mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 22:33:41 +00:00
Merge branch 'jogeurte-update-wdac-event-descriptions' of https://github.com/jgeurten/windows-docs-pr into pr/6507
This commit is contained in:
denisebmsft
@ -56,9 +56,14 @@ After you configure the settings to monitor removable storage devices, use the f
|
||||
4. In Server Manager, click **Tools**, and then click **Event Viewer**.
|
||||
5. Expand **Windows Logs**, and then click **Security**.
|
||||
6. Look for event 4663, which logs successful attempts to write to or read from a removable storage device. Failures will log event 4656. Both events include **Task Category = Removable Storage device**.
|
||||
|
||||
For more information, see [Audit Removable Storage](audit-removable-storage.md).
|
||||
|
||||
Key information to look for includes the name and account domain of the user who attempted to access the file, the object that the user is attempting to access, resource attributes of the resource, and the type of access that was attempted.
|
||||
|
||||
> [!NOTE]
|
||||
> Even after configuring settings to monitor removable storage devices, some versions of Windows 10 may require registry key **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Storage\HotPlugSecureOpen** to be set to **1** to start logging the removable storage audit events.
|
||||
|
||||
> [!NOTE]
|
||||
> We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event.
|
||||
|
||||
|
||||
@ -1,101 +0,0 @@
|
||||
---
|
||||
title: Microsoft Security Compliance Toolkit 1.0
|
||||
description: This article describes how to use the Security Compliance Toolkit 1.0 in your organization
|
||||
keywords: virtualization, security, malware
|
||||
ms.prod: m365-security
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.author: dansimp
|
||||
author: dulcemontemayor
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 11/21/2019
|
||||
ms.reviewer:
|
||||
ms.technology: windows-sec
|
||||
---
|
||||
|
||||
# Microsoft Security Compliance Toolkit 1.0 Usage
|
||||
|
||||
## What is the Security Compliance Toolkit (SCT)?
|
||||
|
||||
The Security Compliance Toolkit (SCT) is a set of tools that allows enterprise security administrators to download, analyze, test, edit, and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products.
|
||||
|
||||
The SCT enables administrators to effectively manage their enterprise’s Group Policy Objects (GPOs). Using the toolkit, administrators can compare their current GPOs with Microsoft-recommended GPO baselines or other baselines, edit them, store them in GPO backup file format, and apply them broadly through Active Directory or individually through local policy.
|
||||
<p></p>
|
||||
|
||||
The Security Compliance Toolkit consists of:
|
||||
|
||||
- Windows 10 security baselines
|
||||
- Windows 10, Version 21H1 (May 2021 Update)
|
||||
- Windows 10, Version 20H2 (October 2020 Update)
|
||||
- Windows 10, Version 2004 (May 2020 Update)
|
||||
- Windows 10, Version 1909 (November 2019 Update)
|
||||
- Windows 10, Version 1809 (October 2018 Update)
|
||||
- Windows 10, Version 1607 (Anniversary Update)
|
||||
- Windows 10, Version 1507
|
||||
|
||||
- Windows Server security baselines
|
||||
- Windows Server 2022
|
||||
- Windows Server 2019
|
||||
- Windows Server 2016
|
||||
- Windows Server 2012 R2
|
||||
|
||||
- Microsoft Office security baseline
|
||||
- Microsoft 365 Apps for enterprise, Version 2104
|
||||
|
||||
- Microsoft Edge security baseline
|
||||
- Version 93
|
||||
|
||||
- Windows Update security baseline
|
||||
- Windows 10 20H2 and below (October 2020 Update)
|
||||
|
||||
- Tools
|
||||
- Policy Analyzer tool
|
||||
- Local Group Policy Object (LGPO) tool
|
||||
- Set Object Security tool
|
||||
- GPO to PolicyRules tool
|
||||
|
||||
- Scripts
|
||||
- Baseline-ADImport.ps1
|
||||
- Baseline-LocalInstall.ps1
|
||||
- Remove-EPBaselineSettings.ps1
|
||||
- MapGuidsToGpoNames.ps1
|
||||
|
||||
|
||||
You can [download the tools](https://www.microsoft.com/download/details.aspx?id=55319) along with the baselines for the relevant Windows versions. For more details about security baseline recommendations, see the [Microsoft Security Baselines blog](https://techcommunity.microsoft.com/t5/Microsoft-Security-Baselines/bg-p/Microsoft-Security-Baselines).
