From e18dd0d16eda742c5e437bed37e8d55ad60ea9b9 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Sat, 21 Dec 2019 13:51:49 +0500 Subject: [PATCH 001/374] Update upgrading-to-mbam-25-sp1-from-mbam-25.md --- .../upgrading-to-mbam-25-sp1-from-mbam-25.md | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md index 4e0f5b098c..c94973efcc 100644 --- a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md +++ b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md @@ -29,21 +29,17 @@ Verify you have a current documentation of your MBAM environment, including all Note: You will not see an option to remove the Databases; this is expected. 2. Install 2.5 SP1 (Located with MDOP - Microsoft Desktop Optimization Pack 2015 from the Volume Licensing Service Center site: 3. Do not configure it at this time  -4. Install the May 2019 Rollup: https://www.microsoft.com/download/details.aspx?id=58345 -5. Using the MBAM Configurator; re-add the Reports role -6. This will configure the SSRS connection using the latest MBAM code from the rollup  -7. Using the MBAM Configurator; re-add the SQL Database role on the SQL Server. -8. At the end, you will be warned that the DBs already exist and weren’t created, but this is expected. -9. This process updates the existing databases to the current version being installed +4. Using the MBAM Configurator; re-add the Reports role +5. Using the MBAM Configurator; re-add the SQL Database role on the SQL Server. +6. At the end, you will be warned that the DBs already exist and weren’t created, but this is expected. +7. This process updates the existing databases to the current version being installed #### Steps to upgrade the MBAM Server (Running MBAM and IIS) 1. Using the MBAM Configurator; remove the Admin and Self Service Portals from the IIS server 2. Install MBAM 2.5 SP1 3. Do not configure it at this time   -4. Install the May 2019 Rollup on the IIS server(https://www.microsoft.com/download/details.aspx?id=58345) -5. Using the MBAM Configurator; re-add the Admin and Self Service Portals to the IIS server  -6. This will configure the sites using the latest MBAM code from the May 2019 Rollup -7. Open an elevated command prompt, Type: **IISRESET** and Hit Enter. +4. Using the MBAM Configurator; re-add the Admin and Self Service Portals to the IIS server  +5 Open an elevated command prompt, Type: **IISRESET** and Hit Enter. #### Steps to upgrade the MBAM Clients/Endpoints 1. Uninstall the 2.5 Agent from client endpoints From 9c2764441b76d150164dbda445ae9f4a47f36076 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Mon, 23 Dec 2019 22:12:24 +0500 Subject: [PATCH 002/374] Update mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md index c94973efcc..38aa4137f3 100644 --- a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md +++ b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md @@ -39,7 +39,7 @@ Verify you have a current documentation of your MBAM environment, including all 2. Install MBAM 2.5 SP1 3. Do not configure it at this time   4. Using the MBAM Configurator; re-add the Admin and Self Service Portals to the IIS server  -5 Open an elevated command prompt, Type: **IISRESET** and Hit Enter. +5. Open an elevated command prompt, type: **IISRESET** and hit Enter. #### Steps to upgrade the MBAM Clients/Endpoints 1. Uninstall the 2.5 Agent from client endpoints From 1d0236d76b60de43e217f44b2e0b6f5ee7b2a7fa Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Thu, 26 Dec 2019 20:39:45 -0800 Subject: [PATCH 003/374] Rebrand System Center to Microsoft Endpoint 32 files _ Four --- .../hello-for-business/hello-faq.md | 4 +-- .../hello-how-it-works-technology.md | 2 +- .../retired/hello-how-it-works.md | 2 +- ...ccount-control-security-policy-settings.md | 2 +- .../virtual-smart-card-tpmvscmgr.md | 2 +- .../vpn/vpn-profile-options.md | 2 +- .../security/information-protection/TOC.md | 4 +-- ...r-device-encryption-overview-windows-10.md | 4 +-- .../bitlocker/ts-bitlocker-intune-issues.md | 4 +-- ...reate-and-verify-an-efs-dra-certificate.md | 4 +-- .../create-wip-policy-using-sccm.md | 24 +++++++------- .../enlightened-microsoft-apps-and-wip.md | 2 +- .../how-wip-works-with-labels.md | 2 +- .../limitations-with-wip.md | 2 +- .../overview-create-wip-policy-sccm.md | 10 +++--- .../overview-create-wip-policy.md | 2 +- .../protect-enterprise-data-using-wip.md | 6 ++-- .../testing-scenarios-for-wip.md | 2 +- windows/security/threat-protection/TOC.md | 6 ++-- .../audit-authorization-policy-change.md | 6 ++-- .../auditing/audit-token-right-adjusted.md | 6 ++-- .../threat-protection/auditing/event-4703.md | 4 +-- ...tion-based-protection-of-code-integrity.md | 2 +- .../get-support-for-security-baselines.md | 2 +- .../attack-surface-reduction.md | 4 +-- .../configure-and-manage-tvm.md | 6 ++-- .../configure-attack-surface-reduction.md | 2 +- .../configure-endpoints-gp.md | 2 +- .../configure-endpoints-mdm.md | 2 +- .../configure-endpoints-sccm.md | 32 +++++++++---------- .../configure-endpoints-script.md | 2 +- .../configure-endpoints-vdi.md | 2 +- 32 files changed, 79 insertions(+), 79 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.md b/windows/security/identity-protection/hello-for-business/hello-faq.md index 0cfbf47cc6..1a9054bdab 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.md +++ b/windows/security/identity-protection/hello-for-business/hello-faq.md @@ -30,8 +30,8 @@ Microsoft is committed to its vision of a world without passwords. We rec ## Can I use Windows Hello for Business key trust and RDP? RDP currently does not support key based authentication and does not support self signed certificates. RDP with Windows Hello for Business is currently only supported with certificate based deployments. -## Can I deploy Windows Hello for Business using System Center Configuration Manager? -Windows Hello for Business deployments using System Center Configuration Manager need to move to the hybrid deployment model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager will no longer be supported after November 2018. +## Can I deploy Windows Hello for Business using Microsoft Endpoint Configuration Manager? +Windows Hello for Business deployments using Microsoft Endpoint Configuration Manager need to move to the hybrid deployment model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager will no longer be supported after November 2018. ## How many users can enroll for Windows Hello for Business on a single Windows 10 computer? The maximum number of supported enrollments on a single Windows 10 computer is 10. That enables 10 users to each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index 012051d5e2..7de79a7f47 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -162,7 +162,7 @@ Primarily for large enterprise organizations with more complex authentication re For more than a decade, many organizations have used the domain join to their on-premises Active Directory to enable: - IT departments to manage work-owned devices from a central location. - Users to sign in to their devices with their Active Directory work or school accounts. -Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use System Center Configuration Manager (SCCM) or group policy (GP) to manage them. +Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use Microsoft Endpoint Configuration Manager or group policy (GP) to manage them. If your environment has an on-premises AD footprint and you also want benefit from the capabilities provided by Azure Active Directory, you can implement hybrid Azure AD joined devices. These are devices that are both, joined to your on-premises Active Directory and your Azure Active Directory. diff --git a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md index 00b0bd2e95..928bd61ac1 100644 --- a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md @@ -97,7 +97,7 @@ Windows Hello depends on having compatible IDPs available to it. As of this writ - Use an existing Windows-based PKI centered around Active Directory Certificate Services. This option requires additional infrastructure, including a way to issue certificates to users. You can use NDES to register devices directly, or Microsoft Intune where it’s available to manage mobile device participation in Windows Hello. - The normal discovery mechanism that clients use to find domain controllers and global catalogs relies on Domain Name System (DNS) SRV records, but those records don’t contain version data. Windows 10 computers will query DNS for SRV records to find all available Active Directory servers, and then query each server to identify those that can act as Windows Hello IDPs. The number of authentication requests your users generate, where your users are located, and the design of your network all drive the number of Windows Server 2016 domain controllers required. -- Azure AD can act as an IDP either by itself or alongside an on-premises AD DS forest. Organizations that use Azure AD can register devices directly without having to join them to a local domain by using the capabilities the Azure AD Device Registration service provides. In addition to the IDP, Windows Hello requires an MDM system. This system can be the cloud-based Intune if you use Azure AD, or an on-premises System Center Configuration Manager deployment that meets the system requirements described in the Deployment requirements section of this document. +- Azure AD can act as an IDP either by itself or alongside an on-premises AD DS forest. Organizations that use Azure AD can register devices directly without having to join them to a local domain by using the capabilities the Azure AD Device Registration service provides. In addition to the IDP, Windows Hello requires an MDM system. This system can be the cloud-based Intune if you use Azure AD, or an on-premises Microsoft Endpoint Configuration Manager deployment that meets the system requirements described in the Deployment requirements section of this document. diff --git a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md index f107a2346a..9cb4e34436 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md @@ -65,7 +65,7 @@ This policy setting controls the behavior of the elevation prompt for standard u This policy setting controls the behavior of application installation detection for the computer. - **Enabled** (Default) When an app installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. -- **Disabled** App installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies, such as Group Policy or System Center Configuration Manager should disable this policy setting. In this case, installer detection is unnecessary. +- **Disabled** App installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies, such as Group Policy or Microsoft Endpoint Configuration Manager should disable this policy setting. In this case, installer detection is unnecessary. ## User Account Control: Only elevate executable files that are signed and validated diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md index cb25136eb0..3d5e75db74 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md @@ -38,7 +38,7 @@ The Create command sets up new virtual smart cards on the user’s system. It re | /AdminKey | Indicates the desired administrator key that can be used to reset the PIN of the card if the user forgets the PIN.
**DEFAULT** Specifies the default value of 010203040506070801020304050607080102030405060708.
**PROMPT**  Prompts the user to enter a value for the administrator key.
**RANDOM**  Results in a random setting for the administrator key for a card that is not returned to the user. This creates a card that might not be manageable by using smart card management tools. When generated with RANDOM, the administrator key must be entered as 48 hexadecimal characters. | | /PIN | Indicates desired user PIN value.
**DEFAULT**  Specifies the default PIN of 12345678.
**PROMPT**  Prompts the user to enter a PIN at the command line. The PIN must be a minimum of eight characters, and it can contain numerals, characters, and special characters. | | /PUK | Indicates the desired PIN Unlock Key (PUK) value. The PUK value must be a minimum of eight characters, and it can contain numerals, characters, and special characters. If the parameter is omitted, the card is created without a PUK.
**DEFAULT**  Specifies the default PUK of 12345678.
**PROMPT**  Prompts the user to enter a PUK at the command line. | -| /generate | Generates the files in storage that are necessary for the virtual smart card to function. If the /generate parameter is omitted, it is equivalent to creating a card without this file system. A card without a file system can be managed only by a smart card management system such as Microsoft System Center Configuration Manager. | +| /generate | Generates the files in storage that are necessary for the virtual smart card to function. If the /generate parameter is omitted, it is equivalent to creating a card without this file system. A card without a file system can be managed only by a smart card management system such as Microsoft Endpoint Configuration Manager. | | /machine | Allows you to specify the name of a remote computer on which the virtual smart card can be created. This can be used in a domain environment only, and it relies on DCOM. For the command to succeed in creating a virtual smart card on a different computer, the user running this command must be a member in the local administrators group on the remote computer. | | /pinpolicy | If **/pin prompt** is used, **/pinpolicy** allows you to specify the following PIN policy options:
**minlen** <minimum PIN length>
   If not specificed, defaults to 8. The lower bound is 4.
**maxlen** <maximum PIN length>
   If not specificed, defaults to 127. The upper bound is 127.
**uppercase**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
**lowercase**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
**digits**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
**specialchars**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**

When using **/pinpolicy**, PIN characters must be printable ASCII characters. | | /attestation | Configures attestation (subject only). This attestation uses an [Attestation Identity Key (AIK) certificate](https://msdn.microsoft.com/library/mt766230.aspx#gt_89a2ba3c-80af-4d1f-88b3-06ec3489fd5a) as a trust anchor to vouch that the virtual smart card keys and certificates are truly hardware bound. The attestation methods are:
**AIK_AND_CERT**  Creates an AIK and obtains an AIK certificate from the Microsoft cloud certification authority (CA). This requires the device to have a TPM with an [EK certificate](https://msdn.microsoft.com/library/cc249746.aspx#gt_6aaaff7f-d380-44fb-91d3-b985e458eb6d). If this option is specified and there is no network connectivity, it is possible that creation of the virtual smart card will fail.
**AIK_ONLY**  Creates an AIK but does not obtain an AIK certificate. | diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index 6931c47d7b..1f2dc8ce4a 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -20,7 +20,7 @@ ms.date: 05/17/2018 - Windows 10 - Windows 10 Mobile -Most of the VPN settings in Windows 10 can be configured in VPN profiles using Microsoft Intune or System Center Configuration Manager. All VPN settings in Windows 10 can be configued using the **ProfileXML** node in the [VPNv2 configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). +Most of the VPN settings in Windows 10 can be configured in VPN profiles using Microsoft Intune or Microsoft Endpoint Configuration Manager. All VPN settings in Windows 10 can be configued using the **ProfileXML** node in the [VPNv2 configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). >[!NOTE] >If you're not familiar with CSPs, read [Introduction to configuration service providers (CSPs)](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers) first. diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md index 31855ca5b2..c3c19ee400 100644 --- a/windows/security/information-protection/TOC.md +++ b/windows/security/information-protection/TOC.md @@ -47,8 +47,8 @@ ##### [Associate and deploy a VPN policy for WIP using the Azure portal for Microsoft Intune](windows-information-protection\create-vpn-and-wip-policy-using-intune-azure.md) #### [Create and verify an EFS Data Recovery Agent (DRA) certificate](windows-information-protection\create-and-verify-an-efs-dra-certificate.md) #### [Determine the Enterprise Context of an app running in WIP](windows-information-protection\wip-app-enterprise-context.md) -### [Create a WIP policy using System Center Configuration Manager](windows-information-protection\overview-create-wip-policy-sccm.md) -#### [Create and deploy a WIP policy using System Center Configuration Manager](windows-information-protection\create-wip-policy-using-sccm.md) +### [Create a WIP policy using Microsoft Endpoint Configuration Manager](windows-information-protection\overview-create-wip-policy-sccm.md) +#### [Create and deploy a WIP policy using Microsoft Endpoint Configuration Manager](windows-information-protection\create-wip-policy-using-sccm.md) #### [Create and verify an EFS Data Recovery Agent (DRA) certificate](windows-information-protection\create-and-verify-an-efs-dra-certificate.md) #### [Determine the Enterprise Context of an app running in WIP](windows-information-protection\wip-app-enterprise-context.md) ### [Mandatory tasks and settings required to turn on WIP](windows-information-protection\mandatory-settings-for-wip.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md index e4fb0170b4..7560239ff8 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md +++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md @@ -126,13 +126,13 @@ Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage * Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. * Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. -* Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. +* Provides centralized reporting and hardware management with Microsoft Microsoft Endpoint Configuration Manager. * Reduces the workload on the help desk to assist end users with BitLocker recovery requests. * Enables end users to recover encrypted devices independently by using the Self-Service Portal. * Enables security officers to easily audit access to recovery key information. * Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. * Enforces the BitLocker encryption policy options that you set for your enterprise. -* Integrates with existing management tools, such as System Center Configuration Manager. +* Integrates with existing management tools, such as Microsoft Endpoint Configuration Manager. * Offers an IT-customizable recovery user experience. * Supports Windows 10. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md index e2d0822e3c..b7f351b324 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md @@ -109,9 +109,9 @@ list volume ``` ![Output of the list volume command in the Diskpart app](./images/4509195-en-1.png) -If the status of any of the volumes is not healthy or if the recovery partition is missing, you may have to reinstall Windows. Before you do this, check the configuration of the Windows image that you are using for provisioning. Make sure that the image uses the correct disk configuration. The image configuration should resemble the following (this example is from System Center Configuration Manager). +If the status of any of the volumes is not healthy or if the recovery partition is missing, you may have to reinstall Windows. Before you do this, check the configuration of the Windows image that you are using for provisioning. Make sure that the image uses the correct disk configuration. The image configuration should resemble the following (this example is from Microsoft Endpoint Configuration Manager). -![Windows image configuration in System Center Configuration Manager](./images/sccm-imageconfig.jpg) +![Windows image configuration in Microsoft Endpoint Configuration Manager](./images/sccm-imageconfig.jpg) #### Step 2: Verify the status of WinRE diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index a6029ffb2a..d2a77a72e2 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -47,7 +47,7 @@ The recovery process included in this topic only works for desktop devices. WIP >[!Important] >Because the private keys in your DRA .pfx files can be used to decrypt any WIP file, you must protect them accordingly. We highly recommend storing these files offline, keeping copies on a smart card with strong protection for normal use and master copies in a secured physical location. -4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as [Microsoft Intune](create-wip-policy-using-intune-azure.md) or [System Center Configuration Manager](create-wip-policy-using-sccm.md). +4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as [Microsoft Intune](create-wip-policy-using-intune-azure.md) or [Microsoft Endpoint Configuration Manager](create-wip-policy-using-sccm.md). > [!NOTE] > This certificate can be used in Intune for policies both _with_ device enrollment (MDM) and _without_ device enrollment (MAM). @@ -147,7 +147,7 @@ After signing in, the necessary WIP key info is automatically downloaded and emp - [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune-azure.md) -- [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) +- [Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-sccm.md) - [Creating a Domain-Based Recovery Agent](https://msdn.microsoft.com/library/cc875821.aspx#EJAA) diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md index 2e4f0f0749..1b109aef97 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md @@ -1,9 +1,9 @@ --- -title: Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager (Windows 10) +title: Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager (Windows 10) description: Use Configuration Manager to make & deploy a Windows Information Protection (WIP) policy. Choose protected apps, WIP-protection level, and find enterprise data. ms.assetid: 85b99c20-1319-4aa3-8635-c1a87b244529 ms.reviewer: -keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, SCCM, Microsoft Endpoint Configuration Manager, Configuration Manager ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -18,23 +18,23 @@ ms.topic: conceptual ms.date: 05/13/2019 --- -# Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager +# Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager **Applies to:** - Windows 10, version 1607 and later - Windows 10 Mobile, version 1607 and later -- System Center Configuration Manager +- Microsoft Endpoint Configuration Manager -System Center Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network. +Microsoft Endpoint Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network. ## Add a WIP policy -After you’ve installed and set up System Center Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy. +After you’ve installed and set up Microsoft Endpoint Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy. **To create a configuration item for WIP** -1. Open the System Center Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node. +1. Open the Microsoft Endpoint Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node. - ![System Center Configuration Manager, Configuration Items screen](images/wip-sccm-addpolicy.png) + ![Microsoft Endpoint Configuration Manager, Configuration Items screen](images/wip-sccm-addpolicy.png) 2. Click the **Create Configuration Item** button.

