminal Services session disconnections. +- New Terminal Services sessions. +- Locking and unlocking a workstation. +- Invoking a screen saver. +- Dismissal of a screen saver. +- Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. +- Access to a wireless network granted to a user or computer account. +- Access to a wired 802.1x network granted to a user or computer account. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Logon Logoff Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditSpecialLogon** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by special logons, such as the following: +- The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. +- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [Audit Special Logon](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-special-logon). + +Volume: Low. + + +GP Info: +- GP English name: *Audit Special Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditUserDeviceClaims** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit User Device Claims* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogon_AuditCredentialValidation** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + +Volume: High on domain controllers. + + +GP Info: +- GP English name: *Audit Credential Validation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogon_AuditKerberosAuthenticationService** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + +Volume: High on Kerberos Key Distribution Center servers. + + +GP Info: +- GP English name: *Audit Kerberos Authentication Service* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogon_AuditKerberosServiceTicketOperations** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Kerberos Service Ticket Operations* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogon_AuditOtherAccountLogonEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + +GP Info: +- GP English name: *Audit Other Account Logon Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditApplicationGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to application groups, such as the following: +- Application group is created, changed, or deleted. +- Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Application Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditComputerAccountManagement** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Computer Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditDistributionGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to distribution groups, such as the following: +- Distribution group is created, changed, or deleted. +- Member is added or removed from a distribution group. +- Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +> [!Note] +> Events in this subcategory are logged only on domain controllers. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Distribution Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditOtherAccountManagementEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: +- The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. +- The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. +- Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy. + +> [!Note] +> The security audit event is logged when the policy setting is applied. It does not occur at the time when the settings are modified. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Account Management Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditSecurityGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to security groups, such as the following: +- Security group is created, changed, or deleted. +- Member is added or removed from a security group. +- Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Security Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditUserAccountManagement** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes to user accounts. +Events include the following: +- A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. +- A user account’s password is set or changed. +- A security identifier (SID) is added to the SID History of a user account. +- The Directory Services Restore Mode password is configured. +- Permissions on administrative user accounts are changed. +- Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a user account changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit User Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/DSAccess_AuditDetailedDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + +Volume: High. + + + +GP Info: +- GP English name: *Audit Detailed Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/DSAccess_AuditDirectoryServiceAccess** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + +Volume: High on domain controllers. None on client computers. + + +GP Info: +- GP English name: *Audit Directory Service Access* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/DSAccess_AuditDirectoryServiceChanges** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +> [!Note] +> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + +Volume: High on domain controllers only. + + +GP Info: +- GP English name: *Audit Directory Service Changes* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/DSAccess_AuditDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + +>[!Note] +> Events in this subcategory are logged only on domain controllers. + +Volume: Medium on domain controllers. None on client computers. + + +GP Info: +- GP English name: *Audit Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditDPAPIActivity** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + +Volume: Low. + + +GP Info: +- GP English name: *Audit DPAPI Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditPNPActivity** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + +Volume: Low. + + +GP Info: +- GP English name: *Audit PNP Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditProcessCreation** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + +Volume: Depends on how the computer is used. + + +GP Info: +- GP English name: *Audit Process Creation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditProcessTermination** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + +Volume: Depends on how the computer is used. + + +GP Info: +- GP English name: *Audit Process Termination* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditRPCEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + +Volume: High on RPC servers. + + +GP Info: +- GP English name: *Audit RPC Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditTokenRightAdjusted** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by adjusting the privileges of a token. + +Volume: High. + + +GP Info: +- GP English name: *Audit Token Right Adjusted* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditApplicationGenerated** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: +- Creation of an application client context. +- Deletion of an application client context. +- Initialization of an application client context. +- Other application operations using the Windows Auditing APIs. + +Volume: Depends on the applications that are generating them. + + +GP Info: +- GP English name: *Audit Application Generated* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditCentralAccessPolicyStaging** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1. Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2. Failure audits when configured records access attempts when: + - The current central access policy does not grant access but the proposed policy grants access. + - A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + +GP Info: +- GP English name: *Audit Central Access Policy Staging* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditCertificationServices** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + +- AD CS startup/shutdown/backup/restore. +- Changes to the certificate revocation list (CRL). +- New certificate requests. +- Issuing of a certificate. +- Revocation of a certificate. +- Changes to the Certificate Manager settings for AD CS. +- Changes in the configuration of AD CS. +- Changes to a Certificate Services template. +- Importing of a certificate. +- Publishing of a certification authority certificate is to Active Directory Domain Services. +- Changes to the security permissions for AD CS. +- Archival of a key. +- Importing of a key. +- Retrieval of a key. +- Starting of Online Certificate Status Protocol (OCSP) Responder Service. +- Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + +Volume: Medium or Low on computers running Active Directory Certificate Services. + + +GP Info: +- GP English name: *Audit Certification Services* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditDetailedFileShare** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. + + +GP Info: +- GP English name: *Audit Detailed File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditFileShare** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. + + +GP Info: +- GP English name: *Audit File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditFileSystem** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +> [!Note] +> You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + +Volume: Depends on how the file system SACLs are configured. + + +GP Info: +- GP English name: *Audit File System* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditFilteringPlatformConnection** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). +The following events are included: +- The Windows Firewall Service blocks an application from accepting incoming connections on the network. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits a bind to a local port. +- The WFP blocks a bind to a local port. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits an application or service to listen on a port for incoming connections. +- The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. + +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + +Volume: High. + + +GP Info: +- GP English name: *Audit Filtering Platform Connection* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditFilteringPlatformPacketDrop** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + +Volume: High. + + + +GP Info: +- GP English name: *Audit Filtering Platform Packet Drop* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditHandleManipulation** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +> [!Note] +> Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + +Volume: Depends on how SACLs are configured. + + +GP Info: +- GP English name: *Audit Handle Manipulation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditKernelObject** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access the kernel, which includes mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +> [!Note] +> The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + +Volume: High if auditing access of global system objects is enabled. + + +GP Info: +- GP English name: *Audit Kernel Object* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditOtherObjectAccessEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: +- Job created. +- Job deleted. +- Job enabled. +- Job disabled. +- Job updated. + +For COM+ objects, the following are audited: +- Catalog object added. +- Catalog object updated. +- Catalog object deleted. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Object Access Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditRegistry** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +> [!Note] +> You can set a SACL on a registry object using the Permissions dialog box. + +Volume: Depends on how registry SACLs are configured. + + +GP Info: +- GP English name: *Audit Registry* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditRemovableStorage** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + +GP Info: +- GP English name: *Audit Removable Storage* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditSAM** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: +- SAM_ALIAS -- A local group. +- SAM_GROUP -- A group that is not a local group. +- SAM_USER – A user account. +- SAM_DOMAIN – A domain. +- SAM_SERVER – A computer account. + +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. + +> [!Note] +> Only the System Access Control List (SACL) for SAM_SERVER can be modified. + +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121698). + + + +GP Info: +- GP English name: *Audit SAM* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditAuthenticationPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: +- Creation of forest and domain trusts. +- Modification of forest and domain trusts. +- Removal of forest and domain trusts. +- Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. +- Granting of any of the following user rights to a user or group: + - Access This Computer From the Network. + - Allow Logon Locally. + - Allow Logon Through Terminal Services. + - Logon as a Batch Job. + - Logon a Service. +- Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +> [!Note] +> The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Authentication Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditAuthorizationPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: +- Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Changes in the Encrypted File System (EFS) policy. +- Changes to the Resource attributes of an object. +- Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Authorization Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditFilteringPlatformPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: +- IPsec services status. +- Changes to IPsec policy settings. +- Changes to Windows Firewall policy settings. +- Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Filtering Platform Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. +Events include the following: +- Reporting of active policies when Windows Firewall service starts. +- Changes to Windows Firewall rules. +- Changes to Windows Firewall exception list. +- Changes to Windows Firewall settings. +- Rules ignored or not applied by Windows Firewall Service. +- Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + +Volume: Low. + + +GP Info: +- GP English name: *Audit MPSSVC Rule Level Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditOtherPolicyChangeEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: +- Trusted Platform Module (TPM) configuration changes. +- Kernel-mode cryptographic self tests. +- Cryptographic provider operations. +- Cryptographic context operations or modifications. +- Applied Central Access Policies (CAPs) changes. +- Boot Configuration Data (BCD) modifications. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Policy Change Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes in the security audit policy settings, such as the following: +- Settings permissions and audit settings on the Audit Policy object. +- Changes to the system audit policy. +- Registration of security event sources. +- De-registration of security event sources. +- Changes to the per-user audit settings. +- Changes to the value of CrashOnAuditFail. +- Changes to the system access control list on a file system or registry object. +- Changes to the Special Groups list. + +> [!Note] +> System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: +- Access Credential Manager as a trusted caller. +- Access this computer from the network. +- Add workstations to domain. +- Adjust memory quotas for a process. +- Allow log on locally. +- Allow log on through Terminal Services. +- Bypass traverse checking. +- Change the system time. +- Create a pagefile. +- Create global objects. +- Create permanent shared objects. +- Create symbolic links. +- Deny access this computer from the network. +- Deny log on as a batch job. +- Deny log on as a service. +- Deny log on locally. +- Deny log on through Terminal Services. +- Force shutdown from a remote system. +- Increase a process working set. +- Increase scheduling priority. +- Lock pages in memory. +- Log on as a batch job. +- Log on as a service. +- Modify an object label. +- Perform volume maintenance tasks. +- Profile single process. +- Profile system performance. +- Remove computer from docking station. +- Shut down the system. +- Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + +Volume: Very High. + + +GP Info: +- GP English name: *Audit Non Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Not used. + + + +GP Info: +- GP English name: *Audit Other Privilege Use Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/PrivilegeUse_AuditSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: +- A privileged service is called. +- One of the following privileges are called: + - Act as part of the operating system. + - Back up files and directories. + - Create a token object. + - Debug programs. + - Enable computer and user accounts to be trusted for delegation. + - Generate security audits. + - Impersonate a client after authentication. + - Load and unload device drivers. + - Manage auditing and security log. + - Modify firmware environment values. + - Replace a process-level token. + - Restore files and directories. + - Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + +Volume: High. + + +GP Info: +- GP English name: *Audit Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/System_AuditIPsecDriver** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: +- Startup and shutdown of the IPsec services. +- Network packets dropped due to integrity check failure. +- Network packets dropped due to replay check failure. +- Network packets dropped due to being in plaintext. +- Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. +- Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + +Volume: Low. + + +GP Info: +- GP English name: *Audit IPsec Driver* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/System_AuditOtherSystemEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit any of the following events: +- Startup and shutdown of the Windows Firewall service and driver. +- Security policy processing by the Windows Firewall Service. +- Cryptography key file and migration operations. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other System Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + + +
    + + +**Audit/System_AuditSecurityStateChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: +- Startup and shutdown of the computer. +- Change of system time. +- Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Security State Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/System_AuditSecuritySystemExtension** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events related to security system extensions or services, such as the following: +- A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. +- A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. + +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + +Volume: Low. Security system extension events are generated more often on a domain controller than on client computers or member servers. + + +GP Info: +- GP English name: *Audit Security System Extension* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/System_AuditSystemIntegrity** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: +- Events that could not be written to the event log because of a problem with the auditing system. +- A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. +- The detection of a Remote Procedure Call (RPC) that compromises system integrity. +- The detection of a hash value of an executable file that is not valid as determined by Code Integrity. +- Cryptographic operations that compromise system integrity. + +Volume: Low. + + +GP Info: +- GP English name: *Audit System Integrity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + +
    + +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + + diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 3d598448d3..e88ef95636 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -6,17 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/26/2019 +ms.date: 09/24/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Defender -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -
    @@ -2335,17 +2331,17 @@ ADMX Info: -The following list shows the supported values: +The following list shows the supported values: -- 0 (default) – Every day -- 1 – Monday -- 2 – Tuesday -- 3 – Wednesday -- 4 – Thursday -- 5 – Friday -- 6 – Saturday -- 7 – Sunday -- 8 – No scheduled scan +- 0 (default) – Every day +- 1 – Sunday +- 2 – Monday +- 3 – Tuesday +- 4 – Wednesday +- 5 – Thursday +- 6 – Friday +- 7 – Saturday +- 8 – No scheduled scan diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 56e547eb48..40a7ae35c2 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -6,14 +6,15 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.date: 09/23/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Education - +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
    @@ -21,6 +22,9 @@ manager: dansimp ## Education policies
    +
    + Education/AllowGraphingCalculator +
    Education/DefaultPrinterName
    @@ -32,6 +36,60 @@ manager: dansimp
    +
    + + +**Education/AllowGraphingCalculator** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check markcheck markcheck markcheck markcheck markcross markcross mark
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Added in next major release of Windows 10. This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, you will be able to access graphing functionality. + + +ADMX Info: +- GP English name: *Allow Graphing Calculator* +- GP name: *AllowGraphingCalculator* +- GP path: *Windows Components/Calculator* +- GP ADMX file name: *Programs.admx* + + + +The following list shows the supported values: +- 0 - Disabled +- 1 (default) - Enabled + +
    @@ -176,7 +234,7 @@ The following list shows the supported values: Added in Windows 10, version 1709. Allows IT Admins to automatically provision printers based on their names (network host names). -The policy value is expected to be a `````` seperated list of printer names. The OS will attempt to search and install the matching printer driver for each listed printer. +The policy value is expected to be a `````` separated list of printer names. The OS will attempt to search and install the matching printer driver for each listed printer. @@ -190,6 +248,7 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. +- 7 - Added in next major release of Windows 10. diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 351f5e5e34..347736e526 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -15,7 +15,7 @@ manager: dansimp -These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user’s browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_). +These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user's browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_).
    @@ -224,7 +224,7 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to -Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk broswser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. +Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk browser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index b775445fbd..960dbecada 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -65,7 +65,7 @@ manager: dansimp -Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. +Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. The easiest way to verify the policy is to restart the explorer process or to reboot after the policy is applied. And then try to swipe from the right edge of the screen. The desired result is for Action Center to not be invoked by the swipe. You can also enter tablet mode and attempt to swipe from the top of the screen to rearrange. That will also be disabled. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index d2d5b890fa..c4c5c90156 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -922,11 +922,11 @@ Value type is integer. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_Enum -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -989,11 +989,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -1040,7 +1040,7 @@ ADMX Info: -Added in Windows 10, version 1903. +Added in Windows 10, version 1903. > [!NOTE] > Currently, this policy is supported only in HoloLens 2. @@ -1051,11 +1051,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -1116,11 +1116,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index 15a529a427..43f3e09bab 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -97,9 +97,6 @@ Supported values: - - -
    Footnotes: @@ -109,4 +106,6 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 6 - Added in Windows 10, version 1903. + + diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index bd12c8d9b7..5450d8dc1a 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -668,13 +668,7 @@ The following list shows the supported values: Enabling this policy prevents context menus from being invoked in the Start Menu. - -The following list shows the supported values: -- 0 (default) – False (Do not disable). -- 1 - True (disable). - - ADMX Info: - GP English name: *Disable context menus in the Start Menu* @@ -684,6 +678,10 @@ ADMX Info: +The following list shows the supported values: + +- 0 (default) – False (Do not disable). +- 1 - True (disable). @@ -1100,13 +1098,7 @@ Added in Windows 10, version 1709. Enabling this policy removes the people icon Value type is integer. - -The following list shows the supported values: -- 0 (default) – False (do not hide). -- 1 - True (hide). - - ADMX Info: - GP English name: *Remove the People Bar from the taskbar* @@ -1115,6 +1107,13 @@ ADMX Info: - GP ADMX file name: *StartMenu.admx* + +The following list shows the supported values: + +- 0 (default) – False (do not hide). +- 1 - True (hide). + +
    diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index eade9cb700..233d029683 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -395,7 +395,7 @@ The following list shows the supported values: - 0 – Disabled. - 1 (default) – Permits Microsoft to configure device settings only. -- 2 – Allows Microsoft to conduct full experimentations. +- 2 – Allows Microsoft to conduct full experimentation. @@ -532,9 +532,9 @@ ADMX Info: The following list shows the supported values: -- 0 – Force Location Off. All Location Privacy settings are toggled off and greyed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. +- 0 – Force Location Off. All Location Privacy settings are toggled off and grayed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. - 1 (default) – Location service is allowed. The user has control and can change Location Privacy settings on or off. -- 2 – Force Location On. All Location Privacy settings are toggled on and greyed out. Users cannot change the settings and all consent permissions will be automatically suppressed. +- 2 – Force Location On. All Location Privacy settings are toggled on and grayed out. Users cannot change the settings and all consent permissions will be automatically suppressed. @@ -763,16 +763,14 @@ Specifies whether to allow the user to factory reset the device by using control Most restricted value is 0. - > [!TIP] > This policy is also applicable to Windows 10 and not exclusive to phone. -> -> The following list shows the supported values: -> orted values: + + +The following list shows the supported values: - 0 – Not allowed. - 1 (default) – Allowed to reset to factory default settings. - @@ -1006,10 +1004,10 @@ This policy setting determines whether people can change their own telemetry lev If you set this policy setting to "Disable Telemetry opt-in Settings", telemetry levels are disabled in Settings, preventing people from changing them. -If you set this policy setting to "Enable Telemetry opt-in Setings" or don't configure this policy setting, people can change their own telemetry levels in Settings. +If you set this policy setting to "Enable Telemetry opt-in Settings" or don't configure this policy setting, people can change their own telemetry levels in Settings. -Note: -Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. +> [!Note] +> Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index 082308817e..6b1d56a0b6 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -113,10 +113,11 @@ By default, this policy is not configured and the SKU based defaults are used fo -ADMX Info:
    - GP English name: Troubleshooting: Allow users to access recommended troubleshooting for known problems -- GP name: TroubleshootingAllowRecommendations -- GP path: Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool -- GP ADMX file name: MSDT.admx +ADMX Info: +- GP English name: *Troubleshooting: Allow users to access recommended troubleshooting for known problems* +- GP name: *TroubleshootingAllowRecommendations* +- GP path: *Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* @@ -127,8 +128,6 @@ ADMX Info:
    - GP English name: Troubleshooting: Allow users to access r - -
    Footnotes: @@ -138,4 +137,5 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 6 - Added in Windows 10, version 1903. + diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 86359678c2..c29f9811ad 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -13,6 +13,8 @@ manager: dansimp # Policy CSP - Update +> [!NOTE] +> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
    @@ -204,11 +206,6 @@ manager: dansimp
    -> [!NOTE] -> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). - -