|
||||
|
||||
## What is the Policy Analyzer tool?
|
||||
|
||||
The Policy Analyzer is a utility for analyzing and comparing sets of Group Policy Objects (GPOs). Its main features include:
|
||||
- Highlight when a set of Group Policies has redundant settings or internal inconsistencies
|
||||
- Highlight the differences between versions or sets of Group Policies
|
||||
- Compare GPOs against current local policy and local registry settings
|
||||
- Export results to a Microsoft Excel spreadsheet
|
||||
|
||||
Policy Analyzer lets you treat a set of GPOs as a single unit. This makes it easy to determine whether particular settings are duplicated across the GPOs or are set to conflicting values. Policy Analyzer also lets you capture a baseline and then compare it to a snapshot taken at a later time to identify changes anywhere across the set.
|
||||
|
||||
More information on the Policy Analyzer tool can be found on the [Microsoft Security Baselines blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/new-tool-policy-analyzer/ba-p/701049) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319).
|
||||
|
||||
## What is the Local Group Policy Object (LGPO) tool?
|
||||
|
||||
LGPO.exe is a command-line utility that is designed to help automate management of Local Group Policy.
|
||||
Using local policy gives administrators a simple way to verify the effects of Group Policy settings, and is also useful for managing non-domain-joined systems.
|
||||
LGPO.exe can import and apply settings from Registry Policy (Registry.pol) files, security templates, Advanced Auditing backup files, as well as from formatted “LGPO text” files.
|
||||
It can export local policy to a GPO backup.
|
||||
It can export the contents of a Registry Policy file to the “LGPO text” format that can then be edited, and can build a Registry Policy file from an LGPO text file.
|
||||
|
||||
Documentation for the LGPO tool can be found on the [Microsoft Security Baselines blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/lgpo-exe-local-group-policy-object-utility-v1-0/ba-p/701045) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319).
|
||||
|
||||
## What is the Set Object Security tool?
|
||||
|
||||
SetObjectSecurity.exe enables you to set the security descriptor for just about any type of Windows securable object (files, directories, registry keys, event logs, services, SMB shares, etc.). For file system and registry objects, you can choose whether to apply inheritance rules. You can also choose to output the security descriptor in a .reg-file-compatible representation of the security descriptor for a REG_BINARY registry value.
|
||||
|
||||
Documentation for the Set Object Security tool can be found on the [Microsoft Security Baselines blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/new-amp-updated-security-tools/ba-p/1631613) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319).
|
||||
|
||||
## What is the GPO to Policy Rules tool?
|
||||
|
||||
Automate the conversion of GPO backups to Policy Analyzer .PolicyRules files and skip the GUI. GPO2PolicyRules is a command-line tool that is included with the Policy Analyzer download.
|
||||
|
||||
Documentation for the GPO to PolicyRules tool can be found on the [Microsoft Security Baselines blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/new-amp-updated-security-tools/ba-p/1631613) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319).
|
||||
@ -14,7 +14,6 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 09/21/2017
|
||||
ms.technology: windows-sec
|
||||
---
|
||||
|
||||
@ -69,6 +68,20 @@ The following table contains information about the events that you can use to de
|
||||
| 8024 | Information| Packaged app installation audited.| Added in Windows Server 2012 and Windows 8.|
|
||||
| 8025 | Warning| Packaged app installation disabled.| Added in Windows Server 2012 and Windows 8.|
|
||||
| 8027 | Warning| No Packaged app rule configured.| Added in Windows Server 2012 and Windows 8.|
|
||||
| 8028 | Warning | * was allowed to run but would have been prevented if the Config CI policy were enforced.| Added in Windows Server 2016 and Windows 10.|
|
||||
| 8029 | Error | * was prevented from running due to Config CI policy.| Added in Windows Server 2016 and Windows 10.|
|
||||
| 8030 | Information | ManagedInstaller check SUCCEEDED during Appid verification of * | Added in Windows Server 2016 and Windows 10.|
|
||||
| 8031 | Information | SmartlockerFilter detected file * being written by process * | Added in Windows Server 2016 and Windows 10.|
|
||||
| 8032 | Error | ManagedInstaller check FAILED during Appid verification of * | Added in Windows Server 2016 and Windows 10.|
|
||||
| 8033 | Warning | ManagedInstaller check FAILED during Appid verification of * . Allowed to run due to Audit Applocker Policy. | Added in Windows Server 2016 and Windows 10.|
|
||||
| 8034 | Information | ManagedInstaller Script check FAILED during Appid verification of * | Added in Windows Server 2016 and Windows 10.|
|
||||
| 8035 | Error | ManagedInstaller Script check SUCCEEDED during Appid verification of * | Added in Windows Server 2016 and Windows 10.|
|
||||
| 8036 | Error | * was prevented from running due to Config CI policy | Added in Windows Server 2016 and Windows 10.|
|
||||
| 8037 | Information | * passed Config CI policy and was allowed to run | Added in Windows Server 2016 and Windows 10.|
|
||||
| 8038 | Information | Publisher info: Subject: * Issuer: * Signature index * (* total) | Added in Windows Server 2016 and Windows 10.|
|
||||
| 8039 | Warning | * passed Config CI policy and was allowed to run | Added in Windows Server 2016 and Windows 10.|
|
||||
| 8040 | Error | Package family name * version * was prevented from installing or updating due to Config CI policy | Added in Windows Server 2016 and Windows 10.|
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -78,17 +78,3 @@ If you don't want users to see the recommendation to update TPM firmware, you ca
|
||||
|
||||
5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy).
|
||||
|
||||
## Disable Memory integrity switch
|
||||
If you don't want users to be able to change the Hypervisor Control Integrity (HVCI), or memory integrity, setting on their computers, you can disable the **Memory integrity** switch.
|
||||
> [!IMPORTANT]
|
||||
> You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
|
||||
|
||||
1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**.
|
||||
|
||||
3. Expand the tree to **Windows components** > **Windows Security** > **Device security**.
|
||||
|
||||
4. Open the **Disable Memory integrity switch** setting and set it to **Enabled**. Select **OK**.
|
||||
|
||||
5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy).
|
||||
|
||||
@ -27,10 +27,9 @@ ms.technology: windows-sec
|
||||
>[!IMPORTANT]
|
||||
>This information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
To get started, open Device Configuration in Intune, then create a new profile.
|
||||
Choose Windows 10 or Windows 11 as the platform, and Endpoint Protection as the profile type.
|
||||
To get started, Open the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and then go to **Devices** > **Windows** > **Configuration profiles** > **Create profile** > Choose **Windows 10 and later** as the platform, Choose **Templates**, then **Endpoint protection** as the profile type.
|
||||
Select Windows Defender Firewall.
|
||||
|
||||
:::image type="content" source="images/windows-firewall-intune.png" alt-text="Example of a Windows Defender Firewall policy in Microsoft Endpoint Manager.":::
|
||||
|
||||
>[!IMPORTANT]
|
||||
>A single Endpoint Protection profile may contain up to a maximum of 150 firewall rules. If a client device requires more than 150 rules, then multiple profiles must be assigned to it.
|
||||
@ -115,4 +114,4 @@ Specifies the list of authorized local users for this rule. A list of authorized
|
||||
|
||||
## Configuring firewall rules programmatically
|
||||
|
||||
Coming soon.
|
||||
Coming soon.
|
||||
|
||||
@ -62,8 +62,6 @@ In some cases, IPsec-secured traffic might have to pass through a router, perime
|
||||
|
||||
In the case of a filtering router or a firewall, you must configure these devices to allow IPsec traffic to be forwarded. Configure the firewall to allow IPsec traffic on UDP source and destination port 500 (IKE), UDP source and destination port 4500 (IPsec NAT-T), and IP Protocol 50 (ESP). You might also have to configure the firewall to allow IPsec traffic on IP protocol 51 (AH) to allow troubleshooting by IPsec administrators and to allow the IPsec traffic to be inspected.
|
||||
|
||||
For more info, see [How to Enable IPsec Traffic Through a Firewall](https://go.microsoft.com/fwlink/?LinkId=45085).
|
||||
|
||||
## Network load balancing and server clusters
|
||||
|
||||
There are challenges implementing connection security for network traffic going to and from network load balancing (NLB) clusters and server clusters. NLB enables multiple servers to be clustered together to provide high availability for a service by providing automatic failover to other nodes in the cluster. Because IPsec matches a security association to a specific device, it prevents different devices from handling the same client connection. If a different node in the cluster responds to an IPsec connection that was originally established by another node, the traffic will be dropped by the client device as untrusted.
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 608 KiB After Width: | Height: | Size: 140 KiB |
@ -35,7 +35,8 @@ In these procedures, you confirm that the rules you deployed are working correct
|
||||
|
||||
- **Encryption zone.** Similar to the main isolation zone, after you confirm that the network traffic to zone members is properly authenticated and encrypted, you must convert your zone rules from request mode to require mode.
|
||||
|
||||
>**Note:** In addition to the steps shown in this procedure, you can also use network traffic capture tools such as Microsoft Network Monitor, which can be downloaded from <https://go.microsoft.com/fwlink/?linkid=94770>. Network Monitor and similar tools allow you to capture, parse, and display the network packets received by the network adapter on your device. Current versions of these tools include full support for IPsec. They can identify encrypted network packets, but they cannot decrypt them.
|
||||
> [!NOTE]
|
||||
> In addition to the steps shown in this procedure, you can also use network traffic capture tools such as [Microsoft Network Monitor](https://www.microsoft.com/download/4865). Network Monitor and similar tools allow you to capture, parse, and display the network packets received by the network adapter on your device. Current versions of these tools include full support for IPsec. They can identify encrypted network packets, but they cannot decrypt them.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
|
||||
@ -234,33 +234,6 @@ Certified against the Protection Profile for General Purpose Operating Systems.
|
||||
- [Administrative Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=cb19538d-9e13-4ab6-af38-8f48abfdad08)
|
||||
- [Certification Report](http://www.commoncriteriaportal.org:80/files/epfiles/0570a_pdf.pdf)
|
||||
|
||||
### Windows XP and Windows Server 2003
|
||||
|
||||
- [Security Target - Windows Server 2003 SP2 including R2, x64, and IA64; Windows XP Professional SP2 and x64 SP2; and Windows XP Embedded SP2](https://www.commoncriteriaportal.org/files/epfiles/st_vid10184-st.pdf)
|
||||
- [Identifying Windows XP and Windows Server 2003 Common Criteria Certified Requirements for the NIST Special Publication 800-53](https://download.microsoft.com/download/a/9/6/a96d1dfc-2bd4-408d-8d93-e0ede7529691/xpws03_ccto800-53.doc)
|
||||
- [Windows Server 2003 SP2 R2 Administrator Guide 3.0](https://www.microsoft.com/downloads/details.aspx?familyid=39598841-e693-4891-9234-cfd1550f3949)
|
||||
- [Windows Server 2003 SP2 R2 Configuration Guide 3.0](https://www.microsoft.com/downloads/details.aspx?familyid=4f7b6a93-0307-480f-a5af-a20268cbd7cc)
|
||||
- [Windows Server 2003 SP1 Administrator's Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=75736009-59e9-4a71-879e-cf581817b8cc)
|
||||
- [Windows Server 2003 SP1 Configuration Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=a0ad1856-beb7-4285-b47c-381e8a210c38)
|
||||
- [Windows Server 2003 with x64 Hardware Administrator's Guide](https://www.microsoft.com/downloads/details.aspx?familyid=8a26829f-c177-4b79-913a-4135fb7b96ef)
|
||||
- [Windows Server 2003 with x64 Hardware Configuration Guide](https://www.microsoft.com/downloads/details.aspx?familyid=3f9ecd0a-74dd-4d23-a4e5-d7b63fed70e8)
|
||||
- [Windows XP Administrator Guide 3.0](https://www.microsoft.com/downloads/details.aspx?familyid=9a7f0b16-72ce-4675-aec8-58785c4e37ee)
|
||||
- [Windows XP Configuration Guide 3.0](https://www.microsoft.com/downloads/details.aspx?familyid=165da57d-f066-4ddf-9462-cbecfcd68694)
|
||||
- [Windows XP User Guide 3.0](https://www.microsoft.com/downloads/details.aspx?familyid=7c1a4761-9b9e-429c-84eb-cd7b034c5779)
|
||||
- [Windows XP Professional with x64 Hardware Administrator's Guide](https://www.microsoft.com/downloads/details.aspx?familyid=346f041e-d641-4af7-bdea-c5a3246d0431)
|
||||
- [Windows XP Professional with x64 Hardware Configuration Guide](https://www.microsoft.com/downloads/details.aspx?familyid=a7075319-cc3d-4420-a00b-8c9a7068ad54)
|
||||
- [Windows XP Professional with x64 Hardware User’s Guide](https://www.microsoft.com/downloads/details.aspx?familyid=26c49cf5-6159-4197-97ce-bf1fdfc54569)
|
||||
- [Windows XP Professional Administrator's Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=9bcac470-a0b3-4d34-a561-fa8308c0ff60)
|
||||
- [Windows XP Professional Configuration Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=9f04915e-571a-422d-8ffa-5797051e81de)
|
||||
- [Windows XP Professional User's Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=d39d0028-7093-495c-80da-2b5b29a54bd8)
|
||||
- [Windows XP / Windows Server 2003 with x64 Hardware ETR](https://www.microsoft.com/downloads/details.aspx?familyid=6e8d98f9-25b9-4c85-9bd9-24d91ea3c9ef)
|
||||
- [Windows XP / Windows Server 2003 with x64 Hardware ETR, Part II](https://www.microsoft.com/downloads/details.aspx?familyid=0c35e7d8-9c56-4686-b902-d5ffb9915658)
|
||||
- [Windows Server 2003 SP2 including R2, Standard, Enterprise, Datacenter, x64, and Itanium Editions Validation Report](https://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf)
|
||||
- [Windows XP Professional SP2 and x64 SP2 Validation Report](https://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf)
|
||||
- [Windows XP Embedded SP2 Validation Report](https://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf)
|
||||
- [Windows XP and Windows Server 2003 ETR](https://www.microsoft.com/downloads/details.aspx?familyid=63cf2a1e-f578-4bb5-9245-d411f0f64265)
|
||||
- [Windows XP and Windows Server 2003 Validation Report](https://www.commoncriteriaportal.org/files/epfiles/st_vid9506-vr.pdf)
|
||||
|
||||
### Windows Server 2003 Certificate Server
|
||||
|
||||
- [Security Target](https://www.commoncriteriaportal.org/files/epfiles/st_vid9507-st.pdf)
|
||||
|
||||
@ -18,7 +18,7 @@ ms.technology: windows-sec
|
||||
|
||||
Windows Sandbox provides a lightweight desktop environment to safely run applications in isolation. Software installed inside the Windows Sandbox environment remains "sandboxed" and runs separately from the host machine.
|
||||
|
||||
A sandbox is temporary. When it's closed, all the software and files and the state are deleted. You get a brand-new instance of the sandbox every time you open the application.
|
||||
A sandbox is temporary. When it's closed, all the software and files and the state are deleted. You get a brand-new instance of the sandbox every time you open the application. Note, however, that as of [Windows 11 Build 22509](https://blogs.windows.com/windows-insider/2021/12/01/announcing-windows-11-insider-preview-build-22509/), your data will persist through a restart initiated from inside the virtualized environment—useful for installing applications that require the OS to reboot.
|
||||
|
||||
Software and applications installed on the host aren't directly available in the sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment.
|
||||
|
||||
@ -40,7 +40,7 @@ The following video provides an overview of Windows Sandbox.
|
||||
## Prerequisites
|
||||
|
||||
- Windows 10 Pro, Enterprise or Education build 18305 or Windows 11 (*Windows Sandbox is currently not supported on Windows Home edition*)
|
||||
- AMD64 architecture
|
||||
- AMD64 or (as of [Windows 11 Build 22483](https://blogs.windows.com/windows-insider/2021/10/20/announcing-windows-11-insider-preview-build-22483/)) ARM64 architecture
|
||||
- Virtualization capabilities enabled in BIOS
|
||||
- At least 4 GB of RAM (8 GB recommended)
|
||||
- At least 1 GB of free disk space (SSD recommended)
|
||||
|
||||
@ -46,7 +46,6 @@ The Security Compliance Toolkit consists of:
|
||||
|
||||
- Microsoft Office security baseline
|
||||
- Microsoft 365 Apps for Enterprise Version 2112
|
||||
- Office 2016
|
||||
|
||||
- Microsoft Edge security baseline
|
||||
- Edge version 98
|
||||
|
||||
Reference in New Issue
Block a user