The **Create Configuration Item Wizard** starts. @@ -43,7 +43,7 @@ The **Create Configuration Item Wizard** starts. 3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. -4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use System Center Configuration Manager for device management, and then click **Next**. +4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use Microsoft Endpoint Configuration Manager for device management, and then click **Next**. - **Settings for devices managed with the Configuration Manager client:** Windows 10 @@ -62,7 +62,7 @@ The **Create Configuration Item Wizard** starts. The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization. ## Add app rules to your policy -During the policy-creation process in System Center Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. +During the policy-creation process in Microsoft Endpoint Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file. @@ -295,9 +295,9 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* ``` -12. After you’ve created your XML file, you need to import it by using System Center Configuration Manager. +12. After you’ve created your XML file, you need to import it by using Microsoft Endpoint Configuration Manager. -**To import your Applocker policy file app rule using System Center Configuration Manager** +**To import your Applocker policy file app rule using Microsoft Endpoint Configuration Manager** 1. From the **App rules** area, click **Add**. The **Add app rule** box appears. diff --git a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md index 93a5d00470..ea32d9185f 100644 --- a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md +++ b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md @@ -86,7 +86,7 @@ Microsoft still has apps that are unenlightened, but which have been tested and > [!NOTE] > As of January 2019 it is no longer necessary to add Intune Company Portal as an exempt app since it is now included in the default list of protected apps. -You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager. +You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and Microsoft Endpoint Configuration Manager. | Product name | App info | diff --git a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md index 5b2d65942a..7549d29961 100644 --- a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md +++ b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md @@ -110,7 +110,7 @@ You can see sensitive information types in Microsoft 365 compliance under **Clas - Auto labelling requires Windows 10, version 1903 - Devices need to be onboarded to [Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection), which scans content for a label and applies WIP policy - [Sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) need to be configured in Microsoft 365 compliance center -- WIP policy needs to be applied to endpoint devices by using [Intune](create-wip-policy-using-intune-azure.md) or [System Center Configuration Manager (SCCM)](overview-create-wip-policy-sccm.md) +- WIP policy needs to be applied to endpoint devices by using [Intune](create-wip-policy-using-intune-azure.md) or [Microsoft Endpoint Configuration Manager](overview-create-wip-policy-sccm.md) diff --git a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md index 7cdf0d2dfd..ff92a6c111 100644 --- a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md @@ -114,7 +114,7 @@ This table provides info about the most common problems you might encounter whil

  • SavedGames
    • - WIP isn’t turned on for employees in your organization. Error code 0x807c0008 will result if WIP is deployed by using System Center Configuration Manager. + WIP isn’t turned on for employees in your organization. Error code 0x807c0008 will result if WIP is deployed by using Microsoft Endpoint Configuration Manager. Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders.

    If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see Can't open files offline when you use Offline Files and Windows Information Protection. diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md index 40ab9e148d..fc7e101613 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md @@ -1,6 +1,6 @@ --- -title: Create a Windows Information Protection (WIP) policy using System Center Configuration Manager (Windows 10) -description: System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +title: Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager (Windows 10) +description: Microsoft Endpoint Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 ms.reviewer: ms.prod: w10 @@ -17,17 +17,17 @@ ms.topic: conceptual ms.date: 02/26/2019 --- -# Create a Windows Information Protection (WIP) policy using System Center Configuration Manager +# Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager **Applies to:** - Windows 10, version 1607 and later - Windows 10 Mobile, version 1607 and later -System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +Microsoft Endpoint Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. ## In this section |Topic |Description | |------|------------| -|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |System Center Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | +|[Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-sccm.md) |Microsoft Endpoint Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | |[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. | |[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). | diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md index 3338a0ebab..e40c2405a1 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md @@ -1,6 +1,6 @@ --- title: Create a Windows Information Protection (WIP) policy using Microsoft Intune (Windows 10) -description: Microsoft Intune and System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy. +description: Microsoft Intune and Microsoft Endpoint Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 ms.reviewer: ms.prod: w10 diff --git a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md index fc2050b5d2..0de8771fac 100644 --- a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md +++ b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md @@ -42,7 +42,7 @@ You’ll need this software to run WIP in your enterprise: |Operating system | Management solution | |-----------------|---------------------| -|Windows 10, version 1607 or later | Microsoft Intune

    -OR-

    System Center Configuration Manager

    -OR-

    Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt697634.aspx) documentation.| +|Windows 10, version 1607 or later | Microsoft Intune

    -OR-

    Microsoft Endpoint Configuration Manager

    -OR-

    Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt697634.aspx) documentation.| ## What is enterprise data control? Effective collaboration means that you need to share data with others in your enterprise. This sharing can be from one extreme where everyone has access to everything without any security, all the way to the other extreme where people can’t share anything and it’s all highly secured. Most enterprises fall somewhere in between the two extremes, where success is balanced between providing the necessary access with the potential for improper data disclosure. @@ -79,7 +79,7 @@ WIP provides: - Use of audit reports for tracking issues and remedial actions. -- Integration with your existing management system (Microsoft Intune, System Center Configuration Manager, or your current mobile device management (MDM) system) to configure, deploy, and manage WIP for your company. +- Integration with your existing management system (Microsoft Intune, Microsoft Endpoint Configuration Manager, or your current mobile device management (MDM) system) to configure, deploy, and manage WIP for your company. ## Why use WIP? WIP is the mobile application management (MAM) mechanism on Windows 10. WIP gives you a new way to manage data policy enforcement for apps and documents on Windows 10 desktop operating systems, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune). @@ -110,7 +110,7 @@ WIP is the mobile application management (MAM) mechanism on Windows 10. WIP give - **Remove access to enterprise data from enterprise-protected devices.** WIP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can use Microsoft Intune to unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable. >[!NOTE] - >For management of Surface devices it is recommended that you use the Current Branch of System Center Configuration Manager.
    System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. + >For management of Surface devices it is recommended that you use the Current Branch of Microsoft Endpoint Configuration Manager.
    Microsoft Endpoint Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. ## How WIP works WIP helps address your everyday challenges in the enterprise. Including: diff --git a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md index d056e573c8..7cb66960c1 100644 --- a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md @@ -56,7 +56,7 @@ You can try any of the processes included in these scenarios, but you should foc Create work documents in enterprise-allowed apps. For desktop:

    For mobile:

      diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index a483760fe8..38feacbb92 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -279,7 +279,7 @@ #### [Manage antivirus in your business]() ##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) ##### [Use Group Policy settings to configure and manage antivirus](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage antivirus](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) +##### [Use Microsoft Endpoint Configuration Manager and Microsoft Intune to configure and manage antivirus](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) ##### [Use PowerShell cmdlets to configure and manage antivirus](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) ##### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) ##### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) @@ -305,7 +305,7 @@ #### [Manage next generation protection in your business]() ##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -##### [Use Microsoft Intune and System Center Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) +##### [Use Microsoft Intune and Microsoft Endpoint Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) ##### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) ##### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) ##### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) @@ -342,7 +342,7 @@ ##### [Onboard Windows 10 machines]() ###### [Onboarding tools and methods](microsoft-defender-atp/configure-endpoints.md) ###### [Onboard machines using Group Policy](microsoft-defender-atp/configure-endpoints-gp.md) -###### [Onboard machines using System Center Configuration Manager](microsoft-defender-atp/configure-endpoints-sccm.md) +###### [Onboard machines using Microsoft Endpoint Configuration Manager](microsoft-defender-atp/configure-endpoints-sccm.md) ###### [Onboard machines using Mobile Device Management tools](microsoft-defender-atp/configure-endpoints-mdm.md) ###### [Onboard machines using a local script](microsoft-defender-atp/configure-endpoints-script.md) ###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](microsoft-defender-atp/configure-endpoints-vdi.md) diff --git a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md index af4339ce53..55beceb62d 100644 --- a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md @@ -25,9 +25,9 @@ Audit Authorization Policy Change allows you to audit assignment and removal of | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
      However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
      However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
      However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
      However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
      However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
      However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-token-right-adjusted.md b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md index a4fb47fef4..0d988cd997 100644 --- a/windows/security/threat-protection/auditing/audit-token-right-adjusted.md +++ b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md @@ -16,9 +16,9 @@ For more information, see [Security Monitoring: A Possible New Way to Detect Pri | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
      However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
      However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
      However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
      However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
      However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
      However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
      If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | **Events List:** diff --git a/windows/security/threat-protection/auditing/event-4703.md b/windows/security/threat-protection/auditing/event-4703.md index a04ae9c4c5..5c8f7fcc36 100644 --- a/windows/security/threat-protection/auditing/event-4703.md +++ b/windows/security/threat-protection/auditing/event-4703.md @@ -26,7 +26,7 @@ ms.author: dansimp ***Event Description:*** -This event generates when [token privileges](https://msdn.microsoft.com/library/windows/desktop/aa446619(v=vs.85).aspx) were enabled or disabled for a specific account’s token. As of Windows 10, event 4703 is also logged by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from svchost.exe). If you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, you might need to disable Success auditing for this subcategory (Audit Authorization Policy Change), or work with a very high volume of event 4703. +This event generates when [token privileges](https://msdn.microsoft.com/library/windows/desktop/aa446619(v=vs.85).aspx) were enabled or disabled for a specific account’s token. As of Windows 10, event 4703 is also logged by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from svchost.exe). If you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, you might need to disable Success auditing for this subcategory (Audit Authorization Policy Change), or work with a very high volume of event 4703. > **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. @@ -185,7 +185,7 @@ Token privileges provide the ability to take certain system-level actions that y For 4703(S): A user right was adjusted. -As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from svchost.exe). If you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, you might need to disable Success auditing for this subcategory, [Audit Authorization Policy Change](audit-authorization-policy-change.md), or work with a very high volume of event 4703. +As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from svchost.exe). If you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, you might need to disable Success auditing for this subcategory, [Audit Authorization Policy Change](audit-authorization-policy-change.md), or work with a very high volume of event 4703. Otherwise, see the recommendations in the following table. diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index 1edd7842a6..3344f60ecf 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -43,7 +43,7 @@ To enable HVCI on Windows 10 devices with supporting hardware throughout an ente - [Windows Security app](#windows-security-app) - [Microsoft Intune (or another MDM provider)](#enable-hvci-using-intune) - [Group Policy](#enable-hvci-using-group-policy) -- [System Center Configuration Manager](https://cloudblogs.microsoft.com/enterprisemobility/2015/10/30/managing-windows-10-device-guard-with-configuration-manager/) +- [Microsoft Endpoint Configuration Manager](https://cloudblogs.microsoft.com/enterprisemobility/2015/10/30/managing-windows-10-device-guard-with-configuration-manager/) - [Registry](#use-registry-keys-to-enable-virtualization-based-protection-of-code-integrity) ### Windows Security app diff --git a/windows/security/threat-protection/get-support-for-security-baselines.md b/windows/security/threat-protection/get-support-for-security-baselines.md index d9eda2847f..81f5a796f3 100644 --- a/windows/security/threat-protection/get-support-for-security-baselines.md +++ b/windows/security/threat-protection/get-support-for-security-baselines.md @@ -40,7 +40,7 @@ The toolkit supports formats created by the Windows GPO backup feature (.pol, .i Not yet. PowerShell-based DSC is rapidly gaining popularity, and more DSC tools are coming online to convert GPOs and DSC and to validate system configuration. We are currently developing a tool to provide customers with these features. -**Does SCT support the creation of System Center Configuration Manager (SCCM) DCM packs?** +**Does SCT support the creation of Microsoft Endpoint Configuration Manager DCM packs?** No. A potential alternative is Desired State Configuration (DSC), a feature of the [Windows Management Framework](https://www.microsoft.com/download/details.aspx?id=40855). A tool that supports conversion of GPO backups to DSC format can be found [here](https://github.com/Microsoft/BaselineManagement). diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 772ce99ae9..fee9236275 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -81,7 +81,7 @@ The "engine version" of attack surface reduction events in the event log, is gen ## Attack surface reduction rules -The following sections describe each of the 15 attack surface reduction rules. This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use System Center Configuration Manager or Microsoft Intune, you do not need the GUIDs: +The following sections describe each of the 15 attack surface reduction rules. This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs: Rule name | GUID | File & folder exclusions -----------|------|-------------------------- @@ -261,7 +261,7 @@ This rule blocks processes through PsExec and WMI commands from running, to prev > File and folder exclusions do not apply to this attack surface reduction rule. > [!WARNING] -> Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [System Center Configuration Manager](https://docs.microsoft.com/sccm) because this rule blocks WMI commands the SCCM client uses to function correctly. +> Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/sccm) because this rule blocks WMI commands the SCCM client uses to function correctly. This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019 diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md index 958a83f654..8fc126288e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md @@ -1,7 +1,7 @@ --- title: Configure Threat & Vulnerability Management in Microsoft Defender ATP ms.reviewer: -description: Configure your Threat & Vulnerability Management to allow security administrators and IT administrators to collaborate seamlessly to remediate issues via Microsoft intune and Microsoft System Center Configuration Manager (SCCM) integrations. +description: Configure your Threat & Vulnerability Management to allow security administrators and IT administrators to collaborate seamlessly to remediate issues via Microsoft intune and Microsoft Endpoint Configuration Manager integrations. keywords: RBAC, Threat & Vulnerability Management configuration, Threat & Vulnerability Management integrations, Microsft Intune integration with TVM, SCCM integration with TVM search.product: Windows 10 search.appverid: met150 @@ -23,13 +23,13 @@ ms.topic: article [!include[Prerelease information](../../includes/prerelease.md)] -This section guides you through the steps you need to take to configure Threat & Vulnerability Management's integration with Microsoft Intune or Microsoft System Center Configuration Manager (SCCM) for a seamless collaboration of issue remediation. +This section guides you through the steps you need to take to configure Threat & Vulnerability Management's integration with Microsoft Intune or Microsoft Endpoint Configuration Manager for a seamless collaboration of issue remediation. ### Before you begin > [!IMPORTANT] > Threat & Vulnerability Management data currently supports Windows 10 machines. Upgrade to Windows 10 to account for the rest of your devices’ threat and vulnerability exposure data.
      -Ensure that you have the right RBAC permissions to configure your Threat & Vulnerability Management integration with Microsoft Intune or Microsoft System Center Configuration Manager (SCCM). +Ensure that you have the right RBAC permissions to configure your Threat & Vulnerability Management integration with Microsoft Intune or Microsoft Endpoint Configuration Manager. >[!WARNING] >Only Intune and SCCM enrolled devices are supported in this scenario.
      diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md index 2373d0cf56..2cdb364929 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md @@ -23,7 +23,7 @@ ms.date: 07/01/2018 You can configure attack surface reduction with a number of tools, including: * Microsoft Intune -* System Center Configuration Manager +* Microsoft Endpoint Configuration Manager * Group Policy * PowerShell cmdlets diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md index 367c0685a8..00b5ca0b72 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md @@ -150,7 +150,7 @@ With Group Policy there isn’t an option to monitor deployment of policies on t ## Related topics -- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm.md) +- [Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) - [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md) - [Onboard Windows 10 machines using a local script](configure-endpoints-script.md) - [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md index a91da9ad8c..09cd520b12 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md @@ -86,7 +86,7 @@ For more information on Microsoft Intune policy settings see, [Windows 10 policy ## Related topics - [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) -- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm.md) +- [Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) - [Onboard Windows 10 machines using a local script](configure-endpoints-script.md) - [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md) - [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md index 60b3f33af2..58d233ccda 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md @@ -1,6 +1,6 @@ --- -title: Onboard Windows 10 machines using System Center Configuration Manager -description: Use System Center Configuration Manager to deploy the configuration package on machines so that they are onboarded to the service. +title: Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager +description: Use Microsoft Endpoint Configuration Manager to deploy the configuration package on machines so that they are onboarded to the service. keywords: onboard machines using sccm, machine management, configure Windows ATP machines, configure Microsoft Defender Advanced Threat Protection machines, sccm search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 12/11/2018 --- -# Onboard Windows 10 machines using System Center Configuration Manager +# Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager **Applies to:** @@ -31,8 +31,8 @@ ms.date: 12/11/2018 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointssccm-abovefoldlink) -## Onboard Windows 10 machines using System Center Configuration Manager (current branch) version 1606 -System Center Configuration Manager (SCCM) (current branch) version 1606, has UI integrated support for configuring and managing Microsoft Defender ATP on machines. For more information, see Support for Microsoft Defender Advanced Threat Protection service. +## Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager (current branch) version 1606 +Microsoft Endpoint Configuration Manager (current branch) version 1606, has UI integrated support for configuring and managing Microsoft Defender ATP on machines. For more information, see Support for Microsoft Defender Advanced Threat Protection service. >[!NOTE] > If you’re using SCCM client version 1606 with server version 1610 or above, you must upgrade the client version to match the server version. @@ -40,15 +40,15 @@ System Center Configuration Manager (SCCM) (current branch) version 1606, has UI -## Onboard Windows 10 machines using System Center Configuration Manager earlier versions -You can use existing System Center Configuration Manager functionality to create a policy to configure your machines. This is supported in the following System Center Configuration Manager versions: +## Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager earlier versions +You can use existing Microsoft Endpoint Configuration Manager functionality to create a policy to configure your machines. This is supported in the following Microsoft Endpoint Configuration Manager versions: - System Center 2012 Configuration Manager - System Center 2012 R2 Configuration Manager -- System Center Configuration Manager (current branch), version 1511 -- System Center Configuration Manager (current branch), version 1602 +- Microsoft Endpoint Configuration Manager (current branch), version 1511 +- Microsoft Endpoint Configuration Manager (current branch), version 1602 -### Onboard machines using System Center Configuration Manager +### Onboard machines using Microsoft Endpoint Configuration Manager 1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): @@ -76,7 +76,7 @@ You can use existing System Center Configuration Manager functionality to create ### Configure sample collection settings For each machine, you can set a configuration value to state whether samples can be collected from the machine when a request is made through Microsoft Defender Security Center to submit a file for deep analysis. -You can set a compliance rule for configuration item in System Center Configuration Manager to change the sample share setting on a machine. +You can set a compliance rule for configuration item in Microsoft Endpoint Configuration Manager to change the sample share setting on a machine. This rule should be a *remediating* compliance rule configuration item that sets the value of a registry key on targeted machines to make sure they’re complaint. The configuration is set through the following registry key entry: @@ -94,11 +94,11 @@ Possible values are: The default value in case the registry key doesn’t exist is 1. -For more information about System Center Configuration Manager Compliance see [Get started with compliance settings in System Center Configuration Manager](https://docs.microsoft.com/sccm/compliance/get-started/get-started-with-compliance-settings). +For more information about Microsoft Endpoint Configuration Manager Compliance see [Get started with compliance settings in Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/sccm/compliance/get-started/get-started-with-compliance-settings). -## Offboard machines using System Center Configuration Manager +## Offboard machines using Microsoft Endpoint Configuration Manager For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. @@ -111,7 +111,7 @@ For security reasons, the package used to Offboard machines will expire 30 days b. Select Windows 10 as the operating system. - c. In the **Deployment method** field, select **System Center Configuration Manager 2012/2012 R2/1511/1602**. + c. In the **Deployment method** field, select **Microsoft Endpoint Configuration Manager 2012/2012 R2/1511/1602**. d. Click **Download package**, and save the .zip file. @@ -147,7 +147,7 @@ If there are failed deployments (machines with **Error**, **Requirements Not Met ![SCCM showing successful deployment with no errors](images/sccm-deployment.png) **Check that the machines are compliant with the Microsoft Defender ATP service:**
      -You can set a compliance rule for configuration item in System Center Configuration Manager to monitor your deployment. +You can set a compliance rule for configuration item in Microsoft Endpoint Configuration Manager to monitor your deployment. This rule should be a *non-remediating* compliance rule configuration item that monitors the value of a registry key on targeted machines. @@ -157,7 +157,7 @@ Path: “HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status” Name: “OnboardingState” Value: “1” ``` -For more information about System Center Configuration Manager Compliance see [Get started with compliance settings in System Center Configuration Manager](https://docs.microsoft.com/sccm/compliance/get-started/get-started-with-compliance-settings). +For more information about Microsoft Endpoint Configuration Manager Compliance see [Get started with compliance settings in Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/sccm/compliance/get-started/get-started-with-compliance-settings). ## Related topics - [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md index f290c1d7b3..baa161a42c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md @@ -136,7 +136,7 @@ Monitoring can also be done directly on the portal, or by using the different de ## Related topics - [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) -- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm.md) +- [Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) - [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md) - [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md) - [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 5a8e0475ca..b2f53da88a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -94,7 +94,7 @@ The following steps will guide you through onboarding VDI machines and will high ## Related topics - [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) -- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm.md) +- [Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) - [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md) - [Onboard Windows 10 machines using a local script](configure-endpoints-script.md) - [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) From 5c6cdcc0728223d5d9992ee946738670d821d6d6 Mon Sep 17 00:00:00 2001 From: Ar5ham <1656076+Ar5ham@users.noreply.github.com> Date: Wed, 8 Jan 2020 16:52:47 -0800 Subject: [PATCH 004/374] Fix device-based data delete OS Version This change fixes the device-based data delete OS Version. --- windows/privacy/windows-10-and-privacy-compliance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 47ce5b00ee..336dd73096 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -142,7 +142,7 @@ Windows 10, version 1803 and later, allows users to change their diagnostic data #### 2.3.7 Diagnostic data: Managing device-based data delete -Windows 10, version 1809 and later, allows a user to delete diagnostic data collected from their device by going into **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. An IT administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. +Windows 10, version 1803 and later, allows a user to delete diagnostic data collected from their device by going into **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. An IT administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. An administrator can disable a user’s ability to delete their device’s diagnostic data by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Disable deleting diagnostic data** or the MDM policy `DisableDeviceDelete`. From 1401fa7938bd94b31128dc723bd7e0446c5ea82f Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Fri, 10 Jan 2020 14:28:11 -0800 Subject: [PATCH 005/374] Add flash device locked by others to HoloLens FAQs @scooley @yannisle Adding how to recover a HoloLens if locked out of a device. --- devices/hololens/hololens-FAQ.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/devices/hololens/hololens-FAQ.md b/devices/hololens/hololens-FAQ.md index a183165e4a..e11c2611e8 100644 --- a/devices/hololens/hololens-FAQ.md +++ b/devices/hololens/hololens-FAQ.md @@ -45,6 +45,7 @@ This FAQ addresses the following questions and issues: - [My HoloLens isn't running well, is unresponsive, or won't start](#my-hololens-isnt-running-well-is-unresponsive-or-wont-start) - [How do I delete all spaces?](#how-do-i-delete-all-spaces) - [I cannot find or use the keyboard to type in the HoloLens 2 Emulator](#i-cannot-find-or-use-the-keyboard-to-type-in-the-hololens-2-emulator) +- [I can't log in to a HoloLens because it was previously set up for someone else](#I-cant-log-in-to-a-HoloLens-because-it-was-previously-set-up-for-someone-else) ## My holograms don't look right or are moving around @@ -204,6 +205,14 @@ If your device isn't performing properly, see [Restart, reset, or recover HoloLe [Back to list](#list) +## I can't log in to a HoloLens because it was previously set up for someone else + +If your device was previously set up for someone else, either a client or former employee and you don't have their password to unlock the device there are two solutions. +- If your device is MDM managed by Intune then you can remotely [Wipe](/IntuneDocs/intune/remote-actions/devices-wipe/) the device and it'll reflash itself. Make sure to leave **Retain enrollment state and user account** unchecked. +- If you have the device with you then you can put the device into **Flashing Mode** and use Advanced Recovery Companion to [recover](https://review.docs.microsoft.com/hololens/hololens-recovery?branch=master#hololens-2) the device. + +[Back to list](#list) + ## How do I delete all spaces? *Coming soon* @@ -215,3 +224,4 @@ If your device isn't performing properly, see [Restart, reset, or recover HoloLe *Coming soon* [Back to list](#list) + From 2536efd15744eb0816bc42c1fa2d263806cd0857 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Jan 2020 10:20:16 +0500 Subject: [PATCH 006/374] Update mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md index 38aa4137f3..f259ca9362 100644 --- a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md +++ b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md @@ -32,7 +32,7 @@ Verify you have a current documentation of your MBAM environment, including all 4. Using the MBAM Configurator; re-add the Reports role 5. Using the MBAM Configurator; re-add the SQL Database role on the SQL Server. 6. At the end, you will be warned that the DBs already exist and weren’t created, but this is expected. -7. This process updates the existing databases to the current version being installed +7. This process updates the existing databases to the current version being installed. #### Steps to upgrade the MBAM Server (Running MBAM and IIS) 1. Using the MBAM Configurator; remove the Admin and Self Service Portals from the IIS server From 8231d8403069794acf1e2e76b3db21d2e8ed8203 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Jan 2020 10:20:27 +0500 Subject: [PATCH 007/374] Update mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md index f259ca9362..46e122559e 100644 --- a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md +++ b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md @@ -39,7 +39,7 @@ Verify you have a current documentation of your MBAM environment, including all 2. Install MBAM 2.5 SP1 3. Do not configure it at this time   4. Using the MBAM Configurator; re-add the Admin and Self Service Portals to the IIS server  -5. Open an elevated command prompt, type: **IISRESET** and hit Enter. +5. Open an elevated command prompt, type **IISRESET**, and hit Enter. #### Steps to upgrade the MBAM Clients/Endpoints 1. Uninstall the 2.5 Agent from client endpoints From 49b3e4e0bc836bf0cfc17fcbaf0c8add08e68188 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Jan 2020 10:20:40 +0500 Subject: [PATCH 008/374] Update mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md index 46e122559e..a666d5a4f7 100644 --- a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md +++ b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md @@ -26,7 +26,8 @@ Verify you have a current documentation of your MBAM environment, including all ### Upgrade steps #### Steps to upgrade the MBAM Database (SQL Server) 1. Using the MBAM Configurator; remove the Reports role from the SQL server, or wherever the SSRS database is hosted. Depending on your environment, this can be the same server or a separate one. - Note: You will not see an option to remove the Databases; this is expected. + > [!NOTE] + > You will not see an option to remove the Databases; this is expected. 2. Install 2.5 SP1 (Located with MDOP - Microsoft Desktop Optimization Pack 2015 from the Volume Licensing Service Center site: 3. Do not configure it at this time  4. Using the MBAM Configurator; re-add the Reports role From b7f996de87dbb9aededce83919490b70f188fc72 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Jan 2020 10:20:50 +0500 Subject: [PATCH 009/374] Update mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md index a666d5a4f7..d344cfc5be 100644 --- a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md +++ b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md @@ -31,7 +31,7 @@ Verify you have a current documentation of your MBAM environment, including all 2. Install 2.5 SP1 (Located with MDOP - Microsoft Desktop Optimization Pack 2015 from the Volume Licensing Service Center site: 3. Do not configure it at this time  4. Using the MBAM Configurator; re-add the Reports role -5. Using the MBAM Configurator; re-add the SQL Database role on the SQL Server. +5. Using the MBAM Configurator; re-add the SQL Database role on the SQL Server 6. At the end, you will be warned that the DBs already exist and weren’t created, but this is expected. 7. This process updates the existing databases to the current version being installed. From 9be0bfb0a4c8f099aa399ca5ef82e51bbd1a902c Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Jan 2020 10:21:01 +0500 Subject: [PATCH 010/374] Update mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md index d344cfc5be..436bbbe48d 100644 --- a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md +++ b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md @@ -32,7 +32,7 @@ Verify you have a current documentation of your MBAM environment, including all 3. Do not configure it at this time  4. Using the MBAM Configurator; re-add the Reports role 5. Using the MBAM Configurator; re-add the SQL Database role on the SQL Server -6. At the end, you will be warned that the DBs already exist and weren’t created, but this is expected. +6. At the end, you will be warned that the DBs already exist and weren’t created, but this is expected 7. This process updates the existing databases to the current version being installed. #### Steps to upgrade the MBAM Server (Running MBAM and IIS) From ab8ed1e2b75969b7e184c6c0b497a809bd741161 Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Tue, 14 Jan 2020 08:11:49 -0800 Subject: [PATCH 011/374] removing more instances of sccm --- .../virtual-smart-card-tpmvscmgr.md | 2 +- .../vpn/vpn-profile-options.md | 2 +- .../attack-surface-reduction.md | 54 +++++++++---------- .../configure-and-manage-tvm.md | 2 +- .../configure-endpoints-sccm.md | 2 +- .../offboard-machines.md | 2 +- 6 files changed, 32 insertions(+), 32 deletions(-) diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md index 3d5e75db74..bb1cf1508f 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md @@ -40,7 +40,7 @@ The Create command sets up new virtual smart cards on the user’s system. It re | /PUK | Indicates the desired PIN Unlock Key (PUK) value. The PUK value must be a minimum of eight characters, and it can contain numerals, characters, and special characters. If the parameter is omitted, the card is created without a PUK.
      **DEFAULT**  Specifies the default PUK of 12345678.
      **PROMPT**  Prompts the user to enter a PUK at the command line. | | /generate | Generates the files in storage that are necessary for the virtual smart card to function. If the /generate parameter is omitted, it is equivalent to creating a card without this file system. A card without a file system can be managed only by a smart card management system such as Microsoft Endpoint Configuration Manager. | | /machine | Allows you to specify the name of a remote computer on which the virtual smart card can be created. This can be used in a domain environment only, and it relies on DCOM. For the command to succeed in creating a virtual smart card on a different computer, the user running this command must be a member in the local administrators group on the remote computer. | -| /pinpolicy | If **/pin prompt** is used, **/pinpolicy** allows you to specify the following PIN policy options:
      **minlen** <minimum PIN length>
         If not specificed, defaults to 8. The lower bound is 4.
      **maxlen** <maximum PIN length>
         If not specificed, defaults to 127. The upper bound is 127.
      **uppercase**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
      **lowercase**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
      **digits**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
      **specialchars**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**

      When using **/pinpolicy**, PIN characters must be printable ASCII characters. | +| /pinpolicy | If **/pin prompt** is used, **/pinpolicy** allows you to specify the following PIN policy options:
      **minlen** <minimum PIN length>
         If not specified, defaults to 8. The lower bound is 4.
      **maxlen** <maximum PIN length>
         If not specified, defaults to 127. The upper bound is 127.
      **uppercase**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
      **lowercase**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
      **digits**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
      **specialchars**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**