    - **Update/ActiveHoursEnd** @@ -1379,49 +1376,6 @@ Added in Windows 10, version 1803. Enable IT admin to configure feature update u
    - -**Update/ConfigureFeatureUpdateUninstallPeriod** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1803. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days. - - - - -
    - **Update/DeferFeatureUpdatesPeriodInDays** diff --git a/windows/deployment/windows-autopilot/user-driven.md b/windows/deployment/windows-autopilot/user-driven.md index 7629dc2ba8..ae6ae398bc 100644 --- a/windows/deployment/windows-autopilot/user-driven.md +++ b/windows/deployment/windows-autopilot/user-driven.md @@ -1,99 +1,103 @@ ---- -title: Windows Autopilot User-Driven Mode -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot user-driven mode - -Windows Autopilot user-driven mode is designed to enable new Windows 10 devices to be transformed from their initial state, directly from the factory, into a ready-to-use state without requiring that IT personnel ever touch the device. The process is designed to be simple so that anyone can complete it, enabling devices to be shipped or distributed to the end user directly with simple instructions: - -- Unbox the device, plug it in, and turn it on. -- Choose a language, locale and keyboard. -- Connect it to a wireless or wired network with internet access. -- Specify your e-mail address and password for your organization account. - -After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization. Any additional prompts during the Out-of-Box Experience (OOBE) can be supressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available. - -Today, Windows Autopilot user-driven mode supports joining devices to Azure Active Directory. Support for Hybrid Azure Active Directory Join (with devices joined to an on-premises Active Directory domain) will be available in a future Windows 10 release. See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options. - -## Available user-driven modes - -The following options are available for user-driven deployment: - -- [Azure Active Directory join](#user-driven-mode-for-azure-active-directory-join) is available if devices do not need to be joined to an on-prem Active Directory domain. -- [Hybrid Azure Active Directory join](#user-driven-mode-for-hybrid-azure-active-directory-join) is available for devices that must be joined to both Azure Active Directory and your on-prem Active Directory domain. - -### User-driven mode for Azure Active Directory join - -In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed: - -- Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory. See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information. -- Create an Autopilot profile for user-driven mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected. -- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. - -For each device that will be deployed using user-driven deployment, these additional steps are needed: - -- Ensure that the device has been added to Windows Autopilot. This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later. See [Adding devices to Windows Autopilot](add-devices.md) for more information. -- Ensure an Autopilot profile has been assigned to the device: - - If using Intune and Azure Active Directory dynamic device groups, this can be done automatically. - - If using Intune and Azure Active Directory static device groups, manually add the device to the device group. - - If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device. - -Also see the [Validation](#validation) section below. - -### User-driven mode for hybrid Azure Active Directory join - -Windows Autopilot requires that devices be Azure Active Directory joined. If you have an on-premises Active Directory environment and want to also join devices to your on-premises domain, you can accomplish this by configuring Autopilot devices to be [hybrid Azure Active Directory (AAD) joined](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan). - -#### Requirements - -To perform a user-driven hybrid AAD joined deployment using Windows Autopilot: - -- A Windows Autopilot profile for user-driven mode must be created and - - **Hybrid Azure AD joined** must be specified as the selected option under **Join to Azure AD as** in the Autopilot profile. -- If using Intune, a device group in Azure Active Directory must exist with the Windows Autopilot profile assigned to that group. -- The device must be running Windows 10, version 1809 or later. -- The device must be able to access an Active Directory domain controller, so it must be connected to the organization's network (where it can resolve the DNS records for the AD domain and the AD domain controller, and communicate with the domain controller to authenticate the user). -- The device must be able to access the Internet, following the [documented Windows Autopilot network requirements](windows-autopilot-requirements.md). -- The Intune Connector for Active Directory must be installed. - - Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf. -- If using Proxy, WPAD Proxy settings option must be enabled and configured. - -**AAD device join**: The hybrid AAD join process uses the system context to perform device AAD join, therefore it is not affected by user based AAD join permission settings. In addition, all users are enabled to join devices to AAD by default. - -#### Step by step instructions - -See [Deploy hybrid Azure AD joined devices using Intune and Windows Autopilot](https://docs.microsoft.com/intune/windows-autopilot-hybrid). - -Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic. - -## Validation - -When performing a user-driven deployment using Windows Autopilot, the following end-user experience should be observed: - -- If multiple languages are preinstalled in Windows 10, the user must pick a language. -- The user must pick a locale and a keyboard layout, and optionally a second keyboard layout. -- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network. -- Once connected to a network, the Autopilot profile will be downloaded. -- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required). -- The user will be prompted for Azure Active Directory credentials, with a customized user experience showing the Azure AD tenant name, logo, and sign-in text. -- Once correct credentials have been entered, the device will join Azure Active Directory. -- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services). -- If configured, the [enrollment status page](enrollment-status.md) will be displayed. -- Once the device configuration tasks have completed, the user will be signed into Windows 10 using the credentials they previously provided. -- Once signed in, the enrollment status page will again be displayed for user-targeted configuration tasks. - -In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation. +--- +title: Windows Autopilot User-Driven Mode +description: Windows Autopilot deployment +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.reviewer: mniehaus +manager: laurawi +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot user-driven mode + +Windows Autopilot user-driven mode is designed to enable new Windows 10 devices to be transformed from their initial state, directly from the factory, into a ready-to-use state without requiring that IT personnel ever touch the device. The process is designed to be simple so that anyone can complete it, enabling devices to be shipped or distributed to the end user directly with simple instructions: + +- Unbox the device, plug it in, and turn it on. +- Choose a language, locale and keyboard. +- Connect it to a wireless or wired network with internet access. +- Specify your e-mail address and password for your organization account. + +After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization. Any additional prompts during the Out-of-Box Experience (OOBE) can be suppressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available. + +Today, Windows Autopilot user-driven mode supports joining devices to Azure Active Directory. Support for Hybrid Azure Active Directory Join (with devices joined to an on-premises Active Directory domain) will be available in a future Windows 10 release. See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options. + +## Available user-driven modes + +The following options are available for user-driven deployment: + +- [Azure Active Directory join](#user-driven-mode-for-azure-active-directory-join) is available if devices do not need to be joined to an on-prem Active Directory domain. +- [Hybrid Azure Active Directory join](#user-driven-mode-for-hybrid-azure-active-directory-join) is available for devices that must be joined to both Azure Active Directory and your on-prem Active Directory domain. + +### User-driven mode for Azure Active Directory join + +In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed: + +- Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory. See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information. +- Create an Autopilot profile for user-driven mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected. +- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. + +For each device that will be deployed using user-driven deployment, these additional steps are needed: + +- Ensure that the device has been added to Windows Autopilot. This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later. See [Adding devices to Windows Autopilot](add-devices.md) for more information. +- Ensure an Autopilot profile has been assigned to the device: + - If using Intune and Azure Active Directory dynamic device groups, this can be done automatically. + - If using Intune and Azure Active Directory static device groups, manually add the device to the device group. + - If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device. + +Also see the [Validation](#validation) section below. + +>[!NOTE] +>If the device reboots during the device enrollment status page (ESP) in the user-driven Azure Active Directoy join scenario, the user will not automatically sign on because the user's credentials cannot be saved across reboots. In this scenario, the user will need to sign in manually after the device ESP completes. + +### User-driven mode for hybrid Azure Active Directory join + +Windows Autopilot requires that devices be Azure Active Directory joined. If you have an on-premises Active Directory environment and want to also join devices to your on-premises domain, you can accomplish this by configuring Autopilot devices to be [hybrid Azure Active Directory (AAD) joined](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan). + +#### Requirements + +To perform a user-driven hybrid AAD joined deployment using Windows Autopilot: + +- A Windows Autopilot profile for user-driven mode must be created and + - **Hybrid Azure AD joined** must be specified as the selected option under **Join to Azure AD as** in the Autopilot profile. +- If using Intune, a device group in Azure Active Directory must exist with the Windows Autopilot profile assigned to that group. +- The device must be running Windows 10, version 1809 or later. +- The device must be able to access an Active Directory domain controller, so it must be connected to the organization's network (where it can resolve the DNS records for the AD domain and the AD domain controller, and communicate with the domain controller to authenticate the user). +- The device must be able to access the Internet, following the [documented Windows Autopilot network requirements](windows-autopilot-requirements.md). +- The Intune Connector for Active Directory must be installed. + - Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf. +- If using Proxy, WPAD Proxy settings option must be enabled and configured. + +**AAD device join**: The hybrid AAD join process uses the system context to perform device AAD join, therefore it is not affected by user based AAD join permission settings. In addition, all users are enabled to join devices to AAD by default. + +#### Step by step instructions + +See [Deploy hybrid Azure AD joined devices using Intune and Windows Autopilot](https://docs.microsoft.com/intune/windows-autopilot-hybrid). + +Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic. + +## Validation + +When performing a user-driven deployment using Windows Autopilot, the following end-user experience should be observed: + +- If multiple languages are preinstalled in Windows 10, the user must pick a language. +- The user must pick a locale and a keyboard layout, and optionally a second keyboard layout. +- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network. +- Once connected to a network, the Autopilot profile will be downloaded. +- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required). +- The user will be prompted for Azure Active Directory credentials, with a customized user experience showing the Azure AD tenant name, logo, and sign-in text. +- Once correct credentials have been entered, the device will join Azure Active Directory. +- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services). +- If configured, the [enrollment status page](enrollment-status.md) will be displayed. +- Once the device configuration tasks have completed, the user will be signed into Windows 10 using the credentials they previously provided. +- Once signed in, the enrollment status page will again be displayed for user-targeted configuration tasks. + +If your results do not match these expectations, see the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation. diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml index 5178fde6ad..9f94df5b29 100644 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ b/windows/release-information/resolved-issues-windows-10-1903.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: " + @@ -68,6 +69,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusDate resolved
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		September 26, 2019
    10:00 AM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:08 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:58 PM PT
    Screenshots and Snips have an unnatural orange tint
    Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		September 11, 2019
    08:54 PM PT
    + diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index a6705b085d..6d6d7771bc 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -65,10 +65,10 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    DetailsOriginating updateStatusHistory
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4517211.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		Resolved:
    September 26, 2019
    10:00 AM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

    Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
    1. Select the Start button and type Services.
    2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
    3. Locate Startup type: and change it to Manual
    4. Select Ok
    5. The TabletInputService service is now in the default configuration and IME should work as expected.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:08 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:58 PM PT

    Opened:
    September 11, 2019
    05:18 PM PT
    Screenshots and Snips have an unnatural orange tint
    When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: None
    Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		Last updated:
    September 11, 2019
    08:54 PM PT

    Opened:
    September 11, 2019
    08:54 PM PT
    + - @@ -99,10 +99,10 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		September 26, 2019
    10:00 AM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:08 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:58 PM PT
    Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
    Microsoft and NEC have found incompatibility issues with some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903.

    See details >    		N/A

    		Mitigated
    		September 13, 2019
    05:25 PM PT
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Mitigated
    		September 13, 2019
    05:25 PM PT
    Screenshots and Snips have an unnatural orange tint
    Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		September 11, 2019
    08:54 PM PT
    Windows Desktop Search may not return any results and may have high CPU usage
    Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

    See details >    		OS Build 18362.329

    August 30, 2019
    KB4512941    		Resolved
    KB4515384    		September 10, 2019
    10:00 AM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Resolved
    KB4512941    		August 30, 2019
    10:00 AM PT
    + -
    DetailsOriginating updateStatusHistory
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4517211.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		Resolved:
    September 26, 2019
    10:00 AM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

    Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
    1. Select the Start button and type Services.
    2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
    3. Locate Startup type: and change it to Manual
    4. Select Ok
    5. The TabletInputService service is now in the default configuration and IME should work as expected.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:08 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:58 PM PT

    Opened:
    September 11, 2019
    05:18 PM PT
    Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
    Microsoft and NEC have found incompatibility issues with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903 on specific models of NEC devices. If these devices are updated to Windows 10, version 1903, they will no longer be able to use any Wi-Fi connections. The Wi-Fi driver may have a yellow exclamation point in device manager. The task tray icon for networking may show the icon for no internet and Network & Internet settings may not show any Wi-Fi networks.

    To safeguard your update experience, we have applied a compatibility hold on the affected devices from being offered Windows 10, version 1903.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: If you are using an affected device and you have already installed Windows 10, version 1903, you can mitigate the issue disabling then re-enabling the Wi-Fi adapter in Device Manager. You should now be able to use Wi-Fi until your next reboot.

    Next steps: Microsoft and NEC are working on a resolution and will provide an update in an upcoming release.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Back to top    		N/A

    		Mitigated
    		Last updated:
    September 13, 2019
    05:25 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To mitigate the issue, open settings in the impacted game and disable multi-channel audio, if this option is available. You can also search in the Windows Control Panel for 3rd party audio device control panels and disable Multi-channel audio or Virtual Surround Sound, if these options are available.  

    Next steps: We are working on a resolution and estimates a solution will be available in late September.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Mitigated
    		Last updated:
    September 13, 2019
    05:25 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Screenshots and Snips have an unnatural orange tint
    When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: None
    Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		Last updated:
    September 11, 2019
    08:54 PM PT

    Opened:
    September 11, 2019
    08:54 PM PT
    Windows Desktop Search may not return any results and may have high CPU usage
    Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing KB4512941. This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4515384.

    Back to top    		OS Build 18362.329

    August 30, 2019
    KB4512941    		Resolved
    KB4515384    		Resolved:
    September 10, 2019
    10:00 AM PT

    Opened:
    September 04, 2019
    02:25 PM PT
    diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml index a3fe4bad82..88e7011cee 100644 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml @@ -61,7 +61,6 @@ sections: text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    -
    SummaryOriginating updateStatusLast updated
    You may receive an error when opening or using the Toshiba Qosmio AV Center
    Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

    See details >    		August 13, 2019
    KB4512506    		Resolved
    KB4516048    		September 24, 2019
    10:00 AM PT
    Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
    Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed

    See details >    		August 13, 2019
    KB4512506    		Resolved External
    		August 27, 2019
    02:29 PM PT
    IA64 and x64 devices may fail to start after installing updates
    After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.

    See details >    		August 13, 2019
    KB4512506    		Mitigated
    		August 17, 2019
    12:59 PM PT
    " @@ -87,7 +86,6 @@ sections: - type: markdown text: " -
    DetailsOriginating updateStatusHistory
    Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
    Symantec identified the potential for a negative interaction that may occur after Windows Updates code signed with SHA-2 only certificates are installed on devices with Symantec or Norton antivirus programs installed. The software may not correctly identify files included in the update as code signed by Microsoft, putting the device at risk for a delayed or incomplete update.

    Affected platforms:
    • Client: Windows 7 SP1
    • Server: Windows Server 2008 R2 SP1
    Resolution: The safeguard hold has been removed. Symantec has completed its evaluation of the impact of this update and future updates to Windows 7/Windows 2008 R2 and has determined that there is no increased risk of a false positive detection for all in-field versions of Symantec Endpoint Protection and Norton antivirus programs. See the Symantec support article for additional detail and please reach out to Symantec or Norton support if you encounter any issues.

    Back to top    		August 13, 2019
    KB4512506    		Resolved External
    		Last updated:
    August 27, 2019
    02:29 PM PT

    Opened:
    August 13, 2019
    10:05 AM PT
    IA64 and x64 devices may fail to start after installing updates
    IA64 devices (in any configuration) and x64 devices using EFI boot that were provisioned after the July 9th updates and/or skipped the recommended update (KB3133977), may fail to start with the following error:
    \"File: \\Windows\\system32\\winload.efi
    Status: 0xc0000428
    Info: Windows cannot verify the digital signature for this file.\"

    Affected platforms:
    • Client: Windows 7 SP1
    • Server: Windows Server 2008 R2 SP1
    Take Action: To resolve this issue please follow the steps outlined in the SHA-2 support FAQ article for error code 0xc0000428.

    Back to top    		August 13, 2019
    KB4512506    		Mitigated
    		Last updated:
    August 17, 2019
    12:59 PM PT

    Opened:
    August 13, 2019
    08:34 AM PT
    " diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index e1bdd172ec..06dc6d0c37 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,7 +50,8 @@ sections: text: " - + + @@ -94,48 +95,5 @@ Given the potential impact to customers and their businesses, we have also relea For more information about the Windows 10 update servicing cadence, please see the Window IT Pro blog. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    MessageDate
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. Additionally, on September 24, 2019, mitigation for this vulnerability will be available via Windows Update (WU) and Windows Server Update Services (WSUS) as part of the 9C optional update for all supported versions of Windows, with the exception of Windows 10, version 1903. For devices running Windows 10, version 1903, mitigation for this vulnerability will be available via Windows Update and WSUS as part of the optional 9D update (targeted for September 26, 2019.) You can get the update in Windows via Settings > Windows Update > Check for Updates. (Note: Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.)

    For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
    		September 24, 2019
    11:00 AM PT
    September 2019 Windows 10, version 1903 \"D\" optional release is available
    The September 2019 optional monthly “D” release for Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 26, 2019
    08:00 AM PT
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation and more information for this vulnerability is available from the Microsoft Security Update Guide at CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. 

    Update: Starting September 24, 2019, mitigation for this vulnerability is included as part of the 9C optional update, via Windows Update (WU) and Microsoft Update Catalog, for all supported versions of Windows 10, with the exception of Windows 10, version 1903 and Windows 10, version 1507 (LTSB). For devices running Windows 10, version 1903, mitigation for this vulnerability will be included as part of the 9D optional update via WU, WSUS and the Microsoft Update Catalog (targeted for September 26, 2019.) To apply this update, go to Settings > Windows Update > Check for Updates. (Note Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.) 

    For customers running Windows 8.1/ Windows Server 2012 R2 or below, the 9C update is also available on Windows Server Update Services (WSUS). For other supported versions of Windows, IT admins using WSUS can import this update into WSUS/SCCM manually from Microsoft Update Catalog. See instructions on the WSUS and the Catalog Site.
    		September 24, 2019
    05:00 PM PT
    Status update: September 2019 Windows \"C\" optional release available
    The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 24, 2019
    08:10 AM PT
    Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
    Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
    		September 24, 2019
    08:00 AM PT
    Status of September 2019 “C” release
    The optional monthly “C” release for September 2019 for all supported versions of Windows and Windows Server prior to Windows 10, version 1903 and Windows Server, version 1903 will be available in the near term. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 19, 2019
    04:11 PM PT
    May 10, 2019
    10:00 AM PT
    Take action: Install servicing stack update for Windows Server 2008 SP2 for SHA-2 code sign support
    A standalone update, KB4493730, that introduce SHA-2 code sign support for the servicing stack (SSU) was released today as a security update.    		April 19, 2019
    10:00 AM PT
    The benefits of Windows 10 Dynamic Update
    Dynamic Update can help organizations and end users alike ensure that their Windows 10 devices have the latest feature update content (as part of an in-place upgrade)—and preserve precious features on demand (FODs) and language packs (LPs) that may have been previously installed.

    - -
    Find out which components are updated by Dynamic Update, how Dynamic Update is initiated, and how to enable or disable it.
    		April 17, 2019
    11:26 AM PT
    Improvements to the Windows 10 update experience are coming
    Find out about the changes coming to the Windows update process that will improve the experience, offer users more control, and improve the quality of Windows updates.    		April 04, 2019
    09:00 AM PT
    Take action: review your Windows Update for Business deferral values
    If devices under your management are still running Windows 10 Pro or Windows 10 Pro for Workstations, version 1709, your devices will reach end of service on April 9, 2019 if you have configured both of the following Windows Update for Business policies:
    -
      -
    • Branch readiness is configured as Semi-Annual Channel (SAC)
      • -
    • Feature update deferral is configured as 274 days or more
      • -
    -In order avoid this, you need to set your feature update deferral policy to 273 days or less.
    		April 03, 2019
    05:47 PM PT
    Find a list of currently supported versions and previous releases
    Every Windows product has a lifecycle. The lifecycle begins when a product is released and ends when it is no longer serviced or supported. Knowing key dates in this lifecycle helps you make informed decisions about when to update, upgrade, or make other changes to your software. Check out the updated Windows 10 release information page for a list of current versions by servicing option as well as end of service dates.    		March 28, 2019
    02:00 PM PT
    Windows 10, version 1809 designated for broad deployment
    Based on the data and the feedback we’ve received from consumers, OEMs, ISVs, partners, and commercial customers, Windows 10, version 1809 has transitioned to broad deployment. With this, the Windows 10 release information page will now reflect Semi-Annual Channel (SAC) for version 1809.    		March 28, 2019
    10:00 AM PT
    Reminder: Additional servicing for the Windows 10 Enterprise, Education, and IoT Enterprise, version 1607 ends April 9, 2019
    The additional servicing for Windows 10 Enterprise, Education, and IoT Enterprise editions ends on April 9, 2019 and doesn't extend beyond this date. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.