      When using **/pinpolicy**, PIN characters must be printable ASCII characters. | | /attestation | Configures attestation (subject only). This attestation uses an [Attestation Identity Key (AIK) certificate](https://msdn.microsoft.com/library/mt766230.aspx#gt_89a2ba3c-80af-4d1f-88b3-06ec3489fd5a) as a trust anchor to vouch that the virtual smart card keys and certificates are truly hardware bound. The attestation methods are:
      **AIK_AND_CERT**  Creates an AIK and obtains an AIK certificate from the Microsoft cloud certification authority (CA). This requires the device to have a TPM with an [EK certificate](https://msdn.microsoft.com/library/cc249746.aspx#gt_6aaaff7f-d380-44fb-91d3-b985e458eb6d). If this option is specified and there is no network connectivity, it is possible that creation of the virtual smart card will fail.
      **AIK_ONLY**  Creates an AIK but does not obtain an AIK certificate. | | /? | Displays Help for this command. | diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index 5cce0122e6..3d0fdc211e 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -20,7 +20,7 @@ ms.date: 05/17/2018 - Windows 10 - Windows 10 Mobile -Most of the VPN settings in Windows 10 can be configured in VPN profiles using Microsoft Intune or Microsoft Endpoint Configuration Manager. All VPN settings in Windows 10 can be configued using the **ProfileXML** node in the [VPNv2 configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). +Most of the VPN settings in Windows 10 can be configured in VPN profiles using Microsoft Intune or Microsoft Endpoint Configuration Manager. All VPN settings in Windows 10 can be configured using the **ProfileXML** node in the [VPNv2 configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). >[!NOTE] >If you're not familiar with CSPs, read [Introduction to configuration service providers (CSPs)](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers) first. diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 1910697467..0da23ce0b5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -110,11 +110,11 @@ This rule blocks the following file types from launching from email in Microsoft * Executable files (such as .exe, .dll, or .scr) * Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) -This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Microsoft Endpoint Configuration Manager CB 1710 Intune name: Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions) -SCCM name: Block executable content from email client and webmail +Microsoft Endpoint Configuration Manager name: Block executable content from email client and webmail GUID: BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 @@ -124,11 +124,11 @@ This rule blocks Office apps from creating child processes. This includes Word, This is a typical malware behavior, especially malware that abuses Office as a vector, using VBA macros and exploit code to download and attempt to run additional payload. Some legitimate line-of-business applications might also use behaviors like this, including spawning a command prompt or using PowerShell to configure registry settings. -This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1710 Intune name: Office apps launching child processes -SCCM name: Block Office application from creating child processes +Configuration Manager name: Block Office application from creating child processes GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A @@ -138,11 +138,11 @@ This rule prevents Office apps, including Word, Excel, and PowerPoint, from crea This rule targets a typical behavior where malware uses Office as a vector to break out of Office and save malicious components to disk, where they persist and survive a computer reboot. This rule prevents malicious code from being written to disk. -This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1710 Intune name: Office apps/macros creating executable content -SCCM name: Block Office applications from creating executable content +Configuration Manager name: Block Office applications from creating executable content GUID: 3B576869-A4EC-4529-8536-B80A7769E899 @@ -152,11 +152,11 @@ Attackers might attempt to use Office apps to migrate malicious code into other This rule applies to Word, Excel, and PowerPoint. -This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1710 Intune name: Office apps injecting code into other processes (no exceptions) -SCCM name: Block Office applications from injecting code into other processes +Configuration Manager name: Block Office applications from injecting code into other processes GUID: 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 @@ -169,11 +169,11 @@ Malware written in JavaScript or VBS often acts as a downloader to fetch and lau > [!IMPORTANT] > File and folder exclusions don't apply to this attack surface reduction rule. -This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1710 Intune name: js/vbs executing payload downloaded from Internet (no exceptions) -SCCM name: Block JavaScript or VBScript from launching downloaded executable content +Configuration Manager name: Block JavaScript or VBScript from launching downloaded executable content GUID: D3E037E1-3EB8-44C8-A917-57927947596D @@ -181,11 +181,11 @@ GUID: D3E037E1-3EB8-44C8-A917-57927947596D Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. This rule detects suspicious properties within an obfuscated script. -This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1710 Intune name: Obfuscated js/vbs/ps/macro code -SCCM name: Block execution of potentially obfuscated scripts. +Configuration Manager name: Block execution of potentially obfuscated scripts. GUID: 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC @@ -193,11 +193,11 @@ GUID: 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC Office VBA provides the ability to use Win32 API calls, which malicious code can abuse. Most organizations don't use this functionality, but might still rely on using other macro capabilities. This rule allows you to prevent using Win32 APIs in VBA macros, which reduces the attack surface. -This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1710 Intune name: Win32 imports from Office macro code -SCCM name: Block Win32 API calls from Office macros +Configuration Manager name: Block Win32 API calls from Office macros GUID: 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B @@ -215,11 +215,11 @@ This rule blocks the following file types from launching unless they either meet > >You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to. -This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1802 Intune name: Executables that don't meet a prevalence, age, or trusted list criteria. -SCCM name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria +Configuration Manager name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25 @@ -230,11 +230,11 @@ This rule provides an extra layer of protection against ransomware. It scans exe > [!NOTE] > You must [enable cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) to use this rule. -This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1802 Intune name: Advanced ransomware protection -SCCM name: Use advanced protection against ransomware +Configuration Manager name: Use advanced protection against ransomware GUID: c1db55ab-c21a-4637-bb3f-a12568109d35 @@ -245,11 +245,11 @@ Local Security Authority Subsystem Service (LSASS) authenticates users who log i > [!NOTE] > In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that overly enumerates LSASS, you need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat. -This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1802 Intune name: Flag credential stealing from the Windows local security authority subsystem -SCCM name: Block credential stealing from the Windows local security authority subsystem +Configuration Manager name: Block credential stealing from the Windows local security authority subsystem GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 @@ -261,13 +261,13 @@ This rule blocks processes through PsExec and WMI commands from running, to prev > File and folder exclusions do not apply to this attack surface reduction rule. > [!WARNING] -> Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/sccm) because this rule blocks WMI commands the SCCM client uses to function correctly. +> Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr) because this rule blocks WMI commands the Configuration Manager client uses to function correctly. This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019 Intune name: Process creation from PSExec and WMI commands -SCCM name: Not applicable +Configuration Manager name: Not applicable GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c @@ -278,11 +278,11 @@ With this rule, admins can prevent unsigned or untrusted executable files from r * Executable files (such as .exe, .dll, or .scr) * Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) -This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1802 Intune name: Untrusted and unsigned processes that run from USB -SCCM name: Block untrusted and unsigned processes that run from USB +Configuration Manager name: Block untrusted and unsigned processes that run from USB GUID: b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 @@ -297,7 +297,7 @@ This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Serve Intune name: Process creation from Office communication products (beta) -SCCM name: Not yet available +Configuration Manager name: Not yet available GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869 @@ -309,7 +309,7 @@ This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Serve Intune name: Process creation from Adobe Reader (beta) -SCCM name: Not yet available +Configuration Manager name: Not yet available GUID: 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c @@ -321,7 +321,7 @@ This rule was introduced in: Windows 10 1903, Windows Server 1903 Intune name: Block persistence through WMI event subscription -SCCM name: Not yet available +Configuration Manager name: Not yet available GUID: e6db77e5-3df2-4cf1-b95a-636979351e5b diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md index 8fc126288e..b9b7d557f2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md @@ -32,7 +32,7 @@ This section guides you through the steps you need to take to configure Threat & Ensure that you have the right RBAC permissions to configure your Threat & Vulnerability Management integration with Microsoft Intune or Microsoft Endpoint Configuration Manager. >[!WARNING] ->Only Intune and SCCM enrolled devices are supported in this scenario.
      +>Only Intune and Microsoft Endpoint Configuration Manager enrolled devices are supported in this scenario.
      >Use any of the following options to enroll devices in Intune: >- IT Admin: For more information on how to enabling auto-enrollment, see [Windows Enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment) >- End-user: For more information on how to enroll your Windows 10 device in Intune, see [Enroll your Windows 10 device in Intune](https://docs.microsoft.com/intune-user-help/enroll-your-w10-device-access-work-or-school) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md index 58d233ccda..fa7fb26703 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md @@ -51,7 +51,7 @@ You can use existing Microsoft Endpoint Configuration Manager functionality to c ### Onboard machines using Microsoft Endpoint Configuration Manager -1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): +1. Open the Microsoft Endpoint Configuration Manager configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): a. In the navigation pane, select **Settings** > **Onboarding**. diff --git a/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md b/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md index 7d9e52a115..ea9ee7efc8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md @@ -34,7 +34,7 @@ Follow the corresponding instructions depending on your preferred deployment met ## Offboard Windows 10 machines - [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script) - [Offboard machines using Group Policy](configure-endpoints-gp.md#offboard-machines-using-group-policy) -- [Offboard machines using System Center Configuration Manager](configure-endpoints-sccm.md#offboard-machines-using-system-center-configuration-manager) +- [Offboard machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md#offboard-machines-using-system-center-configuration-manager) - [Offboard machines using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-and-monitor-machines-using-mobile-device-management-tools) ## Offboard Servers From 49335168da371468acc5d34550765e910c8b42a0 Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Tue, 14 Jan 2020 10:46:16 -0800 Subject: [PATCH 012/374] fixed bookmark --- .../microsoft-defender-atp/offboard-machines.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md b/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md index ea9ee7efc8..7f328014a1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md @@ -34,7 +34,7 @@ Follow the corresponding instructions depending on your preferred deployment met ## Offboard Windows 10 machines - [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script) - [Offboard machines using Group Policy](configure-endpoints-gp.md#offboard-machines-using-group-policy) -- [Offboard machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md#offboard-machines-using-system-center-configuration-manager) +- [Offboard machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md#offboard-machines-using-microsoft-endpoint-configuration-manager) - [Offboard machines using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-and-monitor-machines-using-mobile-device-management-tools) ## Offboard Servers From ade02d640aab2343d0d5af4b3a4d9cb7a34b1f05 Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Wed, 15 Jan 2020 08:18:22 -0800 Subject: [PATCH 013/374] reverted changes to reduce PR size --- .../identity-protection/hello-for-business/hello-faq.md | 4 ++-- .../hello-for-business/hello-how-it-works-technology.md | 2 +- .../hello-for-business/retired/hello-how-it-works.md | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.md b/windows/security/identity-protection/hello-for-business/hello-faq.md index 1a9054bdab..0cfbf47cc6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.md +++ b/windows/security/identity-protection/hello-for-business/hello-faq.md @@ -30,8 +30,8 @@ Microsoft is committed to its vision of a world without passwords. We rec ## Can I use Windows Hello for Business key trust and RDP? RDP currently does not support key based authentication and does not support self signed certificates. RDP with Windows Hello for Business is currently only supported with certificate based deployments. -## Can I deploy Windows Hello for Business using Microsoft Endpoint Configuration Manager? -Windows Hello for Business deployments using Microsoft Endpoint Configuration Manager need to move to the hybrid deployment model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager will no longer be supported after November 2018. +## Can I deploy Windows Hello for Business using System Center Configuration Manager? +Windows Hello for Business deployments using System Center Configuration Manager need to move to the hybrid deployment model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager will no longer be supported after November 2018. ## How many users can enroll for Windows Hello for Business on a single Windows 10 computer? The maximum number of supported enrollments on a single Windows 10 computer is 10. That enables 10 users to each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index 7de79a7f47..012051d5e2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -162,7 +162,7 @@ Primarily for large enterprise organizations with more complex authentication re For more than a decade, many organizations have used the domain join to their on-premises Active Directory to enable: - IT departments to manage work-owned devices from a central location. - Users to sign in to their devices with their Active Directory work or school accounts. -Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use Microsoft Endpoint Configuration Manager or group policy (GP) to manage them. +Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use System Center Configuration Manager (SCCM) or group policy (GP) to manage them. If your environment has an on-premises AD footprint and you also want benefit from the capabilities provided by Azure Active Directory, you can implement hybrid Azure AD joined devices. These are devices that are both, joined to your on-premises Active Directory and your Azure Active Directory. diff --git a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md index 928bd61ac1..00b0bd2e95 100644 --- a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md @@ -97,7 +97,7 @@ Windows Hello depends on having compatible IDPs available to it. As of this writ - Use an existing Windows-based PKI centered around Active Directory Certificate Services. This option requires additional infrastructure, including a way to issue certificates to users. You can use NDES to register devices directly, or Microsoft Intune where it’s available to manage mobile device participation in Windows Hello. - The normal discovery mechanism that clients use to find domain controllers and global catalogs relies on Domain Name System (DNS) SRV records, but those records don’t contain version data. Windows 10 computers will query DNS for SRV records to find all available Active Directory servers, and then query each server to identify those that can act as Windows Hello IDPs. The number of authentication requests your users generate, where your users are located, and the design of your network all drive the number of Windows Server 2016 domain controllers required. -- Azure AD can act as an IDP either by itself or alongside an on-premises AD DS forest. Organizations that use Azure AD can register devices directly without having to join them to a local domain by using the capabilities the Azure AD Device Registration service provides. In addition to the IDP, Windows Hello requires an MDM system. This system can be the cloud-based Intune if you use Azure AD, or an on-premises Microsoft Endpoint Configuration Manager deployment that meets the system requirements described in the Deployment requirements section of this document. +- Azure AD can act as an IDP either by itself or alongside an on-premises AD DS forest. Organizations that use Azure AD can register devices directly without having to join them to a local domain by using the capabilities the Azure AD Device Registration service provides. In addition to the IDP, Windows Hello requires an MDM system. This system can be the cloud-based Intune if you use Azure AD, or an on-premises System Center Configuration Manager deployment that meets the system requirements described in the Deployment requirements section of this document. From fbaf442859209145ede31c4e54faa0cd82a82e31 Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Wed, 15 Jan 2020 13:47:08 -0800 Subject: [PATCH 014/374] typo correction --- .../microsoft-defender-atp/configure-endpoints-sccm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md index fa7fb26703..9d5b9eaded 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md @@ -41,7 +41,7 @@ Microsoft Endpoint Configuration Manager (current branch) version 1606, has UI i ## Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager earlier versions -You can use existing Microsoft Endpoint Configuration Manager functionality to create a policy to configure your machines. This is supported in the following Microsoft Endpoint Configuration Manager versions: +You can use existing Microsoft Endpoint Configuration Manager functionality to create a policy to configure your machines. This is supported in the following Configuration Manager versions: - System Center 2012 Configuration Manager - System Center 2012 R2 Configuration Manager From 888e3d7fda989f69240e58f5a3f26c89039ab18a Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Thu, 16 Jan 2020 11:04:22 -0800 Subject: [PATCH 015/374] typo test --- .../threat-protection/microsoft-defender-atp/management-apis.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/management-apis.md b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md index e23db78609..2878eb7e12 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/management-apis.md +++ b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md @@ -43,7 +43,7 @@ The Microsoft Defender ATP solution is built on top of an integration-ready plat Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Microsoft Defender ATP capabilities. -![Image of available API and integration in Microsoft Defender ATP](images/mdatp-apis.png) +![Image of available API and integration in Microsoft Defender ATP](images/mdatp-apis.png) The Microsoft Defender ATP APIs can be grouped into three: - Microsoft Defender ATP APIs From fa10573e0c682d4cf5d821930d2c6a82cbb6e3f2 Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Thu, 16 Jan 2020 11:09:27 -0800 Subject: [PATCH 016/374] second typo test --- .../threat-protection/microsoft-defender-atp/management-apis.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/management-apis.md b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md index 2878eb7e12..3106011785 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/management-apis.md +++ b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md @@ -43,7 +43,7 @@ The Microsoft Defender ATP solution is built on top of an integration-ready plat Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Microsoft Defender ATP capabilities. -![Image of available API and integration in Microsoft Defender ATP](images/mdatp-apis.png) +![Image of available API and integration in Microsoft Defender ATP](images/mdatp-apis.png) The Microsoft Defender ATP APIs can be grouped into three: - Microsoft Defender ATP APIs From 1eef3bb47641c1bf714ede773351ad122f3017f5 Mon Sep 17 00:00:00 2001 From: Anca-Ioana Martin <48067601+ancmarti@users.noreply.github.com> Date: Fri, 17 Jan 2020 13:23:24 +0200 Subject: [PATCH 017/374] Documenting known-issue with MSA service --- windows/client-management/mdm/policy-csp-accounts.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index e978cc82da..f097cc7b37 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -232,6 +232,9 @@ Added in Windows 10, version 1703. Allows IT Admins the ability to disable the " > [!NOTE] > If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). +> [!NOTE] +> If the MSA service is disabled, the Subscription Activation feature will not work properly and your users will not be able to “step-up” from Windows 10 Pro to Windows 10 Enterprise, because the MSA ticket for license authentication cannot be generated. The machine will remain on Windows 10 Pro and no error will be displayed in the Activation Settings app. + The following list shows the supported values: From a7bd6004a55f954a354103ccd29449b414435374 Mon Sep 17 00:00:00 2001 From: Todd Lyon <19413953+tmlyon@users.noreply.github.com> Date: Fri, 17 Jan 2020 10:28:18 -0800 Subject: [PATCH 018/374] Update manage-windows-mixed-reality.md Updated to clarify the 1903 FOD also supports 1909 --- windows/application-management/manage-windows-mixed-reality.