    Devices running Windows 10 Enterprise 2016 LTSB will continue to receive updates until October 2026 per the Fixed Lifecycle Policy. Windows 10, version 1607 devices running the Intel “Clovertrail” chipset will continue to receive updates until January 2023.
    		March 12, 2019
    10:00 AM PT
    Reminder: Windows 10 Home, Pro, Pro for Workstations, and IoT Core, version 1709 will reach end of service on April 9, 2019
    Windows 10, version 1709, will reach end of service on April 9, 2019 for devices running Windows 10 Home, Pro, Pro for Workstations, and IoT Core editions. These devices will no longer receive monthly security and quality updates that contain protection from the latest security threats. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.

    Windows 10 Enterprise, Education, and IoT Enterprise editions will continue to receive servicing for 12 months at no cost per the lifecycle announcement on October 2018.
    		March 12, 2019
    10:00 AM PT
    Take action: Install standalone security updates to introduce SHA-2 code sign support for Windows 7 amd Windows Server 2008 R2
    A standalone SHA-2 code signing support update for Windows Server 2008 R2 and Windows 7 is now available, as is a servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1 that includes the SHA-2 code signing support update.    		March 12, 2019
    10:00 AM PT
    Take action: Install standalone update for WSUS 3.0 SP2 to support the delivery of SHA-2 signed updates
    A standalone update, KB4484071 is available on Windows Update Catalog for WSUS 3.0 SP2 that supports delivering SHA-2 signed updates. For those customers using WSUS 3.0 SP2, this update should be manually installed no later than June 18, 2019.    		March 12, 2019
    10:00 AM PT
    Reminder: Final Delta update for Windows 10, version 1607, 1703, 1709, and 1803 will be April 9, 2019
    March 12th and April 9th will be the last two Delta updates for Windows 10, version 1607, 1703, 1709, and 1803. Security and quality updates will continue to be available via the express and full cumulative update packages.    		March 12, 2019
    10:00 AM PT
    How do we measure and improve the quality of Windows?
    Measuring the quality of Windows is a complex undertaking that requires gathering a variety of diagnostic signals from millions of devices within the Windows ecosystem. In addition to rigorous internal testing, we rely heavily on the feedback provided through diagnostic data to detect and fix problems before we release new updates of Windows to the general population, and to monitor the impact of those updates after each release.

    - -
    Get insight into some of the practices we employ to measure and improve the quality of Windows.
    		March 06, 2019
    10:23 AM PT
    Getting to know the Windows update history pages
    Windows update history pages offer detailed information about each Windows update: the type of update, which operating systems it affects, the improvements and fixes included, and how to get the update. See how simple it is to use this important resource to access information for Windows 10, Windows Server 2019, and earlier versions of the Windows and Windows Server operating systems.
    		February 21, 2019
    06:37 PM PT
    Share your feedback: Windows update history
    We read every comment you leave on our update history pages, and are always looking to improve these pages and the monthly knowledge base (KB) articles that accompany each monthly update. Take our survey and let us know how we can improve our transparency further and make these more compelling and useful to you and your organization.    		February 21, 2019
    12:00 PM PT
    Plan for change: Windows Update for Business and the retirement of SAC-T
    Beginning with Windows 10, version 1903 (the next feature update for Windows 10), the Windows 10 release information page will no longer list SAC-T information for version 1903 and future feature updates. Instead, you will find a single entry for each new SAC release. In addition, if you are using Windows Update for Business, you will see new UI and behavior to reflect that there is only one release date for each SAC release. If you use System Center Configuration Manager, Windows Server Update Services (WSUS), or other management tools, there will now only be one feature update published to WSUS, and this will occur at the time of release. Learn how this change will affect Windows Business for Update customers.    		February 14, 2019
    12:00 PM PT
    Champs corner: Classifying Windows updates in common deployment tools
    If you utilize automated update deployment tools, such as Windows Server Update Services (WSUS) or System Center Configuration Manager, you likely use automatic rules to streamline the approval and deployment of Windows updates. Using the correct update classification is, therefore, an important component of your organization’s device update process. Explore the options available and how to approach it in a WSUS or Configuration Manager environment.    		February 05, 2019
    10:34 AM PT
    Update: Delta updates for Windows 10, version 1607, 1703, 1709, and 1803 will be available until April 9, 2019
    Based on customer feedback, we are extending Delta update publication for Windows 10 versions 1607, 1703, 1709, and 1803. We will continue to provide Delta updates via the Microsoft Update Catalog through April 9th, 2019, which will be the last delta update available.    		February 05, 2019
    09:00 AM PT
    Global DNS outage affecting Windows Update customers
    Windows Update customers were affected by a network infrastructure event on January 29, 2019 (21:00 UTC), caused by an external DNS service provider’s global outage. A software update to the external provider’s DNS servers resulted in the distribution of corrupted DNS records that affected connectivity to the Windows Update service. The DNS records were restored by January 30, 2019 (00:10 UTC), and the majority of local Internet Service Providers (ISP) have refreshed their DNS servers and customer services have been restored.

    - -While this was not an issue with Microsoft’s services, we take any service disruption for our customers seriously. We will work with partners to better understand this so we can provide higher quality service in the future even across diverse global network providers.

    - -If you are still unable to connect to Windows Update services due to this problem, please contact your local ISP or network administrator. You can also refer to our new KB4493784 for more information to determine if your network is affected, and to provide your local ISP or network administrator with additional information to assist you.
    		January 29, 2019
    04:15 PM PT
    Application compatibility in the Windows ecosystem
    Our application ecosystem is incredibly diverse, encompassing tens of millions of applications (apps) with numerous versions, languages, architectures, services and configuration options. While our ecosystem is complex, our vision is simple. All apps on Windows devices should just work! Explore the various programs and technologies we use to improve application compatibility.    		January 15, 2019
    10:00 AM PT
    Modern desktop servicing: the year in review
    2018 was a pivotal year for the modern desktop and the servicing transformation journey we have been taking with you and your organization. In this post, John Wilcox takes a look back and recaps the progress that has been made, highlighting significant events, and provideing nsight into what 2019 has in store.    		December 19, 2018
    02:20 PM PT
    Driver quality in the Windows ecosystem
    Ensuring Windows 10 works great with all the devices and accessories our customers use is a top priority. We work closely with this broad mix of partners to test new drivers, monitor health characteristics over time, and make Windows and our ecosystem more resilient architecturally. Our goal is to ensure that all the updates and drivers we deliver to non-Insider populations are validated and at production quality (including monthly optional releases) before pushing drivers broadly to all. Explore the driver distribution chain and learn how we measure driver quality and prevent conflicts.    		December 19, 2018
    10:04 AM PT
    Introducing the Modern Desktop podcast series
    In this new podcast series, we'll explore the good, the bad, and, yes, the ugly of servicing and delivery for Windows 10 and Office 365 ProPlus. We'll talk about modern desktop management through Enterprise Mobility, security, and cloud-attached and co-managed environments. Listen to the first episode, in which we discuss monthly quality updates fpr Windows 10, the Microsoft 365 Stay Current pilot program, and interview a real customer to see how they ingest monthly updates in their organization.    		December 18, 2018
    01:00 PM PT
    Measuring Delivery Optimization and its impact to your network
    If you've familiarized yourself with the configuration options for Delivery Optimization in Windows 10, and have started to configure the settings you feel will be the best fit for your organization’s network topology, now is the time to see how well those settings are working. This article provides tips on how evaluate performance at the device level or organization level.    		December 13, 2018
    03:48 PM PT
    Windows monthly security and quality updates overview
    Today’s global cybersecurity threats are both dynamic and sophisticated, and new vulnerabilities are discovered almost every day. We focus on protecting customers from these security threats by providing security updates on a timely basis and with high quality. Find out how we deliver these critical updates on a massive scale as a key component of our ongoing Windows as a service effort.    		December 10, 2018
    10:00 AM PT
    LTSC: What is it, and when should it be used?
    With the Semi-Annual Channel, devices receive two feature updates per year, and benefit from the best performance, user experience, security, and stability. This servicing option continues to be our recommendation for managing Windows 10 updates; however, we acknowledge that certain devices and use cases (e.g. medical systems and industrial process controllers) dictate that functionality and features don’t change over time. Find out how we designed the Long-Term Servicing Channel (LTSC) with these types of use cases in mind, and what is offered through the LTSC.    		November 29, 2018
    07:02 PM PT
    Plan for change: Local Experience Packs: What are they and when should you use them?
    When we released Windows 10, version 1803, we introduced Local Experience Packs (LXPs), which are modern language packs delivered through the Microsoft Store or Microsoft Store for Business. Learn about the biggest advantage to LXPs, and the retirement of legacy language packs (lp.cab) for all Language Interface Packs (LIP).    		November 14, 2018
    11:10 AM PT
    Windows 10 Quality approach for a complex ecosystem
    While our measurements of quality show improving trends on aggregate for each successive Windows 10 release, if a single customer experiences an issue with any of our updates, we take it seriously. In this blog post, Windows CVP Mike Fortin shares an overview of how we work to continuously improve the quality of Windows and our Windows as a service approach. This blog will be the first in a series of more in-depth explanations of the work we do to deliver quality in our Windows releases.    		November 13, 2018
    10:00 AM PT
    Windows 10, version 1809 rollout resumes; now available on VLSC
    Today we are resuming the rollout of the latest Windows 10 feature update—Windows 10, version 1809—via the Software Download Center (via Update Assistant or the Media Creation Tool), Windows Server Update Services (WSUS), and Windows Update for Business. Windows 10, version 1809 is also now available on the Volume Licensing Service Center (VLSC).    		November 13, 2018
    10:00 AM PT
    Express updates for Windows Server 2016 re-enabled for November 2018 update
    Starting with the November 13, 2018 Update Tuesday release, Windows will again publish Express updates for Windows Server 2016. That means that system administrators for WSUS and System Center Configuration Manager will once again see two packages for the Windows Server 2016 update: a Full update and an Express update. Read this article for more details.    		November 12, 2018
    03:00 PM PT
    Plan for change: 2019 SHA-2 code signing support requirement for Windows and WSUS
    To protect your security, Windows operating system updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms to authenticate that updates come directly from Microsoft and were not tampered with during delivery. Due to weaknesses in the SHA-1 algorithm and to align to industry standards Microsoft will only sign Windows updates using the more secure SHA-2 algorithm exclusively.

    Customers running legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) will be required to have SHA-2 code signing support installed on their devices by July 2019. Any devices without SHA-2 support will not be offered Windows updates after July 2019. To help prepare you for this change, we will release support for SHA-2 signing in 2019. Windows Server Update Services (WSUS) 3.0 SP2 will receive SHA-2 support to properly deliver SHA-2 signed updates. Please make note of the dates in the migration timeline and plan accordingly.
    		November 09, 2018
    10:00 AM PT
    " diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index 0707268a3a..b57d24fd11 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -60,6 +60,9 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. +> [!IMPORTANT] +> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). + > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index 2ca7e8267c..1eaf9e6b79 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -33,55 +33,55 @@ This event generates when a logon session is created (on destination machine). I
    ***Event XML:*** -``` -- -- - - 4624 - 2 - 0 - 12544 - 0 - 0x8020000000000000 - - 211 - - - Security - WIN-GG82ULGC9GO - - -- - S-1-5-18 - WIN-GG82ULGC9GO$ - WORKGROUP - 0x3e7 - S-1-5-21-1377283216-344919071-3415362939-500 - Administrator - WIN-GG82ULGC9GO - 0x8dcdc - 2 - User32 - Negotiate - WIN-GG82ULGC9GO - {00000000-0000-0000-0000-000000000000} - - - - - 0 - 0x44c - C:\\Windows\\System32\\svchost.exe - 127.0.0.1 - 0 - %%1833 - - - - - - - %%1843 - 0x0 - %%1842 - - - +```xml + + + + + 4624 + 2 + 0 + 12544 + 0 + 0x8020000000000000 + + 211 + + + Security + WIN-GG82ULGC9GO + + + + S-1-5-18 + WIN-GG82ULGC9GO$ + WORKGROUP + 0x3e7 + S-1-5-21-1377283216-344919071-3415362939-500 + Administrator + WIN-GG82ULGC9GO + 0x8dcdc + 2 + User32 + Negotiate + WIN-GG82ULGC9GO + {00000000-0000-0000-0000-000000000000} + - + - + 0 + 0x44c + C:\\Windows\\System32\\svchost.exe + 127.0.0.1 + 0 + %%1833 + - + - + - + %%1843 + 0x0 + %%1842 + + ``` ***Required Server Roles:*** None. @@ -144,17 +144,17 @@ This event generates when a logon session is created (on destination machine). I ## Logon types and descriptions -| Logon Type | Logon Title | Description | -|------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 2 | Interactive | A user logged on to this computer. | -| 3 | Network | A user or computer logged on to this computer from the network. | -| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | -| 5 | Service | A service was started by the Service Control Manager. | -| 7 | Unlock | This workstation was unlocked. | -| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | -| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | -| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | -| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | +| Logon Type | Logon Title | Description | +|:----------:|---------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `2` | `Interactive` | A user logged on to this computer. | +| `3` | `Network` | A user or computer logged on to this computer from the network. | +| `4` | `Batch` | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | +| `5` | `Service` | A service was started by the Service Control Manager. | +| `7` | `Unlock` | This workstation was unlocked. | +| `8` | `NetworkCleartext` | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | +| `9` | `NewCredentials` | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | +| `10` | `RemoteInteractive` | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | +| `11` | `CachedInteractive` | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | - **Restricted Admin Mode** \[Version 2\] \[Type = UnicodeString\]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md index a1ad5ab37c..5f47de9db6 100644 --- a/windows/security/threat-protection/fips-140-validation.md +++ b/windows/security/threat-protection/fips-140-validation.md @@ -109,6 +109,7 @@ The following list contains some of the Windows components and Microsoft product - Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) - BitLocker® Drive Full-volume Encryption - IPsec Settings of Windows Firewall +- Server Message Block (SMB) 3.x ## Information for System Integrators @@ -1290,7 +1291,7 @@ Validated Editions: Ultimate Edition Algorithms -Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enchanced Cryptographic Provider, and Enhanced Cryptographic Provider +Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider 5.0.2150.1 76

    FIPS Approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)

    @@ -1317,7 +1318,7 @@ Validated Editions: Ultimate Edition Algorithms -Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enchanced Cryptographic Provider, and Enhanced Cryptographic Provider +Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider 5.0.1877.6 and 5.0.1877.7 75

    FIPS Approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)

    @@ -6219,7 +6220,7 @@ Version 6.3.9600 SHA-256 (BYTE-only)
    SHA-384 (BYTE-only)
    SHA-512 (BYTE-only) -