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/manage-windows-mixed-reality.md b/windows/application-management/manage-windows-mixed-reality.md index 205e2c3711..4e0bc2998e 100644 --- a/windows/application-management/manage-windows-mixed-reality.md +++ b/windows/application-management/manage-windows-mixed-reality.md @@ -33,7 +33,7 @@ Organizations that use Windows Server Update Services (WSUS) must take action to 2. Windows Mixed Reality Feature on Demand (FOD) is downloaded from Windows Update. If access to Windows Update is blocked, you must manually install the Windows Mixed Reality FOD. - a. Download the FOD .cab file for [Windows 10, version 1903](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab), [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](https://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab). + a. Download the FOD .cab file for [Windows 10, version 1903 and 1909](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab), [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](https://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab). >[!NOTE] >You must download the FOD .cab file that matches your operating system version. From ffac4218c81eca1f6b22f2e4cf63e0ae776d308b Mon Sep 17 00:00:00 2001 From: jaimeo Date: Fri, 17 Jan 2020 13:47:34 -0800 Subject: [PATCH 019/374] completion of initial incorp --- .../deployment/update/media-dynamic-update.md | 453 ++++++++++++++++++ 1 file changed, 453 insertions(+) create mode 100644 windows/deployment/update/media-dynamic-update.md diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md new file mode 100644 index 0000000000..bbfce9826f --- /dev/null +++ b/windows/deployment/update/media-dynamic-update.md @@ -0,0 +1,453 @@ +--- +title: Update Windows 10 media with Dynamic Update +description: Learn how to deploy feature updates to your mission critical devices +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Update Windows 10 media with Dynamic Update + +**Applies to**: Windows 10 + +This topic explains how to acquire and apply Dyanmic Update packages to existing Windows 10 images and includes Windows Powershell scripts you can use to automate this. + +Volume-licensed media is available for each release of Windows 10 in the Volume Licensing Service Center (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. You can use Dynamic Update to ensure that their Windows 10 devices have the latest feature update content as part of an in-place upgrade while preserving language pack and features on demand (FODs) that might have been previously installed. Dynamic Update also eliminates the need to install a separate quality update as part of the in-place upgrade process. + +## Dynamic Update + +Whenever installation of a feature update starts (whether from media or an environment connected to Windows Update), *dynamic update* is one of the first steps. Windows 10 setup contacts a Microsoft endpoint to fetch dynamic update contant, and then applies those updates to your operating system installation media. The update content includes the following: + +- Updates to Setup.exe binaries or other files that Setup uses for feature updates +- Updates for the "safe operating system" that is used for the Windows recovery environment +- Updates to the servicing stack +- The latest cumulative (quality) update +- Updates to applicable drivers already published by manufacturers + +Dynamic Update preserves language pack and features on demand content by reacquiring them. + +Devices must be able to connect to the internet to obtain Dynamic Updates. You can still do a media-based feature update by acquiring Dynamic Update content and applying it to the image prior to starting Setup on the device. + +## Acquire Dynamic Update content + +You can obtain Dynamic Update content from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx). At that site, use the search bar in the upper right to find the Dynamic Update options for a particular release. For example, you could enter *1809 Dynamic Update*, which would return results like this: + + + +The various Dynamic Update components should all be present in the search results, but you'll need to check various parts of the results to be sure you've identified the needed files. This table shows the key items to check for each of the Dynamic Update components in **bold**. For example, to find the relevant Dynamic Update for Setup, you'll have to check the detailed description for the download by selecting the link in the **Title** column of the search results. + + +|To find this Dynamic Update content, check the results here--> |Title |Product |Description (select the **Title** link to see **Details**) | +|---------|---------|---------|---------| +|Safe operating system Dynamic Update | 2019-08 Dynamic Update... | Windows 10 Dynamic Update,Windows **Safe OS Dynamic Update** | ComponentUpdate: | +|Setup Dynamic Update | 2019-08 Dynamic Update... | Windows 10 Dynamic Update | **SetupUpdate** | +|Latest cumulative update | 2019-08 **Cumulative Update for Windows 10** | Windows 10 | Install this update to resolve issues in Windows... | +|Servicing stack update | 2019-09 **Servicing Stack Update for Windows 10** | Windows 10... | Install this update to resolve issues in Windows... | + +If you want to customize the image with additional languages {"additional" meaning vs. languages in the existing image?} or features, you'll need download supplemental media ISO files from the [Volume Licensing Service Center](https://www.microsoft.com/licensing/servicecenter/default.aspx). For example, since Dynamic Update will be disabled for your devices, and should users require specific FODs, these can be preinstalled into the image. {???}{also, doesn't this duplicate the "customizing...additional language" section below?} + +## Update Windows 10 installation media + +Properly updating the installation media involves a large number of actions operating on several different targets (image files). Some actions are repeated on different targets. The target images files include: + +- Windows Preinstallation Environment (WinPE): a small operating system used to install, deploy, and repair Windows operating systems +- Windows Recovery Environment: repairs common causes of unbootable operating systems. WinRE is based on WinPE and can be customized with additional drivers, languages, optional packages, and other troubleshooting or diagnostic tools. +- Windows operating system: one or more editions of Widnows 10 stored in \sources\install.wim +- Windows installation media: the complete collection of files and folders in the Windows 10 installation media. For example, \sources folder, \boot folder, setup.exe, etc. + +This table shows the correct sequence for applying the various tasks to the files. For example, the full sequence starts with adding the servicing stack update to WinRE (1) and concludes with adding the Dynamic Update for Setup to the new media (27). + +|Task |WinRE (winre.wim) |WinPE (boot.wim) |Operating system (install.wim) | New media | +|---------|---------|---------|---------|------| +|Add servicing stack Dynamic Update | 1 | 9 | 18 | +|Add language pack | 2 | 10 | 19 | +|Add localized optional packages | 3 | 11 | | +|Add font support | 4 | 12 | | +|Add TTS support {what's this?} | 5 | 13 | | +|Update Lang.ini | | 14 | | +|Add features on demand | | | 20 | +|Add "safe operating system" Dynamic Update | 6 | | {21??} | +|Add Setup Dynamic Update | | | | 27 +|Add latest cumulative update | | 15 | 22 | +|Clean image {a verb?} | 7 | 16 | 23 | +|Add optional components | | | 24 | +|Add .Net and cumulative updates | | | 25 | +|Export image | 8 | 17 | 26 | + +### Multiple Windows editions + +The main operating system file (install.wim) contains multiple editions of Windows 10. It’s possible that only an update for a given edition is required to deploy it, based on the index. Or, it might be that all editions need an update. Further, ensure that languages are installed before FODs, and the latest cumulative update is always applied last. + +### Additional languages and features + +You don't have to add more languages and features to the image to accomplish the udpates, but it is an opportunity to customize the image with more languages, optional components, and features beyond what is in your starting image. To do this, it's important to make these changes in the correct order: first apply updates, followed by language additions, then by featre additions, and finally the latest cumulative update. The provided sample script installs a second language (in this case Japanese (ja-JP)). Since this language is backed by an lp.cab there's no need to add a Language Experience Pack. Japanese is added to both the main operating system and to the recovery environment to allow the user to see the recovery screens in Japanese. This includes adding localized versions of the packages currently installed in the recovery image. + +Optional components, along with the .Net feature can be installed offline, however doing so creates pending operations that require the device to restart. As a result, the call to perform image cleanup would fail. There are two options to avoid this. One option is to skip the image cleanup step, though that will result in a larger install.wim. Another option is to install the .Net and optional components in a step after cleanup but before export. This is the option in the sample script. By doing this, you will have to start with the original install.wim (with no pending actions) when you maintain or update the image the next time (for example, the next month). + +## Windows PowerShell scripts to apply Dynamic Updates to an existing image + +These examples are for illustration only, and therefore lacks error handling. The script assumes that the following content is stored locally in this folder structure: + + +|Folder |Description | +|---------|---------| +|C:\mediaRefresh | Parent folder that contains the PowerShell script | +|C:\mediaRefresh\oldMedia | Folder that contains the original media that will be refreshed. For example, contains setup.exe, and \sources folder. | +|C:\mediaRefresh\newMedia | Folder that will contain the updated media. It is copied from \oldMedia, then used as the target for all update and cleanup operations. | + +### Get started + +The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there is a script error and it's necessary to start over from a known state. Also, it will provide a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they are not read-only. + +```powershell +function Get-TS { return "{0:HH:mm:ss}" -f (Get-Date) } + +Write-Host "$(Get-TS): Starting media refresh" + +# Declare media for FOD and LPs +$FOD_ISO_PATH = "C:\mediaRefresh\packages\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso" +$LP_ISO_PATH = "C:\mediaRefresh\packages\CLIENTLANGPACKDVD_OEM_MULTI.iso" + +# Declare language for showcasing adding optional localized components +$LANG = "ja-jp" +$LANG_FONT_CAPABILITY = "jpan" + +# Declare Dynamic Update packages +$LCU_PATH = “C:\mediaRefresh\packages\LCU.msu” +$SSU_PATH = “C:\mediaRefresh\packages\SSU_DU.msu” +$SETUP_DU_PATH = "C:\mediaRefresh\packages\Setup_DU.cab" +$SAFE_OS_DU_PATH = “C:\mediaRefresh\packages\SafeOS_DU.cab” +$DOTNET_CU_PATH = "C:\mediaRefresh\packages\DotNet_CU.msu” + +# Declare folders for mounted images and temp files +$WORKING_PATH = "C:\mediaRefresh\temp" +$MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia" +$MEDIA_NEW_PATH = "C:\mediaRefresh\newMedia" +$MAIN_OS_MOUNT = $WORKING_PATH + "\MainOSMount” +$WINRE_MOUNT = $WORKING_PATH + "\WinREMount” +$WINPE_MOUNT = $WORKING_PATH + "\WinPEMount” + +# Mount the LP ISO +Write-Host "$(Get-TS): Mounting LP ISO" +$LP_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter + +# Declare language related cabs +$WINPE_OC_PATH = Join-Path $LP_ISO_DRIVE_LETTER":" -ChildPath "Windows Preinstallation Environment" | Join-Path -ChildPath "x64" | Join-Path -ChildPath "WinPE_OCs" +$WINPE_OC_LANG_PATH = Join-Path $WINPE_OC_PATH $LANG +$WINPE_OC_LANG_CABS = Get-ChildItem $WINPE_OC_LANG_PATH -name +$WINPE_OC_LP_PATH = Join-Path $WINPE_OC_LANG_PATH "lp.cab" +$WINPE_FONT_SUPPORT_PATH = Join-Path $WINPE_OC_PATH "WinPE-FontSupport-$LANG.cab" +$WINPE_SPEECH_TTS_PATH = Join-Path $WINPE_OC_PATH "WinPE-Speech-TTS.cab" +$WINPE_SPEECH_TTS_LANG_PATH = Join-Path $WINPE_OC_PATH "WinPE-Speech-TTS-$LANG.cab" +$OS_LP_PATH = $LP_ISO_DRIVE_LETTER + ":\x64\langpacks\" + "Microsoft-Windows-Client-Language-Pack_x64_" + $LANG + ".cab" + +# Mount the FOD ISO +Write-Host "$(Get-TS): Mounting FOD ISO" +$FOD_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter +$FOD_PATH = $FOD_ISO_DRIVE_LETTER + ":\" + +# Create folders for mounting images and storing temporary files +New-Item -ItemType directory -Path $WORKING_PATH -ErrorAction Stop | Out-Null +New-Item -ItemType directory -Path $MAIN_OS_MOUNT -ErrorAction stop | Out-Null +New-Item -ItemType directory -Path $WINRE_MOUNT -ErrorAction stop | Out-Null +New-Item -ItemType directory -Path $WINPE_MOUNT -ErrorAction stop | Out-Null + +# Keep the original media, make a copy of it for the new, updateed media. +Write-Host "$(Get-TS): Copying original media to new media path" +Copy-Item -Path $MEDIA_OLD_PATH“\*” -Destination $MEDIA_NEW_PATH -Force -Recurse -ErrorAction stop | Out-Null +Get-ChildItem -Path $MEDIA_NEW_PATH -Recurse | Where-Object { -not $_.PSIsContainer -and $_.IsReadOnly } | ForEach-Object { $_.IsReadOnly = $false } +``` +### Update WinRE + +The script assumes that only a single edition is being updated, indicated by Index = 1 (Windows 10 Education Edition). Then the script mounts the image, saves Winre.wim to the working folder, and mounts it. It then applies servicing stack Dynamic Update, since its components are used for updating other components. Since the script is optionally adding Japanese, it adds the language pack to the image, and installs the Japanese versions of all optional packages already installed in Winre.wim. Then, it applies the safe operating system Dynamic Update package. + +It finishes by cleaning and exporting the image to reduce the image size. + +> [!NOTE] +> Skip adding the latest cumulative update to Winre.wim because it contains unnecessary components in the recovery environment. The components that are updated and applicable are contained in the safe operating system Dynamic Update package. This also helps to keep the image small. + +```powershell +# Mount the main OS, I'll use this throughout the script +Write-Host "$(Get-TS): Mounting main OS" +Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim” -Index 1 -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null + +# +# update Windows Recovery Environment (WinRE) +# +Copy-Item -Path $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim” -Destination $WORKING_PATH"\winre.wim” -Force -Recurse -ErrorAction stop | Out-Null +Write-Host "$(Get-TS): Mounting WinRE" +Mount-WindowsImage -ImagePath $WORKING_PATH"\winre.wim” -Index 1 -Path $WINRE_MOUNT -ErrorAction stop | Out-Null + +# Add SSU +Write-Host "$(Get-TS): Adding package $SSU_PATH" +Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null + +# +# Optional: Add the language to recovery environment +# +# Install lp.cab cab +Write-Host "$(Get-TS): Adding package $WINPE_OC_LP_PATH" +Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null + +# Install language cabs for each optional package installed +$WINRE_INSTALLED_OC = Get-WindowsPackage -Path $WINRE_MOUNT +Foreach ($PACKAGE in $WINRE_INSTALLED_OC) { + + if ( ($PACKAGE.PackageState -eq "Installed") ` + -and ($PACKAGE.PackageName.startsWith("WinPE-")) ` + -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) { + + $INDEX = $PACKAGE.PackageName.IndexOf("-Package") + if ($INDEX -ge 0) { + $OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab" + if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) { + $OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB + Write-Host "$(Get-TS): Adding package $OC_CAB_PATH" + Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null + } + } + } +} + +# Add font support for the new language +if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { + Write-Host "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" + Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null +} + +# Add TTS support for the new language +if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) { + if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) { + + Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" + Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null + + Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" + Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null + } +} + +# Add Safe OS +Write-Host "$(Get-TS): Adding package $SAFE_OS_DU_PATH" +Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SAFE_OS_DU_PATH -ErrorAction stop | Out-Null + +# Perform image cleanup +Write-Host "$(Get-TS): Performing image cleanup on WinRE" +DISM /image:$WINRE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null + +# Dismount +Dismount-WindowsImage -Path $WINRE_MOUNT -Save -ErrorAction stop | Out-Null + +# Export +Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\winre2.wim” +Export-WindowsImage -SourceImagePath $WORKING_PATH"\winre.wim” -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\winre2.wim” -ErrorAction stop | Out-Null +Move-Item -Path $WORKING_PATH"\winre2.wim” -Destination $WORKING_PATH"\winre.wim” -Force -ErrorAction stop | Out-Null +``` +### Update WinPE + +This script is similar to the one that updates WinRE, but instead it mounts Boot.wim, applies the packages with the latest cumulative update last, and saves. It repeats this for all images inside of Boot.wim, typically two images. It starts by applying the servicing stack Dynamic Update. Since the script is customizing this media with Japanese, it installs the language pack from the WinPE folder on the language pack ISO. Additionally, add font support and text to speak (TTS) support. Since the script is adding a new language, it rebuilds lang.ini, used to identify languages installed in the image. Finally, it cleans and exports Boot.wim, and copies it back to the new media. + +```powershell +# +# update Windows Preinstallation Environment (WinPE) +# + +# Get the list of images contained within WinPE +$WINPE_IMAGES = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH“\sources\boot.wim” + +Foreach ($IMAGE in $WINPE_IMAGES) { + + # update WinPE + Write-Host "$(Get-TS): Mounting WinPE" + Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH“\sources\boot.wim” -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null + + # Add SSU + Write-Host "$(Get-TS): Adding package $SSU_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null + + # Install lp.cab cab + Write-Host "$(Get-TS): Adding package $WINPE_OC_LP_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null + + # Install language cabs for each optional package installed + $WINPE_INSTALLED_OC = Get-WindowsPackage -Path $WINPE_MOUNT + Foreach ($PACKAGE in $WINPE_INSTALLED_OC) { + + if ( ($PACKAGE.PackageState -eq "Installed") ` + -and ($PACKAGE.PackageName.startsWith("WinPE-")) ` + -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) { + + $INDEX = $PACKAGE.PackageName.IndexOf("-Package") + if ($INDEX -ge 0) { + + $OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab" + if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) { + $OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB + Write-Host "$(Get-TS): Adding package $OC_CAB_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null + } + } + } + } + + # Add font support for the new language + if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { + Write-Host "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null + } + + # Add TTS support for the new language + if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) { + if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) { + + Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null + + Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null + } + } + + # Generates a new Lang.ini file which is used to define the language packs inside the image + if ( (Test-Path -Path $WINPE_MOUNT"\sources\lang.ini") ) { + Write-Host "$(Get-TS): Updating lang.ini" + DISM /image:$WINPE_MOUNT /Gen-LangINI /distribution:$WINPE_MOUNT | Out-Null + } + + # Add LCU + Write-Host "$(Get-TS): Adding package $LCU_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null + + # Perform image cleanup + Write-Host "$(Get-TS): Performing image cleanup on WinPE" + DISM /image:$WINPE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null + + # Dismount + Dismount-WindowsImage -Path $WINPE_MOUNT -Save -ErrorAction stop | Out-Null + + #Export WinPE + Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\boot2.wim” + Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH“\sources\boot.wim” -SourceIndex $IMAGE.ImageIndex -DestinationImagePath $WORKING_PATH"\boot2.wim" -ErrorAction stop | Out-Null + +} + +Move-Item -Path $WORKING_PATH"\boot2.wim" -Destination $MEDIA_NEW_PATH“\sources\boot.wim” -Force -ErrorAction stop | Out-Null +``` +### Update the main operating system + +For this next phase, there is no need to mount the main operating system, since it was already mounted in the previous scripts. This script starts by applying the servicing stack Dynamic Update. Then, it adds Japanese language support and then the Japanese language features. Unlike the Dynamic Update packages, it leverages `Add-WindowsCapability` to add these features. For a full list of such features, and their associated capability name, see [Available Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod). + +Now is the time to enable other optional components or add other features on demand. If such a feature has an associated cumulative update (for example, .Net), this is the time to apply those. The script then proceeds with applying the latest cumulative update. Finally, the script cleans and exports the image. + +You can install optional components, along with the .Net feature, offline, but that will require the device to be restarted This is why the script installs .Net and optional components after cleanup and before export. + +```powershell +# +# update Main OS +# + +# Add SSU +Write-Host "$(Get-TS): Adding package $SSU_PATH" +Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null + +# Optional: Add language to main OS +Write-Host "$(Get-TS): Adding package $OS_LP_PATH" +Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $OS_LP_PATH -ErrorAction stop | Out-Null + +# Optional: Add a FODs to the image +Write-Host "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0" +Add-WindowsCapability -Name "Language.Fonts.$LANG_FONT_CAPABILITY~~~und-$LANG_FONT_CAPABILITY~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +Write-Host "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0" +Add-WindowsCapability -Name "Language.Basic~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +Write-Host "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0" +Add-WindowsCapability -Name "Language.OCR~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +Write-Host "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0" +Add-WindowsCapability -Name "Language.Handwriting~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +Write-Host "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0" +Add-WindowsCapability -Name "Language.TextToSpeech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +Write-Host "$(Get-TS): Adding language FOD:Language.Speech~~~$LANG~0.0.1.0" +Add-WindowsCapability -Name "Language.Speech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +# Note: If I wanted to enable additional features on demand (FOD), I'd add these here. + +# Add LCU +Write-Host "$(Get-TS): Adding package $LCU_PATH" +Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null + +# Copy our updated recovery image from earlier into the main OS +# Note: If I were updating more than 1 edition, I'd want to copy the same recovery image file +# into each edition to enable single instancing +Copy-Item -Path $WORKING_PATH"\winre.wim” -Destination $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim” -Force -Recurse -ErrorAction stop | Out-Null + +# Perform image cleanup +Write-Host "$(Get-TS): Performing image cleanup on main OS" +DISM /image:$MAIN_OS_MOUNT /cleanup-image /StartComponentCleanup | Out-Null + +# +# Note: If I wanted to enable additional Optional Components, I'd add these here. +# In addition, we'll add .Net 3.5 here as well. Both .Net and Optional Components may require +# the image to be booted, and thus if we tried to cleanup after installation, it would fail. +# + +Write-Host "$(Get-TS): Adding NetFX3~~~~" +Add-WindowsCapability -Name "NetFX3~~~~" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +# Add .Net Cumulative Update +Write-Host "$(Get-TS): Adding package $DOTNET_CU_PATH" +Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $DOTNET_CU_PATH -ErrorAction stop | Out-Null + +# Dismount +Dismount-WindowsImage -Path $MAIN_OS_MOUNT -Save -ErrorAction stop | Out-Null + +# Export +Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\install2.wim” +Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH“\sources\install.wim” -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\install2.wim” -ErrorAction stop | Out-Null +Move-Item -Path $WORKING_PATH"\install2.wim” -Destination $MEDIA_NEW_PATH“\sources\install.wim” -Force -ErrorAction stop | Out-Null +``` + +### Update remaining media files + +This part of the script updates the setup files. It simply copies the individual files in the Setup Dynamic Update package to the new media. This step brings an updated Setup.exe as needed, along with the latest compatibility database, and replacement component manifests. + +```powershell +# +# update remaining files on media +# + +# Add Setup DU by copy the files from the package into the newMedia +Write-Host "$(Get-TS): Adding package $SETUP_DU_PATH" +cmd.exe /c $env:SystemRoot\System32\expand.exe $SETUP_DU_PATH -F:* $MEDIA_NEW_PATH"\sources" | Out-Null +``` +### Finish up + +As a last step, the script removes the working folder of temporary files, and unmounts our language pack and features on demand ISOs. + +```powershell +# +# Perform final cleanup +# + +# Remove our working folder +Remove-Item -Path $WORKING_PATH -Recurse -Force -ErrorAction stop | Out-Null + +# Dismount ISO images +Write-Host "$(Get-TS): Dismounting ISO images" +Dismount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Out-Null +Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Out-Null + +Write-Host "$(Get-TS): Media refresh completed!" +``` + From 153a6c8532ed31c4f920f063513ff4ad84941bd9 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Sat, 18 Jan 2020 20:59:31 +0500 Subject: [PATCH 020/374] Removed links pointing to a personal blog I think this reference should be removed as the content is pointing to a non-official document. It's a personal blog and we can not refer any information from any personal blog in MS documentation. All of the links pointing to a personal blog should be removed. Link to **Configuring a proxy for your Surface Hub** , **Configuring a proxy for your Surface Hub** and **Surface Hub and the Skype for Business Trusted Domain List** . Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5847 --- .../use-surface-hub-diagnostic-test-device-account.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md index 40a5768d27..cbabc6e3fa 100644 --- a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md +++ b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md @@ -89,11 +89,11 @@ The Surface Hub Hardware Diagnostic tool is an easy-to-navigate tool that lets t Field |Success |Failure |Comment |Reference |------|------|------|------|------| -Internet Connectivity |Device does have Internet connectivity |Device does not have Internet connectivity |Verifies internet connectivity, including proxy connection |[Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/) +Internet Connectivity |Device does have Internet connectivity |Device does not have Internet connectivity |Verifies internet connectivity, including proxy connection | HTTP Version |1.1 |1.0 |If HTTP 1.0 found, it will cause issue with WU and Store | Direct Internet Connectivity |Device has a Proxy configured Device has no Proxy configured |N/A |Informational. Is your device behind a proxy? | Proxy Address | | |If configured, returns proxy address. | -Proxy Authentication |Proxy does not require Authentication |Proxy requires Proxy Auth |Result may be a false positive if a user already has an open session in Edge and has authenticated thru the proxy. |[Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/) +Proxy Authentication |Proxy does not require Authentication |Proxy requires Proxy Auth |Result may be a false positive if a user already has an open session in Edge and has authenticated thru the proxy. | Proxy Auth Types | | |If proxy authentication is used, return the Authentication methods advertised by the proxy. | #### Environment @@ -131,5 +131,5 @@ SIP Pool Cert Root CA | | |Information. Display the SIP Pool Cert Root CA, if av Field |Success |Failure |Comment |Reference |------|------|------|------|------| -Trust Model Status |No Trust Model Issue Detected. |SIP Domain and server domain are different please add the following domains. |Check the LD FQDN/ LD Server Name/ Pool Server name for Trust model issue. |[Surface Hub and the Skype for Business Trusted Domain List](https://blogs.technet.microsoft.com/y0av/2017/10/25/95/) +Trust Model Status |No Trust Model Issue Detected. |SIP Domain and server domain are different please add the following domains. |Check the LD FQDN/ LD Server Name/ Pool Server name for Trust model issue. Domain Name(s) | | |Return the list of domains that should be added for SFB to connect. | From 23e560a3ec19eb6004b7cd263d75e5fd6db54114 Mon Sep 17 00:00:00 2001 From: DanPandre <54847950+DanPandre@users.noreply.github.com> Date: Tue, 21 Jan 2020 17:41:53 -0500 Subject: [PATCH 021/374] Document Surface Hub fixes in 2B --- devices/surface-hub/surface-hub-update-history.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/devices/surface-hub/surface-hub-update-history.md b/devices/surface-hub/surface-hub-update-history.md index 943400d44c..5d6989d80b 100644 --- a/devices/surface-hub/surface-hub-update-history.md +++ b/devices/surface-hub/surface-hub-update-history.md @@ -24,6 +24,17 @@ Please refer to the “[Surface Hub Important Information](https://support.micro ## Windows 10 Team Creators Update 1703 +
      +January 14, 2020—update for Team edition based on KB4534296* (OS Build 15063.2254) + +This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: + +* Addresses an issue with log collection for Microsoft Surface Hub 2S. + +Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. +*[KB4534296](https://support.microsoft.com/help/4534296) +
      +
      September 24, 2019—update for Team edition based on KB4516059* (OS Build 15063.2078) @@ -57,7 +68,6 @@ Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: -* Addresses an issue with log collection for Microsoft Surface Hub 2S. * Addresses an issue preventing a user from signing in to a Microsoft Surface Hub device with an Azure Active Directory account. This issue occurs because a previous session did not end successfully. * Adds support for TLS 1.2 connections to identity providers and Exchange in device account setup scenarios. * Fixes to improve reliability of Hardware Diagnostic App on Hub 2S. From d91aec056ba434fb2d3f8eb753df902442316dc7 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 21 Jan 2020 14:58:17 -0800 Subject: [PATCH 022/374] Added article --- ...ot-stop-error-on-broadcom-driver-update.md | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md diff --git a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md new file mode 100644 index 0000000000..fdadf04a37 --- /dev/null +++ b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md @@ -0,0 +1,43 @@ +--- +title: Blue screen occurs when updating the in-box Broadcom NIC driver +description: Describes an issue that causes a blue screen error when you upgrade a Broadcom in-box driver on Windows Server 2019, version 1809. +author: Teresa-Motiv +ms.author: v-tea +ms.date: 1/24/2020 +ms.prod: win10 +ms.topic: article +ms.custom: +- CI 113175 +- CSSTroubleshooting +audience: ITPro +ms.localizationpriority: medium +keywords: +manager: kaushika +--- + +# Blue screen occurs when updating the in-box Broadcom NIC driver + +This issue affects computers that meet the following criteria: + +- The operating system is Windows Server 2019, version 1809 +- The network card is a Broadcom NX1 Gigabit Ethernet NIC +- The number of logical processors is large (for example, a computer that has more than 38 logical processors may be affected) + +On such a computer, when you update the in-box Broadcom NIC driver to a newer version, the computer experiences a blue screen error (also referred to as a Stop error or Bugcheck error). + +## Cause + +The operating system media for Windows Server 2019, version 1809, contains version 17.2 of the Broadcom NIC driver. When you upgrade this driver to a newer version, the process of uninstalling the version 17.2 driver generates an error. This behavior is a known issue. + +This issue has been eliminated in Windows Server 2019 version 1903 and newer versions. The operating system media use a newer version of the Broadcom NIC driver. + +## Workaround + +To update the Broadcom NIC driver on an affected computer, follow these steps: + +1. Download the driver update to the affected computer. +1. Open Device Manager, and then select the Broadcom network adapter. +1. Right-click the adapter and select **Disable device**. +1. Right-click the adapter again and select **Update driver** > **Browse my computer for driver software**. +1. Select the update that you downloaded, and start the update. +1. After the update finishes, right-click the adapter and select **Enable device**. From a02fb31e76f86cea9da24c1528ceeaeab48b9ac0 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 21 Jan 2020 15:04:49 -0800 Subject: [PATCH 023/374] Revisions --- .../troubleshoot-stop-error-on-broadcom-driver-update.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md index fdadf04a37..1366d7d806 100644 --- a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md +++ b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md @@ -1,6 +1,6 @@ --- -title: Blue screen occurs when updating the in-box Broadcom NIC driver -description: Describes an issue that causes a blue screen error when you upgrade a Broadcom in-box driver on Windows Server 2019, version 1809. +title: Blue screen occurs when you update the in-box Broadcom NIC driver +description: Describes an issue that causes a blue screen error when you update a in-box Broadcom driver on Windows Server 2019, version 1809. author: Teresa-Motiv ms.author: v-tea ms.date: 1/24/2020 @@ -15,7 +15,7 @@ keywords: manager: kaushika --- -# Blue screen occurs when updating the in-box Broadcom NIC driver +# Blue screen occurs when you update the in-box Broadcom NIC driver This issue affects computers that meet the following criteria: From dfc53420de6bc249bebe5ef72d45fe9ca82a62f4 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 21 Jan 2020 15:21:25 -0800 Subject: [PATCH 024/374] Updating with new link --- windows/client-management/troubleshoot-windows-startup.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/client-management/troubleshoot-windows-startup.md b/windows/client-management/troubleshoot-windows-startup.md index 308677bcef..fb70165fcc 100644 --- a/windows/client-management/troubleshoot-windows-startup.md +++ b/windows/client-management/troubleshoot-windows-startup.md @@ -51,3 +51,5 @@ These articles will walk you through the resources you need to troubleshoot Wind - [Advanced troubleshooting for Stop error or blue screen error](https://docs.microsoft.com/windows/client-management/troubleshoot-stop-errors) - [Advanced troubleshooting for Windows-based computer freeze issues](https://docs.microsoft.com/windows/client-management/troubleshoot-windows-freeze) + +- [Blue screen occurs when you update the in-box Broadcom NIC driver](troubleshoot-stop-error-on-broadcom-driver-update.md) From f663156104898137728aa1ce9a722ef698fae252 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 21 Jan 2020 15:22:10 -0800 Subject: [PATCH 025/374] new entry --- windows/client-management/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/TOC.md b/windows/client-management/TOC.md index cb93e0fb3b..cafa3205ba 100644 --- a/windows/client-management/TOC.md +++ b/windows/client-management/TOC.md @@ -32,5 +32,6 @@ #### [Advanced troubleshooting for stop error or blue screen error](troubleshoot-stop-errors.md) #### [Advanced troubleshooting for stop error 7B or Inaccessible_Boot_Device](troubleshoot-inaccessible-boot-device.md) #### [Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) +#### [Blue screen occurs when you update the in-box Broadcom NIC driver](troubleshoot-stop-error-on-broadcom-driver-update.md) ## [Mobile device management for solution providers](mdm/index.md) ## [Change history for Client management](change-history-for-client-management.md) From 52a88919085574ac1c2fb306c550acb47e2efe5c Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 21 Jan 2020 15:30:09 -0800 Subject: [PATCH 026/374] updated --- .../change-history-for-client-management.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/windows/client-management/change-history-for-client-management.md b/windows/client-management/change-history-for-client-management.md index 8265dd9abc..125bdbf78d 100644 --- a/windows/client-management/change-history-for-client-management.md +++ b/windows/client-management/change-history-for-client-management.md @@ -19,11 +19,19 @@ ms.topic: article This topic lists new and updated topics in the [Client management](index.md) documentation for Windows 10 and Windows 10 Mobile. +## January 2020 + +New or changed topic | Description +--- | --- +[Blue screen occurs when you update the in-box Broadcom NIC driver](troubleshoot-stop-error-on-broadcom-driver-update.md) | New +[Advanced troubleshooting for Windows startup](troubleshoot-windows-startup.md) | Updated + ## December 2019 New or changed topic | Description --- | --- [Change in default removal policy for external storage media in Windows 10, version 1809](change-default-removal-policy-external-storage-media.md) | New +[Advanced troubleshooting for Windows startup](troubleshoot-windows-startup.md) | Updated [Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) | New ## December 2018 From 5dc018dc1e34b7a5c00ba92d919d395964d635e0 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 21 Jan 2020 15:31:02 -0800 Subject: [PATCH 027/374] Date change --- .../client-management/change-history-for-client-management.md | 2 +- windows/client-management/troubleshoot-windows-startup.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/change-history-for-client-management.md b/windows/client-management/change-history-for-client-management.md index 125bdbf78d..ae3363e0cc 100644 --- a/windows/client-management/change-history-for-client-management.md +++ b/windows/client-management/change-history-for-client-management.md @@ -9,7 +9,7 @@ ms.pagetype: security ms.localizationpriority: medium author: dansimp ms.author: dansimp -ms.date: 12/27/2019 +ms.date: 1/21/2020 ms.reviewer: manager: dansimp ms.topic: article diff --git a/windows/client-management/troubleshoot-windows-startup.md b/windows/client-management/troubleshoot-windows-startup.md index fb70165fcc..4ad3f6471d 100644 --- a/windows/client-management/troubleshoot-windows-startup.md +++ b/windows/client-management/troubleshoot-windows-startup.md @@ -7,7 +7,7 @@ ms.topic: troubleshooting author: dansimp ms.localizationpriority: medium ms.author: dansimp -ms.date: +ms.date: 1/21/2020 ms.reviewer: manager: dansimp --- From 2e858eb28e17a7eb6b09c16da93c37092987fce3 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 21 Jan 2020 15:43:33 -0800 Subject: [PATCH 028/374] Typo --- .../troubleshoot-stop-error-on-broadcom-driver-update.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md index 1366d7d806..7b70c9bd26 100644 --- a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md +++ b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md @@ -1,6 +1,6 @@ --- title: Blue screen occurs when you update the in-box Broadcom NIC driver -description: Describes an issue that causes a blue screen error when you update a in-box Broadcom driver on Windows Server 2019, version 1809. +description: Describes an issue that causes a blue screen error when you update an in-box Broadcom driver on Windows Server 2019, version 1809. author: Teresa-Motiv ms.author: v-tea ms.date: 1/24/2020 From eaeb2763541853b3cb61f79eb52b0f76b6c86168 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 21 Jan 2020 15:49:28 -0800 Subject: [PATCH 029/374] Metadata update --- .../troubleshoot-stop-error-on-broadcom-driver-update.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md index 7b70c9bd26..811813aebc 100644 --- a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md +++ b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md @@ -4,7 +4,7 @@ description: Describes an issue that causes a blue screen error when you update author: Teresa-Motiv ms.author: v-tea ms.date: 1/24/2020 -ms.prod: win10 +ms.prod: w10 ms.topic: article ms.custom: - CI 113175 From 030bc3a9e46f37175011f057453dccdb334ad4c9 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Wed, 22 Jan 2020 10:38:32 +0200 Subject: [PATCH 030/374] remove incorrect info and add note about expected behavior https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5432 --- ...-a-windows-10-device-automatically-using-group-policy.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index ac08247a1f..ee0d0066a0 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -49,10 +49,14 @@ The following steps demonstrate required settings using the Intune service: ![Intune license verification](images/auto-enrollment-intune-license-verification.png) 2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](https://docs.microsoft.com/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal). -Also verify that the **MAM user scope** is set to **None**. Otherwise, it will have precedence over the MDM scope that will lead to issues. ![Auto-enrollment activation verification](images/auto-enrollment-activation-verification.png) +> [!IMPORTANT] +> For BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled. + +> For corporate devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled. + 3. Verify that the device OS version is Windows 10, version 1709 or later. 4. Auto-enrollment into Intune via Group Policy is valid only for devices which are hybrid Azure AD joined. This means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line. From 17ecb7c7e54189325402f85a71623b813d916a6b Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 22 Jan 2020 14:04:43 +0500 Subject: [PATCH 031/374] Update recommended-network-definitions-for-wip.md --- .../recommended-network-definitions-for-wip.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md index c3e7e88640..fee621245c 100644 --- a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md @@ -33,12 +33,14 @@ This table includes the recommended URLs to add to your Enterprise Cloud Resourc |If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting
      (Replace "contoso" with your domain name(s)| |-----------------------------|---------------------------------------------------------------------| -|Office 365 for Business |
      • contoso.sharepoint.com
      • contoso-my.sharepoint.com
      • contoso-files.sharepoint.com
      • tasks.office.com
      • protection.office.com
      • meet.lync.com
      • teams.microsoft.com
      | +|Sharepoint Online |
      • contoso.sharepoint.com
      • contoso-my.sharepoint.com
      • contoso-files.sharepoint.com
      | |Yammer |
      • www.yammer.com
      • yammer.com
      • persona.yammer.com
      | |Outlook Web Access (OWA) |
      • outlook.office.com
      • outlook.office365.com
      • attachments.office.net
      | |Microsoft Dynamics |contoso.crm.dynamics.com | |Visual Studio Online |contoso.visualstudio.com | |Power BI |contoso.powerbi.com | +|Microsoft Teams |teams.microsoft.com | +|Other Office 365 services |
      • tasks.office.com
      • protection.office.com
      • meet.lync.com
      • project.microsoft.com
      | You can add other work-only apps to the Cloud Resource list, or you can create a packaged app rule for the .exe file to protect every file the app creates or modifies. Depending on how the app is accessed, you might want to add both. From 48fa656a6fd37470b783e6ecb4e0b7f17aaf5ee9 Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Mon, 27 Jan 2020 13:42:22 +0200 Subject: [PATCH 032/374] Update configure-proxy-internet.md Fixed a typo --- .../microsoft-defender-atp/configure-proxy-internet.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index 698e0aeb8d..162531b03e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -118,7 +118,7 @@ If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP ## Microsoft Defender ATP service backend IP range -If you network devices don't support the URLs white-listed in the prior section, you can use the following information. +If your network devices don't support the URLs white-listed in the prior section, you can use the following information. Microsoft Defender ATP is built on Azure cloud, deployed in the following regions: From 7efd563403356b2b1fd4b614ce614fc4110eb5fa Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Mon, 27 Jan 2020 19:57:57 +0200 Subject: [PATCH 033/374] Update user-roles.md It should be mentioned that we need an Azure AD Security group. We have seen cases where customers used Office group by mistake and RBAC did not work because of that. --- .../threat-protection/microsoft-defender-atp/user-roles.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md index 379bc21985..e55dfe29c0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md +++ b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md @@ -70,7 +70,7 @@ The following steps guide you on how to create roles in Microsoft Defender Secur For more information on the available commands, see [Investigate machines using Live response](live-response.md). -4. Click **Next** to assign the role to an Azure AD group. +4. Click **Next** to assign the role to an Azure AD Security group. 5. Use the filter to select the Azure AD group that you'd like to add to this role. From a9e14d89123e3b02729dbb3c383dc91fc4487933 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Mon, 27 Jan 2020 13:54:47 -0800 Subject: [PATCH 034/374] remove review. from url @scooley Made requested change --- devices/hololens/hololens-FAQ.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-FAQ.md b/devices/hololens/hololens-FAQ.md index e11c2611e8..c91612ffa0 100644 --- a/devices/hololens/hololens-FAQ.md +++ b/devices/hololens/hololens-FAQ.md @@ -209,7 +209,7 @@ If your device isn't performing properly, see [Restart, reset, or recover HoloLe If your device was previously set up for someone else, either a client or former employee and you don't have their password to unlock the device there are two solutions. - If your device is MDM managed by Intune then you can remotely [Wipe](/IntuneDocs/intune/remote-actions/devices-wipe/) the device and it'll reflash itself. Make sure to leave **Retain enrollment state and user account** unchecked. -- If you have the device with you then you can put the device into **Flashing Mode** and use Advanced Recovery Companion to [recover](https://review.docs.microsoft.com/hololens/hololens-recovery?branch=master#hololens-2) the device. +- If you have the device with you then you can put the device into **Flashing Mode** and use Advanced Recovery Companion to [recover](https://docs.microsoft.com/hololens/hololens-recovery?branch=master#hololens-2) the device. [Back to list](#list) From deb26fb920b840ca6c12912fe5e6b5be2c4d11cd Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 27 Jan 2020 14:24:17 -0800 Subject: [PATCH 035/374] Update TOC.md --- windows/security/threat-protection/TOC.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 3d8409c878..7c3a3c157a 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -44,7 +44,7 @@ #### [Attack surface reduction](microsoft-defender-atp/attack-surface-reduction.md) #### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) -### [Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) +### [Next-generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) #### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoft-antivirus.md) ### [Endpoint detection and response]() @@ -187,7 +187,7 @@ ##### [Controlled folder access](microsoft-defender-atp/evaluate-controlled-folder-access.md) ##### [Attack surface reduction](microsoft-defender-atp/evaluate-attack-surface-reduction.md) ##### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) -##### [Evaluate next generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md) +##### [Evaluate next-generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md) ### [Access the Windows Defender Security Center Community Center](microsoft-defender-atp/community.md) @@ -231,7 +231,7 @@ -### [Configure next generation protection]() +### [Configure next-generation protection]() #### [Configure Windows Defender Antivirus features](windows-defender-antivirus/configure-windows-defender-antivirus-features.md) #### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) @@ -315,13 +315,13 @@ ##### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) ##### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) -#### [Manage next generation protection in your business]() +#### [Manage next-generation protection in your business]() ##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) ##### [Use Microsoft Intune and System Center Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -##### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -##### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -##### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -##### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) +##### [Use Group Policy settings to manage next-generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) +##### [Use PowerShell cmdlets to manage next-generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) +##### [Use Windows Management Instrumentation (WMI) to manage next-generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) +##### [Use the mpcmdrun.exe command line tool to manage next-generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) ### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) @@ -573,7 +573,7 @@ #### [Network protection](microsoft-defender-atp/troubleshoot-np.md) #### [Attack surface reduction rules](microsoft-defender-atp/troubleshoot-asr.md) -### [Troubleshoot next generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md) +### [Troubleshoot next-generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md) From 1eff95103c3ce25e74da2df1c3a32b08ad723ed3 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 27 Jan 2020 14:53:15 -0800 Subject: [PATCH 036/374] new article about FP/FN in WDAV --- windows/security/threat-protection/TOC.md | 1 + .../antivirus-false-positives-negatives.md | 25 +++++++++++++++++++ 2 files changed, 26 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 7c3a3c157a..44d2dfed8d 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -316,6 +316,7 @@ ##### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) #### [Manage next-generation protection in your business]() +##### [Handle false positives/negatives in Windows Defender Antivirus](windows-defender-antivirus/antivirus-false-positives-negatives.md) ##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) ##### [Use Microsoft Intune and System Center Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) ##### [Use Group Policy settings to manage next-generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md new file mode 100644 index 0000000000..595435124f --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md @@ -0,0 +1,25 @@ +--- +title: Handling false positives/negatives in Windows Defender Antivirus +description: Did Windows Defender Antivirus miss or wrongly detect something? Find out what you can do. +keywords: Windows Defender Antivirus, false positives, false negatives, exclusions +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 01/27/2020 +ms.reviewer: +manager: dansimp +--- + +# Handling false positives/negatives in Windows Defender Antivirus + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + From 7624f226dec37a3750d3d22a8fdd4a45a96d1bf3 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 27 Jan 2020 14:58:43 -0800 Subject: [PATCH 037/374] Update antivirus-false-positives-negatives.md --- .../antivirus-false-positives-negatives.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md index 595435124f..ff06518411 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md +++ b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md @@ -23,3 +23,5 @@ manager: dansimp - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +As you probably already know, Windows Defender Antivirus is designed to keep your PC safe with built-in, trusted antivirus protection. With Windows Defender Antivirus, you get comprehensive, ongoing, and real-time protection against software threats like viruses, malware and spyware across email, apps, the cloud and the web. But what do you do if something was missed or wrongly detected as malware? You can report it to Microsoft for analysis. + From 7700b0274b0aaa762cfa0815775593839f9069c8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 27 Jan 2020 15:26:25 -0800 Subject: [PATCH 038/374] Update antivirus-false-positives-negatives.md --- .../antivirus-false-positives-negatives.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md index ff06518411..489dd382e2 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md +++ b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md @@ -23,5 +23,14 @@ manager: dansimp - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -As you probably already know, Windows Defender Antivirus is designed to keep your PC safe with built-in, trusted antivirus protection. With Windows Defender Antivirus, you get comprehensive, ongoing, and real-time protection against software threats like viruses, malware and spyware across email, apps, the cloud and the web. But what do you do if something was missed or wrongly detected as malware? You can report it to Microsoft for analysis. +Windows Defender Antivirus is designed to keep your PC safe with built-in, trusted antivirus protection. With Windows Defender Antivirus, you get comprehensive, ongoing, and real-time protection against software threats like viruses, malware and spyware across email, apps, the cloud and the web. + +But what if something gets detected wrongly as malware, or something is missed? We call these false positives and false negatives, and there are some steps you can take to deal with these things. + +## Report a false positive/negative to Microsoft + +1. Review the [submission guidelines](../intelligence/submission-guide.md). +2. Submit your file here: [https://www.microsoft.com/wdsi/filesubmission/](https://www.microsoft.com/wdsi/filesubmission/). + +## Define an exclusion From 55e1b6935b51060eb3d8ab35c445b50a1a9718a7 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 27 Jan 2020 15:37:53 -0800 Subject: [PATCH 039/374] Update antivirus-false-positives-negatives.md --- .../antivirus-false-positives-negatives.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md index 489dd382e2..4c352ce500 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md +++ b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md @@ -25,12 +25,21 @@ manager: dansimp Windows Defender Antivirus is designed to keep your PC safe with built-in, trusted antivirus protection. With Windows Defender Antivirus, you get comprehensive, ongoing, and real-time protection against software threats like viruses, malware and spyware across email, apps, the cloud and the web. -But what if something gets detected wrongly as malware, or something is missed? We call these false positives and false negatives, and there are some steps you can take to deal with these things. +But what if something gets detected wrongly as malware, or something is missed? We call these false positives and false negatives, and there are some steps you can take to deal with these things. You can submit a file to Microsoft for analysis, and potentially, define an exclusion in your Windows Defender Antivirus settings. -## Report a false positive/negative to Microsoft +## Submit a file to Microsoft for analysis 1. Review the [submission guidelines](../intelligence/submission-guide.md). -2. Submit your file here: [https://www.microsoft.com/wdsi/filesubmission/](https://www.microsoft.com/wdsi/filesubmission/). +2. [Submit your file or sample](https://www.microsoft.com/wdsi/filesubmission). -## Define an exclusion +> [!TIP] +> We recommend signing in at the submission portal so you can track the results of your submissions. +## Define an exclusion on a Windows device + +When you define an exclusion for Windows Defender Antivirus, you configure your antivirus to skip that item. + +1. On your Windows 10 device, open the Windows Security app. +2. Select **Virus & threat protection** > **Virus & threat protection settings**. +3. Under **Exclusions**, select **Add or remove exclusions**. +4. Select **+ Add an exclusion**, and specify its type (**File**, **Folder**, **File type**, or **Process**.) \ No newline at end of file From ae77ae6c88ff13eebabe582741fd0068c18f5a9b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 27 Jan 2020 15:42:57 -0800 Subject: [PATCH 040/374] Update antivirus-false-positives-negatives.md --- .../antivirus-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md index 4c352ce500..22f22eb666 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md +++ b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md @@ -25,7 +25,7 @@ manager: dansimp Windows Defender Antivirus is designed to keep your PC safe with built-in, trusted antivirus protection. With Windows Defender Antivirus, you get comprehensive, ongoing, and real-time protection against software threats like viruses, malware and spyware across email, apps, the cloud and the web. -But what if something gets detected wrongly as malware, or something is missed? We call these false positives and false negatives, and there are some steps you can take to deal with these things. You can submit a file to Microsoft for analysis, and potentially, define an exclusion in your Windows Defender Antivirus settings. +But what if something gets detected wrongly as malware, or something is missed? We call these false positives and false negatives, and there are some steps you can take to deal with these things. You can [submit a file to Microsoft for analysis](#submit-a-file-to-microsoft-for-analysis), and potentially, [define an exclusion](#define-an-exclusion-on-a-windows-device) in your Windows Defender Antivirus settings. ## Submit a file to Microsoft for analysis From 0419ba351027e963bdf2c5d180e2f55c2e750f58 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 27 Jan 2020 16:22:48 -0800 Subject: [PATCH 041/374] Edit pass: AppLocker rules @erhopf @Dansimp The edit is complete on this article per work item 3851148. Please review to ensure my edits didn't change technical accuracy and then sign off. Let me know if you have any questions! Thanks, Kelly --- .../applocker/document-your-applocker-rules.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md index acfdd8e57d..47e8f33091 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md @@ -1,6 +1,6 @@ --- title: Document your AppLocker rules (Windows 10) -description: Learn how to document your Applocker rules with this planning guide. Associate rule conditions with files, permissions, rule source, and implementation. +description: Learn how to document your AppLocker rules and associate rule conditions with files, permissions, rule source, and implementation. ms.assetid: 91a198ce-104a-45ff-b49b-487fb40cd2dd ms.reviewer: ms.author: dansimp @@ -23,7 +23,7 @@ ms.date: 09/21/2017 - Windows 10 - Windows Server -This topic describes what rule conditions to associate with each file, how to associate the rule conditions with each file, the source of the rule, and whether the file should be included or excluded. +This topic describes what AppLocker rule conditions to associate with each file, how to associate these rule conditions, the source of the rule, and whether the file should be included or excluded. ## Record your findings @@ -121,7 +121,7 @@ The following table details sample data for documenting rule type and rule condi ## Next steps -For each rule, determine whether to use the allow or deny option. Then, three tasks remain: +For each rule, determine whether to use the allow or deny option, and then complete the following tasks: - [Determine Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) - [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) From cbb2f0c7fff02689168c4dd35057b46485d205b8 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 27 Jan 2020 17:00:30 -0800 Subject: [PATCH 042/374] Edit pass: monitor-the-central-access-policies-that-apply-on-a-file-server @erhopf @Dansimp The edit on this article is complete per work item 3851148. Let me know if my edits changed the technical meaning anywhere. Once you've approved, please sign off. Thanks! Kelly --- ...ss-policies-that-apply-on-a-file-server.md | 40 ++++++++++--------- 1 file changed, 21 insertions(+), 19 deletions(-) diff --git a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md index 7be96ce69b..d5bc5d25e3 100644 --- a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md +++ b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md @@ -1,6 +1,6 @@ --- title: Monitor central access policies on a file server (Windows 10) -description: Learn how to monitor changes to the central access policies that apply to a file server, when using advanced security auditing options. +description: Learn how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options. ms.assetid: 126b051e-c20d-41f1-b42f-6cff24dcf20c ms.reviewer: ms.author: dansimp @@ -22,39 +22,41 @@ ms.date: 04/19/2017 **Applies to** - Windows 10 -This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. Central access policies are created on a domain controller and then applied to file servers through Group Policy management. +This article describes how to monitor changes to the central access policies (CAPs) that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. CAPs are created on a domain controller and then applied to file servers through Group Policy management. -Use the following procedures to configure and verify security auditing settings that are used to monitor changes to the set of central access policies on a file server. The following procedures assume that you have configured and deployed dynamic access control, including central access policies, and claims in your network. If you have not yet deployed dynamic access control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](https://technet.microsoft.com/library/hh846167.aspx). +Use the following procedures to configure and verify security auditing settings that are used to monitor changes to the set of CAPs on a file server. The following procedures assume that you have configured and deployed dynamic access control, including CAPs and claims, in your network. If you have not yet deployed dynamic access control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](https://technet.microsoft.com/library/hh846167.aspx). **To configure settings to monitor changes to central access policies** 1. Sign in to your domain controller by using domain administrator credentials. -2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. -3. In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**. -4. Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Policy Change**, and then double-click **Other Policy Change Events**. +2. In Server Manager, point to **Tools**, and then select **Group Policy Management**. +3. In the console tree, select the flexible access Group Policy Object, and then select **Edit**. +4. Select **Computer Configuration** > **Security Settings** > **Advanced Audit Policy Configuration** > **Policy Change** > **Other Policy Change Events**. - >**Note:**  This policy setting monitors policy changes that might not be captured otherwise, such as central access policy changes or trusted platform module configuration changes. + > [!NOTE] + > This policy setting monitors policy changes that might not be captured otherwise, such as CAP changes or trusted platform module configuration changes.   -5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. +5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then select **OK**. -After you modify the central access policies on the domain controller, verify that the changes have been applied to the file server and that the proper events are logged. +After you modify the CAPs on the domain controller, verify that the changes have been applied to the file server and that the proper events are logged. **To verify changes to the central access policies** 1. Sign in to your domain controller by using domain administrator credentials. 2. Open the Group Policy Management Console. -3. Right-click **Default domain policy**, and then click **Edit**. -4. Double-click **Computer Configuration**, double-click **Policies**, and then double-click **Windows Settings**. -5. Double-click **Security Settings**, right-click **File system**, and then click **Manage CAPs**. -6. In the wizard that appears, follow the instructions to add a new central access policy (CAP), and then click **OK**. -7. Use local administrator credentials to sign in to the server that hosts resources that are subject to the central access policies you changed. -8. Press the Windows key + R, then type **cmd** to open a Command Prompt window. +3. Select **Default domain policy**, and then select **Edit**. +4. Select **Computer Configuration** > **Policies**, and then select **Windows Settings**. +5. Select **Security Settings** > **File system**, and then select **Manage CAPs**. +6. In the wizard that appears, follow the instructions to add a new CAP, and then select **OK**. +7. Use local administrator credentials to sign in to the server that hosts resources that are subject to the CAPs you changed. +8. Select the Windows logo key+R, and then type **cmd** to open a command prompt window. - >**Note:**  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. + > [!NOTE] + > If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**.   -9. Type **gpupdate /force**, and press ENTER. -10. In Server Manager, click **Tools**, and then click **Event Viewer**. -11. Expand **Windows Logs**, and then click **Security**. Verify that event 4819 appears in the security log. +9. Type **gpupdate /force**, and then select the Enter key. +10. In Server Manager, select **Tools**, and then select **Event Viewer**. +11. Expand **Windows Logs**, and then select **Security**. Verify that event 4819 appears in the security log. ## Related resource From 2bf53c6b7f3d1d07e364a0e24c537a5d2b554f48 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Tue, 28 Jan 2020 12:52:58 +0500 Subject: [PATCH 043/374] Removed one more link There was one more personal blog link in the document and has been removed. --- .../use-surface-hub-diagnostic-test-device-account.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md index 7dfc7994bc..e01737c52e 100644 --- a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md +++ b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md @@ -93,7 +93,7 @@ Internet Connectivity |Device does have Internet connectivity |Device does not h HTTP Version |1.1 |1.0 |If HTTP 1.0 found, it will cause issue with WU and Store | Direct Internet Connectivity |Device has a Proxy configured Device has no Proxy configured |N/A |Informational. Is your device behind a proxy? | Proxy Address | | |If configured, returns proxy address. | -Proxy Authentication |Proxy does not require Authentication |Proxy requires Proxy Auth |Result may be a false positive if a user already has an open session in Edge and has authenticated through the proxy. |[Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/) +Proxy Authentication |Proxy does not require Authentication |Proxy requires Proxy Auth |Result may be a false positive if a user already has an open session in Edge and has authenticated through the proxy. | Proxy Auth Types | | |If proxy authentication is used, return the Authentication methods advertised by the proxy. | #### Environment From 9ae95635a321add1d5c45f045cca3b3ce2f5a492 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 28 Jan 2020 10:56:02 -0800 Subject: [PATCH 044/374] Update configure-proxy-internet.md --- .../microsoft-defender-atp/configure-proxy-internet.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index 162531b03e..3104707257 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -118,7 +118,7 @@ If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP ## Microsoft Defender ATP service backend IP range -If your network devices don't support the URLs white-listed in the prior section, you can use the following information. +If your network devices don't support the URLs added to an "allow" list in the prior section, you can use the following information. Microsoft Defender ATP is built on Azure cloud, deployed in the following regions: From dfcb41067d6f3e5241688eeff905ded367a8c1ed Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:18:52 -0800 Subject: [PATCH 045/374] Added MTE EOD prereq note --- .../microsoft-defender-advanced-threat-protection.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md index 56b73435ad..ef2ddb98d9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md @@ -108,6 +108,11 @@ Microsoft Defender ATP includes a secure score to help you dynamically assess th **[Microsoft Threat Experts](microsoft-threat-experts.md)**
      Microsoft Defender ATP's new managed threat hunting service provides proactive hunting, prioritization, and additional context and insights that further empower Security operation centers (SOCs) to identify and respond to threats quickly and accurately. +>[!IMPORTANT] +>Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. + +If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. + **[Management and APIs](management-apis.md)**
      From c3562695aa16fb761dbf4dd33130a3febb2ce01c Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:19:33 -0800 Subject: [PATCH 046/374] Update microsoft-defender-advanced-threat-protection.md --- .../microsoft-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md index ef2ddb98d9..dacbda8e0a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md @@ -111,7 +111,7 @@ Microsoft Defender ATP's new managed threat hunting service provides proactive h >[!IMPORTANT] >Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. -If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. +>If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. From 6385e6de1c14ec7a0a0ef4adbdadcbf1a631342e Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:20:16 -0800 Subject: [PATCH 047/374] Update microsoft-defender-advanced-threat-protection.md --- .../microsoft-defender-advanced-threat-protection.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md index dacbda8e0a..09fb7a88c4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md @@ -110,7 +110,6 @@ Microsoft Defender ATP's new managed threat hunting service provides proactive h >[!IMPORTANT] >Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. - >If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. From e4016ed9b3f9e6948ceee070ba664ff77737c220 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:21:01 -0800 Subject: [PATCH 048/374] Added MTE EOD prereq --- .../threat-protection/microsoft-defender-atp/overview.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview.md b/windows/security/threat-protection/microsoft-defender-atp/overview.md index be86e6742f..acf20a1482 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview.md @@ -42,5 +42,7 @@ Topic | Description [Microsoft Threat Experts](microsoft-threat-experts.md) | Managed cybersecurity threat hunting service. Learn how you can get expert-driven insights and data through targeted attack notification and access to experts on demand. [Advanced hunting](advanced-hunting-overview.md) | Use a powerful query-based threat-hunting tool to proactively find breach activity and create custom detection rules. [Management and APIs](management-apis.md) | Microsoft Defender ATP supports a wide variety of tools to help you manage and interact with the platform so that you can integrate the service into your existing workflows. -[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions. +[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions. >[!IMPORTANT] +>Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. +>If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. [Portal overview](portal-overview.md) |Learn to navigate your way around Microsoft Defender Security Center. From 687a4e70bd4ada22774612c9f2a197f9db5dbeaf Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:22:12 -0800 Subject: [PATCH 049/374] Update overview.md --- .../threat-protection/microsoft-defender-atp/overview.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview.md b/windows/security/threat-protection/microsoft-defender-atp/overview.md index acf20a1482..3878d155ec 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview.md @@ -42,7 +42,7 @@ Topic | Description [Microsoft Threat Experts](microsoft-threat-experts.md) | Managed cybersecurity threat hunting service. Learn how you can get expert-driven insights and data through targeted attack notification and access to experts on demand. [Advanced hunting](advanced-hunting-overview.md) | Use a powerful query-based threat-hunting tool to proactively find breach activity and create custom detection rules. [Management and APIs](management-apis.md) | Microsoft Defender ATP supports a wide variety of tools to help you manage and interact with the platform so that you can integrate the service into your existing workflows. -[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions. >[!IMPORTANT] ->Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. ->If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. +[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions.
      IMPORTANT +
      Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. +If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. [Portal overview](portal-overview.md) |Learn to navigate your way around Microsoft Defender Security Center. From e1436580fa84d9057672cffb75cce6d5e5d2a58d Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:23:03 -0800 Subject: [PATCH 050/374] Update overview.md --- .../threat-protection/microsoft-defender-atp/overview.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview.md b/windows/security/threat-protection/microsoft-defender-atp/overview.md index 3878d155ec..efe28abc3b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview.md @@ -42,7 +42,5 @@ Topic | Description [Microsoft Threat Experts](microsoft-threat-experts.md) | Managed cybersecurity threat hunting service. Learn how you can get expert-driven insights and data through targeted attack notification and access to experts on demand. [Advanced hunting](advanced-hunting-overview.md) | Use a powerful query-based threat-hunting tool to proactively find breach activity and create custom detection rules. [Management and APIs](management-apis.md) | Microsoft Defender ATP supports a wide variety of tools to help you manage and interact with the platform so that you can integrate the service into your existing workflows. -[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions.
      IMPORTANT -
      Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. -If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. +[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions. IMPORTANT: Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration.If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. [Portal overview](portal-overview.md) |Learn to navigate your way around Microsoft Defender Security Center. From a7a35320c4cfa891a468bd66f508a4a25705ae47 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:23:37 -0800 Subject: [PATCH 051/374] Update overview.md --- .../threat-protection/microsoft-defender-atp/overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview.md b/windows/security/threat-protection/microsoft-defender-atp/overview.md index efe28abc3b..10cd7206dc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview.md @@ -42,5 +42,5 @@ Topic | Description [Microsoft Threat Experts](microsoft-threat-experts.md) | Managed cybersecurity threat hunting service. Learn how you can get expert-driven insights and data through targeted attack notification and access to experts on demand. [Advanced hunting](advanced-hunting-overview.md) | Use a powerful query-based threat-hunting tool to proactively find breach activity and create custom detection rules. [Management and APIs](management-apis.md) | Microsoft Defender ATP supports a wide variety of tools to help you manage and interact with the platform so that you can integrate the service into your existing workflows. -[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions. IMPORTANT: Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration.If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. +[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions.

      IMPORTANT: Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration.If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. [Portal overview](portal-overview.md) |Learn to navigate your way around Microsoft Defender Security Center. From 38351e2f038aae39f4639d89b5defe5853a57734 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:24:26 -0800 Subject: [PATCH 052/374] Update overview.md --- .../threat-protection/microsoft-defender-atp/overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview.md b/windows/security/threat-protection/microsoft-defender-atp/overview.md index 10cd7206dc..31aeed1093 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview.md @@ -42,5 +42,5 @@ Topic | Description [Microsoft Threat Experts](microsoft-threat-experts.md) | Managed cybersecurity threat hunting service. Learn how you can get expert-driven insights and data through targeted attack notification and access to experts on demand. [Advanced hunting](advanced-hunting-overview.md) | Use a powerful query-based threat-hunting tool to proactively find breach activity and create custom detection rules. [Management and APIs](management-apis.md) | Microsoft Defender ATP supports a wide variety of tools to help you manage and interact with the platform so that you can integrate the service into your existing workflows. -[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions.

      IMPORTANT: Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration.If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. +[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions.

      IMPORTANT: Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration.

      If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. [Portal overview](portal-overview.md) |Learn to navigate your way around Microsoft Defender Security Center. From 716617647dbbad4fc2054889d8bb4f862bbf672c Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:25:23 -0800 Subject: [PATCH 053/374] Update overview.md --- .../threat-protection/microsoft-defender-atp/overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview.md b/windows/security/threat-protection/microsoft-defender-atp/overview.md index 31aeed1093..de767b478d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview.md @@ -42,5 +42,5 @@ Topic | Description [Microsoft Threat Experts](microsoft-threat-experts.md) | Managed cybersecurity threat hunting service. Learn how you can get expert-driven insights and data through targeted attack notification and access to experts on demand. [Advanced hunting](advanced-hunting-overview.md) | Use a powerful query-based threat-hunting tool to proactively find breach activity and create custom detection rules. [Management and APIs](management-apis.md) | Microsoft Defender ATP supports a wide variety of tools to help you manage and interact with the platform so that you can integrate the service into your existing workflows. -[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions.

      IMPORTANT: Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration.

      If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. +[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions.

      **NOTE:**

      Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration.

      If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. [Portal overview](portal-overview.md) |Learn to navigate your way around Microsoft Defender Security Center. From 1b408ef7f963444cb427bc5aac3dc149dcdd897e Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:26:05 -0800 Subject: [PATCH 054/374] Update overview.md --- .../threat-protection/microsoft-defender-atp/overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview.md b/windows/security/threat-protection/microsoft-defender-atp/overview.md index de767b478d..3f9210c536 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview.md @@ -39,8 +39,8 @@ Topic | Description [Endpoint detection and response](overview-endpoint-detection-response.md) | Understand how Microsoft Defender ATP continuously monitors your organization for possible attacks against systems, networks, or users in your organization and the features you can use to mitigate and remediate threats. [Automated investigation and remediation](automated-investigations.md) | In conjunction with being able to quickly respond to advanced attacks, Microsoft Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale. [Secure score](overview-secure-score.md) | Quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to better protect your organization - all in one place. -[Microsoft Threat Experts](microsoft-threat-experts.md) | Managed cybersecurity threat hunting service. Learn how you can get expert-driven insights and data through targeted attack notification and access to experts on demand. +[Microsoft Threat Experts](microsoft-threat-experts.md) | Managed cybersecurity threat hunting service. Learn how you can get expert-driven insights and data through targeted attack notification and access to experts on demand.

      **NOTE:**

      Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration.

      If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. [Advanced hunting](advanced-hunting-overview.md) | Use a powerful query-based threat-hunting tool to proactively find breach activity and create custom detection rules. [Management and APIs](management-apis.md) | Microsoft Defender ATP supports a wide variety of tools to help you manage and interact with the platform so that you can integrate the service into your existing workflows. -[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions.

      **NOTE:**

      Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration.

      If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. +[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other how Microsoft Defender ATP works with other Microsoft security solutions. [Portal overview](portal-overview.md) |Learn to navigate your way around Microsoft Defender Security Center. From 3d004a08a5e9138916493909ad3c6b244c735945 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:30:38 -0800 Subject: [PATCH 055/374] Added MTE EOD in the prereq --- .../microsoft-defender-atp/microsoft-threat-experts.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md index c451cf8400..d98ece13ea 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md @@ -26,9 +26,12 @@ Microsoft Threat Experts is a managed detection and response (MDR) service that This new capability provides expert-driven insights and data through targeted attack notification and access to experts on demand. ->[!NOTE] ->Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. See [Configure Microsoft Threat Experts capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts#before-you-begin) for details. - + +## Before you begin +Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. + +If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. See [Configure Microsoft Threat Experts capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts#before-you-begin) for details. + ## Targeted attack notification Microsoft Threat Experts provides proactive hunting for the most important threats to your network, including human adversary intrusions, hands-on-keyboard attacks, or advanced attacks like cyberespionage. The managed hunting service includes: - Threat monitoring and analysis, reducing dwell time and risk to the business From e4b2638edf847a3074b8a146b38cd5c7e34be6cb Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:32:40 -0800 Subject: [PATCH 056/374] Added MTE EOD prereq --- .../configure-microsoft-threat-experts.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md index 6140a832e2..2f864f309a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md @@ -26,8 +26,10 @@ ms.topic: article ## Before you begin Ensure that you have Microsoft Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up. ->[!NOTE] ->Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. +Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. + +If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. + ## Register to Microsoft Threat Experts managed threat hunting service If you're already a Microsoft Defender ATP customer, you can apply through the Microsoft Defender ATP portal. From 14479419850647bc50b1bff92e4cb985aecc8379 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Tue, 28 Jan 2020 15:36:50 -0800 Subject: [PATCH 057/374] Update microsoft-defender-advanced-threat-protection.md --- .../microsoft-defender-advanced-threat-protection.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md index 09fb7a88c4..c25f83a0a0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md @@ -109,8 +109,7 @@ Microsoft Defender ATP includes a secure score to help you dynamically assess th Microsoft Defender ATP's new managed threat hunting service provides proactive hunting, prioritization, and additional context and insights that further empower Security operation centers (SOCs) to identify and respond to threats quickly and accurately. >[!IMPORTANT] ->Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. ->If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. +>Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply for a 90-day trial. Contact your Microsoft representative to get a full Experts on Demand subscription. From 87dabf7055bdf25b4d91a599e34ad46a12120d95 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Jan 2020 15:48:58 -0800 Subject: [PATCH 058/374] Update antivirus-false-positives-negatives.md --- .../antivirus-false-positives-negatives.md | 23 +++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md index 22f22eb666..a6dc1e50c2 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md +++ b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: denisebmsft ms.author: deniseb ms.custom: nextgen -ms.date: 01/27/2020 +ms.date: 01/29/2020 ms.reviewer: manager: dansimp --- @@ -25,7 +25,10 @@ manager: dansimp Windows Defender Antivirus is designed to keep your PC safe with built-in, trusted antivirus protection. With Windows Defender Antivirus, you get comprehensive, ongoing, and real-time protection against software threats like viruses, malware and spyware across email, apps, the cloud and the web. -But what if something gets detected wrongly as malware, or something is missed? We call these false positives and false negatives, and there are some steps you can take to deal with these things. You can [submit a file to Microsoft for analysis](#submit-a-file-to-microsoft-for-analysis), and potentially, [define an exclusion](#define-an-exclusion-on-a-windows-device) in your Windows Defender Antivirus settings. +But what if something gets detected wrongly as malware, or something is missed? We call these false positives and false negatives. Fortunately, there are some steps you can take to deal with these things. You can: +- [Submit a file to Microsoft for analysis](#submit-a-file-to-microsoft-for-analysis); +- [Create an "Allow" indicator](#create-an-allow-indicator); or +- [Define an exclusion on an individual device](#define-an-exclusion-on-a-windows-device) in your Windows Defender Antivirus settings. ## Submit a file to Microsoft for analysis @@ -35,11 +38,23 @@ But what if something gets detected wrongly as malware, or something is missed? > [!TIP] > We recommend signing in at the submission portal so you can track the results of your submissions. -## Define an exclusion on a Windows device +## Create an "Allow" indicator + +If a file, IP address, URL, or domain is treated as malware on a device, even though it's safe, you can create an "Allow" indicator. This indicator tells Windows Defender Antivirus (and Microsoft Defender Advanced Threat Protection) that the item is safe. + +To set up your "Allow" indicator, follow the guidance in [Manage indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators). + +## Define an exclusion on an individual Windows device When you define an exclusion for Windows Defender Antivirus, you configure your antivirus to skip that item. 1. On your Windows 10 device, open the Windows Security app. 2. Select **Virus & threat protection** > **Virus & threat protection settings**. 3. Under **Exclusions**, select **Add or remove exclusions**. -4. Select **+ Add an exclusion**, and specify its type (**File**, **Folder**, **File type**, or **Process**.) \ No newline at end of file +4. Select **+ Add an exclusion**, and specify its type (**File**, **Folder**, **File type**, or **Process**.) + +## Related articles + +[What is Microsoft Defender Advanced Threat Protection?](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) + +[Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection) \ No newline at end of file From 48d0c9edfdc26c113e1375f71995024581853d93 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Jan 2020 15:59:07 -0800 Subject: [PATCH 059/374] Update antivirus-false-positives-negatives.md --- .../antivirus-false-positives-negatives.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md index a6dc1e50c2..f04cb9e76c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md +++ b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md @@ -1,5 +1,5 @@ --- -title: Handling false positives/negatives in Windows Defender Antivirus +title: What to do with false positives/negatives in Windows Defender Antivirus description: Did Windows Defender Antivirus miss or wrongly detect something? Find out what you can do. keywords: Windows Defender Antivirus, false positives, false negatives, exclusions search.product: eADQiWindows 10XVcnh @@ -17,7 +17,7 @@ ms.reviewer: manager: dansimp --- -# Handling false positives/negatives in Windows Defender Antivirus +# What to do with false positives/negatives in Windows Defender Antivirus **Applies to:** From 06ba43601c76119b5d4d68b3b7125cac4e2112bd Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Jan 2020 16:15:25 -0800 Subject: [PATCH 060/374] Update antivirus-false-positives-negatives.md --- .../antivirus-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md index f04cb9e76c..d2f4a1c9b5 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md +++ b/windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md @@ -28,7 +28,7 @@ Windows Defender Antivirus is designed to keep your PC safe with built-in, trust But what if something gets detected wrongly as malware, or something is missed? We call these false positives and false negatives. Fortunately, there are some steps you can take to deal with these things. You can: - [Submit a file to Microsoft for analysis](#submit-a-file-to-microsoft-for-analysis); - [Create an "Allow" indicator](#create-an-allow-indicator); or -- [Define an exclusion on an individual device](#define-an-exclusion-on-a-windows-device) in your Windows Defender Antivirus settings. +- [Define an exclusion on an individual Windows device](#define-an-exclusion-on-an-individual-windows-device) in your Windows Defender Antivirus settings. ## Submit a file to Microsoft for analysis From 0200844f9e3c1e5905c5bab049c8f4a31ea3af95 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Jan 2020 16:17:38 -0800 Subject: [PATCH 061/374] fixing build report errors --- ...ix-a-powershell-scripts-for-surface-hub.md | 6 ++-- mdop/appv-v5/app-v-50-prerequisites.md | 36 +++++++++---------- 2 files changed, 21 insertions(+), 21 deletions(-) diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md index 8196982606..7b44ff3d38 100644 --- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md +++ b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md @@ -617,7 +617,7 @@ try { catch { PrintError "Some dependencies are missing" - PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to http://www.microsoft.com/download/details.aspx?id=39366" + PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to https://www.microsoft.com/download/details.aspx?id=39366" PrintError "Please install the Azure Active Directory module for PowerShell from https://go.microsoft.com/fwlink/p/?linkid=236297" CleanupAndFail } @@ -1104,7 +1104,7 @@ if ($fSfbIsOnline) } catch { - CleanupAndFail "To verify Skype for Business in online tenants you need the Lync Online Connector module from http://www.microsoft.com/download/details.aspx?id=39366" + CleanupAndFail "To verify Skype for Business in online tenants you need the Lync Online Connector module from https://www.microsoft.com/download/details.aspx?id=39366" } } else @@ -1518,7 +1518,7 @@ if ($online) catch { PrintError "Some dependencies are missing" - PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to http://www.microsoft.com/download/details.aspx?id=39366" + PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to https://www.microsoft.com/download/details.aspx?id=39366" PrintError "Please install the Azure Active Directory module for PowerShell from https://go.microsoft.com/fwlink/p/?linkid=236297" CleanupAndFail } diff --git a/mdop/appv-v5/app-v-50-prerequisites.md b/mdop/appv-v5/app-v-50-prerequisites.md index 1d1dcd7770..60a2900438 100644 --- a/mdop/appv-v5/app-v-50-prerequisites.md +++ b/mdop/appv-v5/app-v-50-prerequisites.md @@ -100,8 +100,8 @@ The following table lists the installation prerequisites for the App-V 5.0 clien

      Software requirements

      @@ -158,8 +158,8 @@ The following table lists the installation prerequisites for the App-V 5.0 Remot

      Software requirements

      @@ -221,12 +221,12 @@ If the system requirements of a locally installed application exceed the require

      Software requirements