    Windows 7and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

    +

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816

    diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md index 82211561cf..dec845f1d0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: macaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md index c9543f40e7..08ab2a0d71 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md @@ -61,6 +61,9 @@ You can also delete tags from this view. >- Windows Server, version 1803 or later >- Windows Server 2016 >- Windows Server 2012 R2 +>- Windows Server 2008 R2 SP1 +>- Windows 8.1 +>- Windows 7 SP1 Machines with similar tags can be handy when you need to apply contextual action on a specific list of machines. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md index e3142e03ef..ba4afb804d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md @@ -48,11 +48,11 @@ Download the installation and onboarding packages from Windows Defender Security Extract the contents of the .zip files: ```bash - ls -l + $ ls -l total 721152 -rw-r--r-- 1 test staff 6185 Mar 15 10:45 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip inflating: WindowsDefenderATPOnboarding.py ``` @@ -92,7 +92,7 @@ If you did not enable Microsoft's driver during installation, then the applicati You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available: ```bash -mdatp --health +$ mdatp --health ... realTimeProtectionAvailable : false realTimeProtectionEnabled : true @@ -112,7 +112,7 @@ In this case, you need to perform the following steps to enable Real-Time Protec 1. In Terminal, attempt to install the driver. (The operation will fail) ```bash - sudo kextutil /Library/Extensions/wdavkext.kext + $ sudo kextutil /Library/Extensions/wdavkext.kext Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } Diagnostics for /Library/Extensions/wdavkext.kext: @@ -125,13 +125,13 @@ In this case, you need to perform the following steps to enable Real-Time Protec 4. In Terminal, install the driver again. This time the operation will succeed: ```bash -sudo kextutil /Library/Extensions/wdavkext.kext +$ sudo kextutil /Library/Extensions/wdavkext.kext ``` The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available: ```bash -mdatp --health +$ mdatp --health ... realTimeProtectionAvailable : true realTimeProtectionEnabled : true @@ -145,20 +145,20 @@ realTimeProtectionEnabled : true The client machine is not associated with orgId. Note that the *orgId* attribute is blank. ```bash - mdatp --health orgId + $ mdatp --health orgId ``` 2. Run the Python script to install the configuration file: ```bash - /usr/bin/python WindowsDefenderATPOnboarding.py + $ /usr/bin/python WindowsDefenderATPOnboarding.py Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password) ``` 3. Verify that the machine is now associated with your organization and reports a valid *orgId*: ```bash - mdatp --health orgId + $ mdatp --health orgId E6875323-A6C0-4C60-87AD-114BBE7439B8 ``` diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md index 21be43c179..1abf3471f5 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md @@ -50,28 +50,29 @@ Download the installation and onboarding packages from Microsoft Defender Securi Extract the contents of the .zip files: ```bash - mavel-macmini:Downloads test$ ls -l + $ ls -l total 721688 -rw-r--r-- 1 test staff 269280 Mar 15 11:25 IntuneAppUtil -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators inflating: intune/kext.xml inflating: intune/WindowsDefenderATPOnboarding.xml inflating: jamf/WindowsDefenderATPOnboarding.plist - mavel-macmini:Downloads test$ ``` 7. Make IntuneAppUtil an executable: - ```mavel-macmini:Downloads test$ chmod +x IntuneAppUtil``` + ```bash + $ chmod +x IntuneAppUtil + ``` 8. Create the wdav.pkg.intunemac package from wdav.pkg: ```bash - mavel-macmini:Downloads test$ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" + $ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" Microsoft Intune Application Utility for Mac OS X Version: 1.0.0.0 Copyright 2018 Microsoft Corporation diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 9a52b56369..621dee60a6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -51,17 +51,16 @@ Download the installation and onboarding packages from Windows Defender Security 5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: ```bash - mavel-macmini:Downloads test$ ls -l + $ ls -l total 721160 -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators inflating: intune/kext.xml inflating: intune/WindowsDefenderATPOnboarding.xml inflating: jamf/WindowsDefenderATPOnboarding.plist - mavel-macmini:Downloads test$ ``` ## Create JAMF policies @@ -166,7 +165,7 @@ Once the policy is applied, you'll see the Microsoft Defender ATP icon in the ma You can monitor policy installation on a device by following the JAMF log file: ```bash - mavel-mojave:~ testuser$ tail -f /var/log/jamf.log + $ tail -f /var/log/jamf.log Thu Feb 21 11:11:41 mavel-mojave jamf[7960]: No patch policies were found. Thu Feb 21 11:16:41 mavel-mojave jamf[8051]: Checking for policies triggered by "recurring check-in" for user "testuser"... Thu Feb 21 11:16:43 mavel-mojave jamf[8051]: Executing Policy WDAV @@ -179,7 +178,7 @@ You can monitor policy installation on a device by following the JAMF log file: You can also check the onboarding status: ```bash -mavel-mojave:~ testuser$ mdatp --health +$ mdatp --health ... licensed : true orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" @@ -195,7 +194,7 @@ orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: ```bash -mdatp --health healthy +$ mdatp --health healthy ``` The above command prints "1" if the product is onboarded and functioning as expected. @@ -219,6 +218,8 @@ Create a script in **Settings > Computer Management > Scripts**. This script removes Microsoft Defender ATP from the /Applications directory: ```bash + #!/bin/bash + echo "Is WDAV installed?" ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md index ffa0df06d3..80ec6a0f67 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md @@ -66,7 +66,7 @@ Whether real-time protection (scan files as they are accessed) is enabled or not Whether the antivirus engine runs in passive mode or not. In passive mode: - Real-time protection is turned off -- On demand scanning is turned on +- On-demand scanning is turned on - Automatic threat remediation is turned off - Security intelligence updates are turned on - Status menu icon is hidden @@ -149,6 +149,16 @@ Used to exclude content from the scan by file name. | **Possible values** | any string | | **Comments** | Applicable only if *$type* is *excludedFileName* | +#### Allowed threats + +List of threats (identified by their name) that are not blocked by the product and are instead allowed to run. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | allowedThreats | +| **Data type** | Array of strings | + #### Threat type settings The *threatTypeSettings* preference in the antivirus engine is used to control how certain threat types are handled by the product. @@ -243,7 +253,7 @@ The *userInterface* section of the configuration profile is used to manage the p #### Show / hide status menu icon -Whether the status menu icon (shown in the top right corner of the screen) is hidden or not. +Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not. ||| |:---|:---| @@ -425,7 +435,7 @@ The following configuration profile contains entries for all settings described allowedThreats - eicar + EICAR-Test-File (not a virus) threatTypeSettings @@ -540,7 +550,7 @@ The following configuration profile contains entries for all settings described allowedThreats - eicar + EICAR-Test-File (not a virus) threatTypeSettings diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md index e8697f63a3..2f67653ec0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md @@ -31,7 +31,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 1. Increase logging level: ```bash - mdatp --log-level verbose + $ mdatp --log-level verbose Creating connection to daemon Connection established Operation succeeded @@ -39,10 +39,10 @@ If you can reproduce a problem, please increase the logging level, run the syste 2. Reproduce the problem -3. Run `mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. +3. Run `sudo mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. ```bash - mdatp --diagnostic --create + $ sudo mdatp --diagnostic --create Creating connection to daemon Connection established ``` @@ -50,7 +50,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 4. Restore logging level: ```bash - mdatp --log-level info + $ mdatp --log-level info Creating connection to daemon Connection established Operation succeeded @@ -82,13 +82,13 @@ Important tasks, such as controlling product settings and triggering on-demand s |-------------|-------------------------------------------|-----------------------------------------------------------------------| |Configuration|Turn on/off real-time protection |`mdatp --config realTimeProtectionEnabled [true/false]` | |Configuration|Turn on/off cloud protection |`mdatp --config cloudEnabled [true/false]` | -|Configuration|Turn on/off product diagnostics |`mdatp --config diagnostic [true/false]` | +|Configuration|Turn on/off product diagnostics |`mdatp --config cloudDiagnosticEnabled [true/false]` | |Configuration|Turn on/off automatic sample submission |`mdatp --config cloudAutomaticSampleSubmission [true/false]` | |Configuration|Turn on PUA protection |`mdatp --threat --type-handling potentially_unwanted_application block`| |Configuration|Turn off PUA protection |`mdatp --threat --type-handling potentially_unwanted_application off` | |Configuration|Turn on audit mode for PUA protection |`mdatp --threat --type-handling potentially_unwanted_application audit`| |Diagnostics |Change the log level |`mdatp --log-level [error/warning/info/verbose]` | -|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic` | +|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic --create` | |Health |Check the product's health |`mdatp --health` | |Protection |Scan a path |`mdatp --scan --path [path]` | |Protection |Do a quick scan |`mdatp --scan --quick` | diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md index 7c18dc31d2..f87f5332c7 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md @@ -69,7 +69,7 @@ To test that a connection is not blocked, open [https://x.cp.wd.microsoft.com/ap If you prefer the command line, you can also check the connection by running the following command in Terminal: ```bash -curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping' +$ curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping' ``` The output from this command should be similar to the following: