diff --git a/windows/security/threat-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md b/windows/security/threat-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md index 669d4ede86..b663f72d19 100644 --- a/windows/security/threat-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md +++ b/windows/security/threat-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md @@ -2,28 +2,30 @@ title: Add Production Devices to the Membership Group for a Zone (Windows) description: Learn how to add production devices to the membership group for a zone and refresh the group policy on the devices in the membership group. ms.assetid: 7141de15-5840-4beb-aabe-21c1dd89eb23 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Add Production Devices to the Membership Group for a Zone -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After you test the GPOs for your design on a small set of devices, you can deploy them to the production devices. diff --git a/windows/security/threat-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md b/windows/security/threat-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md index 15f91730ba..9f5d3bac7c 100644 --- a/windows/security/threat-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md +++ b/windows/security/threat-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md @@ -2,28 +2,30 @@ title: Add Test Devices to the Membership Group for a Zone (Windows) description: Learn how to add devices to the group for a zone to test whether your Windows Defender Firewall with Advanced Security implementation works as expected. ms.assetid: 47057d90-b053-48a3-b881-4f2458d3e431 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Add Test Devices to the Membership Group for a Zone -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Before you deploy your rules to large numbers of devices, you must thoroughly test the rules to make sure that communications are working as expected. A misplaced WMI filter or an incorrectly typed IP address in a filter list can easily block communications between devices. Although we recommend that you set your rules to request mode until testing and deployment is complete. We also recommend that you initially deploy the rules to a few devices only to be sure that the correct GPOs are being processed by each device. diff --git a/windows/security/threat-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md b/windows/security/threat-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md index 1a7d5dd07e..180ebf61e7 100644 --- a/windows/security/threat-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md +++ b/windows/security/threat-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md @@ -2,28 +2,30 @@ title: Appendix A Sample GPO Template Files for Settings Used in this Guide (Windows) description: Use sample template files import an XML file containing customized registry preferences into a Group Policy Object (GPO). ms.assetid: 75930afd-ab1b-4e53-915b-a28787814b38 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Appendix A: Sample GPO Template Files for Settings Used in this Guide -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC). diff --git a/windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md b/windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md index 221490f2e9..88a28959fc 100644 --- a/windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md +++ b/windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md @@ -2,28 +2,30 @@ title: Assign Security Group Filters to the GPO (Windows) description: Learn how to use Group Policy Management MMC to assign security group filters to a GPO to make sure that the GPO is applied to the correct computers. ms.assetid: bcbe3299-8d87-4ec1-9e86-8e4a680fd7c8 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Assign Security Group Filters to the GPO -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To make sure that your GPO is applied to the correct computers, use the Group Policy Management MMC snap-in to assign security group filters to the GPO. diff --git a/windows/security/threat-protection/windows-firewall/basic-firewall-policy-design.md b/windows/security/threat-protection/windows-firewall/basic-firewall-policy-design.md index b2dfe86d3b..68b7ae50a0 100644 --- a/windows/security/threat-protection/windows-firewall/basic-firewall-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/basic-firewall-policy-design.md @@ -2,27 +2,29 @@ title: Basic Firewall Policy Design (Windows) description: Protect the devices in your organization from unwanted network traffic that gets through the perimeter defenses by using basic firewall policy design. ms.assetid: 6f7af99e-6850-4522-b7f5-db98e6941418 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Basic Firewall Policy Design -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Many organizations have a network perimeter firewall that is designed to prevent the entry of malicious traffic in to the organization's network, but don't have a host-based firewall enabled on each device in the organization. diff --git a/windows/security/threat-protection/windows-firewall/best-practices-configuring.md b/windows/security/threat-protection/windows-firewall/best-practices-configuring.md index d71e89f983..db778a73a8 100644 --- a/windows/security/threat-protection/windows-firewall/best-practices-configuring.md +++ b/windows/security/threat-protection/windows-firewall/best-practices-configuring.md @@ -6,14 +6,20 @@ ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: maccruz -author: schmurky +ms.author: paoloma +author: paolomatarazzo ms.localizationpriority: medium -manager: dansimp +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: article ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Best practices for configuring Windows Defender Firewall diff --git a/windows/security/threat-protection/windows-firewall/boundary-zone-gpos.md b/windows/security/threat-protection/windows-firewall/boundary-zone-gpos.md index 10fa58f666..77da6ba1be 100644 --- a/windows/security/threat-protection/windows-firewall/boundary-zone-gpos.md +++ b/windows/security/threat-protection/windows-firewall/boundary-zone-gpos.md @@ -2,28 +2,30 @@ title: Boundary Zone GPOs (Windows) description: Learn about GPOs to create that must align with the group you create for the boundary zone in Windows Defender Firewall with Advanced Security. ms.assetid: 1ae66088-02c3-47e4-b7e8-74d0b8f8646e -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Boundary Zone GPOs -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above All the devices in the boundary zone are added to the group CG\_DOMISO\_Boundary. You must create multiple GPOs to align with this group, one for each operating system that you have in your boundary zone. This group is granted Read and Apply permissions in Group Policy on the GPOs described in this section. diff --git a/windows/security/threat-protection/windows-firewall/boundary-zone.md b/windows/security/threat-protection/windows-firewall/boundary-zone.md index 11d52f96fe..d8077459ac 100644 --- a/windows/security/threat-protection/windows-firewall/boundary-zone.md +++ b/windows/security/threat-protection/windows-firewall/boundary-zone.md @@ -2,28 +2,30 @@ title: Boundary Zone (Windows) description: Learn how a boundary zone supports devices that must receive traffic from beyond an isolated domain in Windows Defender Firewall with Advanced Security. ms.assetid: ed98b680-fd24-44bd-a7dd-26c522e45a20 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Boundary Zone - -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above + In most organizations, some devices can receive network traffic from devices that aren't part of the isolated domain, and therefore can't authenticate. To accept communications from untrusted devices, create a boundary zone within your isolated domain. diff --git a/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design-example.md index 17c7175cd6..02c88fdfb7 100644 --- a/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design-example.md @@ -2,28 +2,30 @@ title: Certificate-based Isolation Policy Design Example (Windows) description: This example uses a fictitious company to illustrate certificate-based isolation policy design in Windows Defender Firewall with Advanced Security. ms.assetid: 509b513e-dd49-4234-99f9-636fd2f749e3 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Certificate-based Isolation Policy Design Example -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This design example continues to use the fictitious company Woodgrove Bank, as described in the sections [Firewall Policy Design Example](firewall-policy-design-example.md), [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md), and [Server Isolation Policy Design Example](server-isolation-policy-design-example.md). diff --git a/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md index e61836e9ce..c21f3ae251 100644 --- a/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md @@ -2,28 +2,30 @@ title: Certificate-based Isolation Policy Design (Windows) description: Explore the methodology behind Certificate-based Isolation Policy Design and how it defers from Domain Isolation and Server Isolation Policy Design. ms.assetid: 63e01a60-9daa-4701-9472-096c85e0f862 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Certificate-based isolation policy design -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above In the certificate-based isolation policy design, you provide the same types of protections to your network traffic as described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) and [Server Isolation Policy Design](server-isolation-policy-design.md) sections. The only difference is the method used to share identification credentials during the authentication of your network traffic. diff --git a/windows/security/threat-protection/windows-firewall/change-rules-from-request-to-require-mode.md b/windows/security/threat-protection/windows-firewall/change-rules-from-request-to-require-mode.md index 88550f7f67..effdd2a70c 100644 --- a/windows/security/threat-protection/windows-firewall/change-rules-from-request-to-require-mode.md +++ b/windows/security/threat-protection/windows-firewall/change-rules-from-request-to-require-mode.md @@ -2,28 +2,30 @@ title: Change Rules from Request to Require Mode (Windows) description: Learn how to convert a rule from request to require mode and apply the modified GPOs to the client devices. ms.assetid: ad969eda-c681-48cb-a2c4-0b6cae5f4cff -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Change Rules from Request to Require Mode -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After you confirm that network traffic is being correctly protected by using IPsec, you can change the rules for the domain isolation and encryption zones to require, instead of request, authentication. Don't change the rules for the boundary zone; they must stay in request mode so that devices in the boundary zone can continue to accept connections from devices that aren't part of the isolated domain. diff --git a/windows/security/threat-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md index 18558ef571..d3356b14f3 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md +++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md @@ -2,28 +2,30 @@ title: Checklist Configuring Basic Firewall Settings (Windows) description: Configure Windows Firewall to set inbound and outbound behavior, display notifications, record log files and more of the necessary function for Firewall. ms.assetid: 0d10cdae-da3d-4a33-b8a4-6b6656b6d1f9 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Configuring Basic Firewall Settings -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This checklist includes tasks for configuring a GPO with firewall defaults and settings that are separate from the rules. diff --git a/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md index 36fe34357d..176d8f4536 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md +++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md @@ -2,28 +2,30 @@ title: Checklist Configuring Rules for an Isolated Server Zone (Windows) description: Use these tasks to configure connection security rules and IPsec settings in GPOs for servers in an isolated server zone that are part of an isolated domain. ms.assetid: 67c50a91-e71e-4f1e-a534-dad2582e311c -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Configuring Rules for an Isolated Server Zone -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs for servers in an isolated server zone that are part of an isolated domain. For information about creating a standalone isolated server zone that isn't part of an isolated domain, see [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md). diff --git a/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md index db9e5235c2..e546b37adf 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md +++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md @@ -2,28 +2,30 @@ title: Checklist Configuring Rules for Servers in a Standalone Isolated Server Zone (Windows) description: Checklist Configuring Rules for Servers in a Standalone Isolated Server Zone ms.assetid: ccc09d06-ef75-43b0-9c77-db06f2940955 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs for servers in a standalone isolated server zone that isn't part of an isolated domain. In addition to requiring authentication and optionally encryption, servers in a server isolation zone are accessible only by users or devices that are authenticated as members of a network access group (NAG). The GPOs described here apply only to the isolated servers, not to the client devices that connect to them. For the GPOs for the client devices, see [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md). diff --git a/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md index 7e7fc7b158..55e7e19754 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md +++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md @@ -2,28 +2,30 @@ title: Checklist Configuring Rules for the Boundary Zone (Windows) description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the boundary zone in an isolated domain. ms.assetid: 25fe0197-de5a-4b4c-bc44-c6f0620ea94b -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Configuring Rules for the Boundary Zone -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the boundary zone in an isolated domain. diff --git a/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md index 1d42ae70b6..5d0a18a69f 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md +++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md @@ -2,28 +2,30 @@ title: Checklist Configuring Rules for the Encryption Zone (Windows) description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the encryption zone in an isolated domain. ms.assetid: 87b1787b-0c70-47a4-ae52-700bff505ea4 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Configuring Rules for the Encryption Zone -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs to implement the encryption zone in an isolated domain. diff --git a/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md index 4f86220ff8..648850a336 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md +++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md @@ -2,28 +2,30 @@ title: Checklist Configuring Rules for the Isolated Domain (Windows) description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the main zone in the isolated domain. ms.assetid: bfd2d29e-4011-40ec-a52e-a67d4af9748e -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Configuring Rules for the Isolated Domain -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the main zone in the isolated domain. diff --git a/windows/security/threat-protection/windows-firewall/checklist-creating-group-policy-objects.md b/windows/security/threat-protection/windows-firewall/checklist-creating-group-policy-objects.md index 373174d887..6168d455d3 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-creating-group-policy-objects.md +++ b/windows/security/threat-protection/windows-firewall/checklist-creating-group-policy-objects.md @@ -2,28 +2,30 @@ title: Checklist Creating Group Policy Objects (Windows) description: Learn to deploy firewall settings, IPsec settings, firewall rules, or connection security rules, by using Group Policy in AD DS. ms.assetid: e99bd6a4-34a7-47b5-9791-ae819977a559 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Creating Group Policy Objects -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To deploy firewall or IPsec settings or firewall or connection security rules, we recommend that you use Group Policy in AD DS. This section describes a tested, efficient method that requires some up-front work, but serves an administrator well in the end by making GPO assignments as easy as dropping a device into a membership group. diff --git a/windows/security/threat-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md b/windows/security/threat-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md index cb5f132795..57a25a4b6c 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md +++ b/windows/security/threat-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md @@ -2,28 +2,30 @@ title: Checklist Creating Inbound Firewall Rules (Windows) description: Use these tasks for creating inbound firewall rules in your GPOs for Windows Defender Firewall with Advanced Security. ms.assetid: 0520e14e-5c82-48da-8fbf-87cef36ce02f -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Creating Inbound Firewall Rules -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This checklist includes tasks for creating firewall rules in your GPOs. diff --git a/windows/security/threat-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md b/windows/security/threat-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md index cc6976169c..879c1a55b6 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md +++ b/windows/security/threat-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md @@ -2,28 +2,30 @@ title: Checklist Creating Outbound Firewall Rules (Windows) description: Use these tasks for creating outbound firewall rules in your GPOs for Windows Defender Firewall with Advanced Security. ms.assetid: 611bb98f-4e97-411f-82bf-7a844a4130de -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Creating Outbound Firewall Rules -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This checklist includes tasks for creating outbound firewall rules in your GPOs. diff --git a/windows/security/threat-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md b/windows/security/threat-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md index b6369d7c01..9094725eda 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md +++ b/windows/security/threat-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md @@ -2,28 +2,30 @@ title: Create Rules for Standalone Isolated Server Zone Clients (Windows) description: Checklist for when creating rules for clients of a Standalone Isolated Server Zone ms.assetid: 6a5e6478-add3-47e3-8221-972549e013f6 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This checklist includes tasks for configuring connection security rules and IPsec settings in the GPOs for client devices that must connect to servers in an isolated server zone. diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md index c9c577bc2e..6a5f00771e 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md @@ -2,28 +2,30 @@ title: Checklist Implementing a Basic Firewall Policy Design (Windows) description: Follow this parent checklist for implementing a basic firewall policy design to ensure successful implementation. ms.assetid: 6caf0c1e-ac72-4f9d-a986-978b77fbbaa3 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Implementing a Basic Firewall Policy Design -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This parent checklist includes cross-reference links to important concepts about the basic firewall policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md index 5d59df9ccd..ce48d49c77 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md @@ -2,28 +2,30 @@ title: Checklist Implementing a Certificate-based Isolation Policy Design (Windows) description: Use these references to learn about using certificates as an authentication option and configure a certificate-based isolation policy design. ms.assetid: 1e34b5ea-2e77-4598-a765-550418d33894 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Implementing a Certificate-based Isolation Policy Design -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This parent checklist includes cross-reference links to important concepts about using certificates as an authentication option in either a domain isolation or server isolation design. diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md index 6a6f01d952..6061bc86b5 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md @@ -2,28 +2,30 @@ title: Checklist Implementing a Domain Isolation Policy Design (Windows) description: Use these references to learn about the domain isolation policy design and links to other checklists to complete tasks require to implement this design. ms.assetid: 76586eb3-c13c-4d71-812f-76bff200fc20 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Implementing a Domain Isolation Policy Design -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This parent checklist includes cross-reference links to important concepts about the domain isolation policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md index c484d2eec0..87364021d1 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md @@ -2,28 +2,30 @@ title: Checklist Implementing a Standalone Server Isolation Policy Design (Windows) description: Use these tasks to create a server isolation policy design that isn't part of an isolated domain. See references to concepts and links to other checklists. ms.assetid: 50a997d8-f079-408c-8ac6-ecd02078ade3 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Checklist: Implementing a Standalone Server Isolation Policy Design -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This checklist contains procedures for creating a server isolation policy design that isn't part of an isolated domain. For information on the steps required to create an isolated server zone within an isolated domain, see [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md). diff --git a/windows/security/threat-protection/windows-firewall/configure-authentication-methods.md b/windows/security/threat-protection/windows-firewall/configure-authentication-methods.md index b16b7adc8a..7f45ce6466 100644 --- a/windows/security/threat-protection/windows-firewall/configure-authentication-methods.md +++ b/windows/security/threat-protection/windows-firewall/configure-authentication-methods.md @@ -2,28 +2,30 @@ title: Configure Authentication Methods (Windows) description: Learn how to configure authentication methods for devices in an isolated domain or standalone server zone in Windows Defender Firewall with Advanced Security. ms.assetid: 5fcdc523-617f-4233-9213-15fe19f4cd02 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Configure Authentication Methods -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This procedure shows you how to configure the authentication methods that can be used by computers in an isolated domain or standalone isolated server zone. diff --git a/windows/security/threat-protection/windows-firewall/configure-data-protection-quick-mode-settings.md b/windows/security/threat-protection/windows-firewall/configure-data-protection-quick-mode-settings.md index 99a5795add..f839c60899 100644 --- a/windows/security/threat-protection/windows-firewall/configure-data-protection-quick-mode-settings.md +++ b/windows/security/threat-protection/windows-firewall/configure-data-protection-quick-mode-settings.md @@ -2,28 +2,30 @@ title: Configure Data Protection (Quick Mode) Settings (Windows) description: Learn how to configure the data protection settings for connection security rules in an isolated domain or a standalone isolated server zone. ms.assetid: fdcb1b36-e267-4be7-b842-5df9a067c9e0 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Configure Data Protection (Quick Mode) Settings -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This procedure shows you how to configure the data protection (quick mode) settings for connection security rules in an isolated domain or a standalone isolated server zone. diff --git a/windows/security/threat-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md b/windows/security/threat-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md index ef75edf628..feb3b8e3a2 100644 --- a/windows/security/threat-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md +++ b/windows/security/threat-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md @@ -2,28 +2,30 @@ title: Configure Group Policy to Autoenroll and Deploy Certificates (Windows) description: Learn how to configure Group Policy to automatically enroll client computer certificates and deploy them to the workstations on your network. ms.assetid: faeb62b5-2cc3-42f7-bee5-53ba45d05c09 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Configure Group Policy to Autoenroll and Deploy Certificates -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above You can use this procedure to configure Group Policy to automatically enroll client computer certificates and deploy them to the workstations on your network. Follow this procedure for each GPO that contains IPsec connection security rules that require this certificate. diff --git a/windows/security/threat-protection/windows-firewall/configure-key-exchange-main-mode-settings.md b/windows/security/threat-protection/windows-firewall/configure-key-exchange-main-mode-settings.md index d630831fe4..dd062985fe 100644 --- a/windows/security/threat-protection/windows-firewall/configure-key-exchange-main-mode-settings.md +++ b/windows/security/threat-protection/windows-firewall/configure-key-exchange-main-mode-settings.md @@ -2,28 +2,30 @@ title: Configure Key Exchange (Main Mode) Settings (Windows) description: Learn how to configure the main mode key exchange settings used to secure the IPsec authentication traffic in Windows Defender Firewall with Advanced Security. ms.assetid: 5c593b6b-2cd9-43de-9b4e-95943fe82f52 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Configure Key Exchange (Main Mode) Settings -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This procedure shows you how to configure the main mode key exchange settings used to secure the IPsec authentication traffic. diff --git a/windows/security/threat-protection/windows-firewall/configure-the-rules-to-require-encryption.md b/windows/security/threat-protection/windows-firewall/configure-the-rules-to-require-encryption.md index 00d5f4cd23..2a9fedfb36 100644 --- a/windows/security/threat-protection/windows-firewall/configure-the-rules-to-require-encryption.md +++ b/windows/security/threat-protection/windows-firewall/configure-the-rules-to-require-encryption.md @@ -2,20 +2,26 @@ title: Configure the Rules to Require Encryption (Windows) description: Learn how to configure rules to add encryption algorithms and delete the algorithm combinations that don't use encryption for zones that require encryption. ms.assetid: 07b7760f-3225-4b4b-b418-51787b0972a0 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Configure the Rules to Require Encryption diff --git a/windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log.md index 763858cb1e..acae2a5eb6 100644 --- a/windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log.md @@ -2,28 +2,30 @@ title: Configure the Windows Defender Firewall Log (Windows) description: Learn how to configure Windows Defender Firewall with Advanced Security to log dropped packets or successful connections by using Group Policy Management MMC. ms.assetid: f037113d-506b-44d3-b9c0-0b79d03e7d18 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Configure the Windows Defender Firewall with Advanced Security Log -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To configure Windows Defender Firewall with Advanced Security to log dropped packets or successful connections, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in. diff --git a/windows/security/threat-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md b/windows/security/threat-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md index ae802dff45..7f4b8057f3 100644 --- a/windows/security/threat-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md +++ b/windows/security/threat-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md @@ -2,25 +2,27 @@ title: Configure the Workstation Authentication Template (Windows) description: Learn how to configure a workstation authentication certificate template, which is used for device certificates that are enrolled and deployed to workstations. ms.assetid: c3ac9960-6efc-47c1-bd69-d9d4bf84f7a6 -ms.reviewer: -manager: dansimp -ms.author: dansimp +ms.reviewer: jekrynit +manager: aaroncz +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +author: paolomatarazzo ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Configure the Workstation Authentication Certificate Template -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This procedure describes how to configure a certificate template that Active Directory Certification Services (AD CS) uses as the starting point for device certificates that are automatically enrolled and deployed to workstations in the domain. It shows how to create a copy of a template, and then configure the template according to your design requirements. diff --git a/windows/security/threat-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md b/windows/security/threat-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md index da729a7b63..81905439d5 100644 --- a/windows/security/threat-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md +++ b/windows/security/threat-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md @@ -2,28 +2,30 @@ title: Configure Windows Defender Firewall with Advanced Security to Suppress Notifications When a Program is Blocked (Windows) description: Configure Windows Defender Firewall with Advanced Security to suppress notifications when a program is Blocked ms.assetid: b7665d1d-f4d2-4b5a-befc-8b6bd940f69b -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Configure Windows Defender Firewall with Advanced Security to Suppress Notifications When a Program Is Blocked -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To configure Windows Defender Firewall with Advanced Security to suppress the display of a notification when it blocks a program that tries to listen for network traffic and to prohibit locally defined rules, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console. diff --git a/windows/security/threat-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md b/windows/security/threat-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md index 45aac5c3bd..e23f800b1e 100644 --- a/windows/security/threat-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md +++ b/windows/security/threat-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md @@ -2,28 +2,30 @@ title: Confirm That Certificates Are Deployed Correctly (Windows) description: Learn how to confirm that a Group Policy is being applied as expected and that the certificates are being properly installed on the workstations. ms.assetid: de0c8dfe-16b0-4d3b-8e8f-9282f6a65eee -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: securit ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Confirm That Certificates Are Deployed Correctly -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After configuring your certificates and autoenrollment in Group Policy, you can confirm that the policy is being applied as expected, and that the certificates are being properly installed on the workstation devices. diff --git a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md index a3b8bcee88..603fb772d6 100644 --- a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md +++ b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md @@ -2,28 +2,30 @@ title: Copy a GPO to Create a New GPO (Windows) description: Learn how to make a copy of a GPO by using the Active Directory Users and devices MMC snap-in to create a GPO for boundary zone devices. ms.assetid: 7f6a23e5-4b3f-40d6-bf6d-7895558b1406 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Copy a GPO to Create a New GPO -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To create the GPO for the boundary zone devices, make a copy of the main domain isolation GPO, and then change the settings to request, instead of require, authentication. To make a copy of a GPO, use the Active Directory Users and devices MMC snap-in. diff --git a/windows/security/threat-protection/windows-firewall/create-a-group-account-in-active-directory.md b/windows/security/threat-protection/windows-firewall/create-a-group-account-in-active-directory.md index 7f5899e2f5..f3f7a3bb1b 100644 --- a/windows/security/threat-protection/windows-firewall/create-a-group-account-in-active-directory.md +++ b/windows/security/threat-protection/windows-firewall/create-a-group-account-in-active-directory.md @@ -2,28 +2,30 @@ title: Create a Group Account in Active Directory (Windows) description: Learn how to create a security group for the computers that are to receive Group Policy settings by using the Active Directory Users and Computers console. ms.assetid: c3700413-e02d-4d56-96b8-7991f97ae432 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create a Group Account in Active Directory -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To create a security group to contain the computer accounts for the computers that are to receive a set of Group Policy settings, use the Active Directory Users and Computers console. diff --git a/windows/security/threat-protection/windows-firewall/create-a-group-policy-object.md b/windows/security/threat-protection/windows-firewall/create-a-group-policy-object.md index c1f6da0c2a..8926c70552 100644 --- a/windows/security/threat-protection/windows-firewall/create-a-group-policy-object.md +++ b/windows/security/threat-protection/windows-firewall/create-a-group-policy-object.md @@ -2,28 +2,30 @@ title: Create a Group Policy Object (Windows) description: Learn how to use the Active Directory Users and Computers MMC snap-in to create a GPO. You must be a member of the Domain Administrators group. ms.assetid: 72a50dd7-5033-4d97-a5eb-0aff8a35cced -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create a Group Policy Object -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To create a new GPO, use the Active Directory Users and Computers MMC snap-in. diff --git a/windows/security/threat-protection/windows-firewall/create-an-authentication-exemption-list-rule.md b/windows/security/threat-protection/windows-firewall/create-an-authentication-exemption-list-rule.md index 513807383f..a2ad8d6f6c 100644 --- a/windows/security/threat-protection/windows-firewall/create-an-authentication-exemption-list-rule.md +++ b/windows/security/threat-protection/windows-firewall/create-an-authentication-exemption-list-rule.md @@ -2,28 +2,30 @@ title: Create an Authentication Exemption List Rule (Windows) description: Learn how to create rules that exempt devices that cannot communicate by using IPSec from the authentication requirements of your isolation policies. ms.assetid: 8f6493f3-8527-462a-82c0-fd91a6cb5dd8 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create an Authentication Exemption List Rule -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above In almost any isolated server or isolated domain scenario, there are some devices or devices that cannot communicate by using IPsec. This procedure shows you how to create rules that exempt those devices from the authentication requirements of your isolation policies. diff --git a/windows/security/threat-protection/windows-firewall/create-an-authentication-request-rule.md b/windows/security/threat-protection/windows-firewall/create-an-authentication-request-rule.md index 037a451dee..99d3d07f46 100644 --- a/windows/security/threat-protection/windows-firewall/create-an-authentication-request-rule.md +++ b/windows/security/threat-protection/windows-firewall/create-an-authentication-request-rule.md @@ -2,20 +2,26 @@ title: Create an Authentication Request Rule (Windows) description: Create a new rule for Windows Defender Firewall with Advanced Security so devices on the network use IPsec protocols and methods before they can communicate. ms.assetid: 1296e048-039f-4d1a-aaf2-8472ad05e359 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create an Authentication Request Rule diff --git a/windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule.md b/windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule.md index da5b7f7f20..76b063f72d 100644 --- a/windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule.md +++ b/windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule.md @@ -2,28 +2,30 @@ title: Create an Inbound ICMP Rule (Windows) description: Learn how to allow inbound ICMP traffic by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. ms.assetid: 267b940a-79d9-4322-b53b-81901e357344 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create an Inbound ICMP Rule -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To allow inbound Internet Control Message Protocol (ICMP) network traffic, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows ICMP requests and responses to be sent and received by computers on the network. diff --git a/windows/security/threat-protection/windows-firewall/create-an-inbound-port-rule.md b/windows/security/threat-protection/windows-firewall/create-an-inbound-port-rule.md index 93586077a2..56a7c6808c 100644 --- a/windows/security/threat-protection/windows-firewall/create-an-inbound-port-rule.md +++ b/windows/security/threat-protection/windows-firewall/create-an-inbound-port-rule.md @@ -2,28 +2,30 @@ title: Create an Inbound Port Rule (Windows) description: Learn to allow traffic on specific ports by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. ms.assetid: a7b6c6ca-32fa-46a9-a5df-a4e43147da9f -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create an Inbound Port Rule -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To allow inbound network traffic on only a specified TCP or UDP port number, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. diff --git a/windows/security/threat-protection/windows-firewall/create-an-inbound-program-or-service-rule.md b/windows/security/threat-protection/windows-firewall/create-an-inbound-program-or-service-rule.md index bb976db9c3..1d6f3352d0 100644 --- a/windows/security/threat-protection/windows-firewall/create-an-inbound-program-or-service-rule.md +++ b/windows/security/threat-protection/windows-firewall/create-an-inbound-program-or-service-rule.md @@ -2,28 +2,30 @@ title: Create an Inbound Program or Service Rule (Windows) description: Learn how to allow inbound traffic to a program or service by using the Group Policy Management MMC snap-in to create firewall rules. ms.assetid: 00b7fa60-7c64-4ba5-ba95-c542052834cf -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create an Inbound Program or Service Rule -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To allow inbound network traffic to a specified program or service, use the Windows Defender Firewall with Advanced Securitynode in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows the program to listen and receive inbound network traffic on any port. diff --git a/windows/security/threat-protection/windows-firewall/create-an-outbound-port-rule.md b/windows/security/threat-protection/windows-firewall/create-an-outbound-port-rule.md index 11f38ec926..9c6df54f31 100644 --- a/windows/security/threat-protection/windows-firewall/create-an-outbound-port-rule.md +++ b/windows/security/threat-protection/windows-firewall/create-an-outbound-port-rule.md @@ -2,28 +2,30 @@ title: Create an Outbound Port Rule (Windows) description: Learn to block outbound traffic on a port by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. ms.assetid: 59062b91-756b-42ea-8f2a-832f05d77ddf -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create an Outbound Port Rule -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. To block outbound network traffic on a specified TCP or UDP port number, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. diff --git a/windows/security/threat-protection/windows-firewall/create-an-outbound-program-or-service-rule.md b/windows/security/threat-protection/windows-firewall/create-an-outbound-program-or-service-rule.md index ec94f13e2b..79eb7dda0d 100644 --- a/windows/security/threat-protection/windows-firewall/create-an-outbound-program-or-service-rule.md +++ b/windows/security/threat-protection/windows-firewall/create-an-outbound-program-or-service-rule.md @@ -1,24 +1,26 @@ --- title: Create an Outbound Program or Service Rule (Windows) description: Use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create an Outbound Program or Service Rule -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. To block outbound network traffic for a specified program or service, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. This type of rule prevents the program from sending any outbound network traffic on any port. diff --git a/windows/security/threat-protection/windows-firewall/create-inbound-rules-to-support-rpc.md b/windows/security/threat-protection/windows-firewall/create-inbound-rules-to-support-rpc.md index 4d05d75092..2fec297236 100644 --- a/windows/security/threat-protection/windows-firewall/create-inbound-rules-to-support-rpc.md +++ b/windows/security/threat-protection/windows-firewall/create-inbound-rules-to-support-rpc.md @@ -1,24 +1,26 @@ --- title: Create Inbound Rules to Support RPC (Windows) description: Learn how to allow RPC network traffic by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create Inbound Rules to Support RPC -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To allow inbound remote procedure call (RPC) network traffic, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create two firewall rules. The first rule allows incoming network packets on TCP port 135 to the RPC Endpoint Mapper service. The incoming traffic consists of requests to communicate with a specified network service. The RPC Endpoint Mapper replies with a dynamically assigned port number that the client must use to communicate with the service. The second rule allows the network traffic that is sent to the dynamically assigned port number. Using the two rules configured as described in this topic helps to protect your device by allowing network traffic only from devices that have received RPC dynamic port redirection and to only those TCP port numbers assigned by the RPC Endpoint Mapper. diff --git a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md index 7f460e4af8..3b6a633dbf 100644 --- a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md +++ b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md @@ -1,23 +1,25 @@ --- title: Create Windows Firewall rules in Intune (Windows) description: Learn how to use Intune to create rules in Windows Defender Firewall with Advanced Security. Start by creating a profile in Device Configuration in Intune. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create Windows Firewall rules in Intune -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above >[!IMPORTANT] >This information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. diff --git a/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md b/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md index 1b2931e18d..2bdb97ef09 100644 --- a/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md +++ b/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md @@ -1,24 +1,26 @@ --- title: Create WMI Filters for the GPO (Windows) description: Learn how to use WMI filters on a GPO to make sure that each GPO for a group can only be applied to devices running the correct version of Windows. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Create WMI Filters for the GPO -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To make sure that each GPO associated with a group can only be applied to devices running the correct version of Windows, use the Group Policy Management MMC snap-in to create and assign WMI filters to the GPO. Although you can create a separate membership group for each GPO, you would then have to manage the memberships of the different groups. Instead, use only a single membership group, and let WMI filters automatically ensure the correct GPO is applied to each device. diff --git a/windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md b/windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md index a245dc4589..0b2d46c86c 100644 --- a/windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md +++ b/windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md @@ -1,24 +1,26 @@ --- title: Designing a Windows Defender Firewall Strategy (Windows) description: Answer the question in this article to design an effective Windows Defender Firewall with Advanced Security Strategy. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Designing a Windows Defender Firewall with Advanced Security Strategy -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To select the most effective design for helping to protect the network, you must spend time collecting key information about your current computer environment. You must have a good understanding of what tasks the devices on the network perform, and how they use the network to accomplish those tasks. You must understand the network traffic generated by the programs running on the devices. diff --git a/windows/security/threat-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md b/windows/security/threat-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md index 8ba54573da..7cc8bd8b35 100644 --- a/windows/security/threat-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md +++ b/windows/security/threat-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md @@ -1,24 +1,26 @@ --- title: Determining the Trusted State of Your Devices (Windows) description: Learn how to define the trusted state of devices in your enterprise to help design your strategy for using Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Determining the Trusted State of Your Devices -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After obtaining information about the devices that are currently part of the IT infrastructure, you must determine at what point a device is considered trusted. The term *trusted* can mean different things to different people. Therefore, you must communicate a firm definition for it to all stakeholders in the project. Failure to do this communication can lead to problems with the security of the trusted environment, because the overall security can't exceed the level of security set by the least secure client that achieves trusted status. diff --git a/windows/security/threat-protection/windows-firewall/documenting-the-zones.md b/windows/security/threat-protection/windows-firewall/documenting-the-zones.md index 2215134491..95dc6e163c 100644 --- a/windows/security/threat-protection/windows-firewall/documenting-the-zones.md +++ b/windows/security/threat-protection/windows-firewall/documenting-the-zones.md @@ -1,24 +1,26 @@ --- title: Documenting the Zones (Windows) description: Learn how to document the zone placement of devices in your design for Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Documenting the Zones -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Generally, the task of determining zone membership isn't complex, but it can be time-consuming. Use the information generated during the [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) section of this guide to determine the zone in which to put each host. You can document this zone placement by adding a Group column to the inventory table shown in the Designing a Windows Defender Firewall with Advanced Security Strategy section. A sample is shown here: diff --git a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md index 2370992ec2..82b302fd7b 100644 --- a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md @@ -1,24 +1,26 @@ --- title: Domain Isolation Policy Design Example (Windows) description: This example uses a fictitious company to illustrate domain isolation policy design in Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Domain Isolation Policy Design Example -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This design example continues to use the fictitious company Woodgrove Bank, and builds on the example described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section. See that example for an explanation of the basic corporate network infrastructure at Woodgrove Bank with diagrams. diff --git a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md index 50640ef245..340f62976e 100644 --- a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md @@ -1,24 +1,26 @@ --- title: Domain Isolation Policy Design (Windows) description: Learn how to design a domain isolation policy, based on which devices accept only connections from authenticated members of the same isolated domain. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Domain Isolation Policy Design -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above In the domain isolation policy design, you configure the devices on your network to accept only connections coming from devices that are authenticated as members of the same isolated domain. diff --git a/windows/security/threat-protection/windows-firewall/enable-predefined-inbound-rules.md b/windows/security/threat-protection/windows-firewall/enable-predefined-inbound-rules.md index 307d2e17e0..123058b8dd 100644 --- a/windows/security/threat-protection/windows-firewall/enable-predefined-inbound-rules.md +++ b/windows/security/threat-protection/windows-firewall/enable-predefined-inbound-rules.md @@ -1,24 +1,26 @@ --- title: Enable Predefined Inbound Rules (Windows) description: Learn the rules for Windows Defender Firewall with Advanced Security for common networking roles and functions. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Enable Predefined Inbound Rules -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Windows Defender Firewall with Advanced Security includes many predefined rules for common networking roles and functions. When you install a new server role on a device or enable a network feature on a client device, the installer typically enables the rules required for that role instead of creating new ones. When deploying firewall rules to the devices on the network, you can take advantage of these predefined rules instead of creating new ones. Using this advantage helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use. diff --git a/windows/security/threat-protection/windows-firewall/enable-predefined-outbound-rules.md b/windows/security/threat-protection/windows-firewall/enable-predefined-outbound-rules.md index d0ee50b518..000488608e 100644 --- a/windows/security/threat-protection/windows-firewall/enable-predefined-outbound-rules.md +++ b/windows/security/threat-protection/windows-firewall/enable-predefined-outbound-rules.md @@ -1,24 +1,26 @@ --- title: Enable Predefined Outbound Rules (Windows) description: Learn to deploy predefined firewall rules that block outbound network traffic for common network functions in Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/07/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Enable Predefined Outbound Rules -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above By default, Windows Defender Firewall with Advanced Security allows all outbound network traffic unless it matches a rule that prohibits the traffic. Windows Defender Firewall includes many predefined outbound rules that can be used to block network traffic for common networking roles and functions. When you install a new server role on a computer or enable a network feature on a client computer, the installer can install, but typically doesn't enable, outbound block rules for that role. When deploying firewall rules to the computers on the network, you can take advantage of these predefined rules instead of creating new ones. Using this advantage helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use. diff --git a/windows/security/threat-protection/windows-firewall/encryption-zone-gpos.md b/windows/security/threat-protection/windows-firewall/encryption-zone-gpos.md index 90e93ba044..bcca4ec64f 100644 --- a/windows/security/threat-protection/windows-firewall/encryption-zone-gpos.md +++ b/windows/security/threat-protection/windows-firewall/encryption-zone-gpos.md @@ -1,24 +1,26 @@ --- title: Encryption Zone GPOs (Windows) description: Learn how to add a device to an encryption zone by adding the device account to the encryption zone group in Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Encryption Zone GPOs -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Handle encryption zones in a similar manner to the boundary zones. A device is added to an encryption zone by adding the device account to the encryption zone group. Woodgrove Bank has a single service that must be protected, and the devices that are running that service are added to the group CG\_DOMISO\_Encryption. This group is granted Read and Apply Group Policy permissions in on the GPO described in this section. diff --git a/windows/security/threat-protection/windows-firewall/encryption-zone.md b/windows/security/threat-protection/windows-firewall/encryption-zone.md index 3427f8825c..7038a7f49d 100644 --- a/windows/security/threat-protection/windows-firewall/encryption-zone.md +++ b/windows/security/threat-protection/windows-firewall/encryption-zone.md @@ -1,24 +1,26 @@ --- title: Encryption Zone (Windows) description: Learn how to create an encryption zone to contain devices that host sensitive data and require that the sensitive network traffic be encrypted. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Encryption Zone -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Some servers in the organization host data that's sensitive, including medical, financial, or other personal data. Government or industry regulations might require that this sensitive information must be encrypted when it's transferred between devices. diff --git a/windows/security/threat-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md b/windows/security/threat-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md index 9cd638e39c..3096a8342b 100644 --- a/windows/security/threat-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md +++ b/windows/security/threat-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md @@ -1,24 +1,26 @@ --- title: Evaluating Windows Defender Firewall with Advanced Security Design Examples (Windows) description: Evaluating Windows Defender Firewall with Advanced Security Design Examples -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Evaluating Windows Defender Firewall with Advanced Security Design Examples -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above The following Windows Defender Firewall with Advanced Security design examples illustrate how you can use Windows Defender Firewall to improve the security of the devices connected to the network. You can use these topics to evaluate how the firewall and connection security rules work across all Windows Defender Firewall designs and to determine which design or combination of designs best suits the goals of your organization. diff --git a/windows/security/threat-protection/windows-firewall/exempt-icmp-from-authentication.md b/windows/security/threat-protection/windows-firewall/exempt-icmp-from-authentication.md index dee6778a40..d6de9a861d 100644 --- a/windows/security/threat-protection/windows-firewall/exempt-icmp-from-authentication.md +++ b/windows/security/threat-protection/windows-firewall/exempt-icmp-from-authentication.md @@ -1,24 +1,26 @@ --- title: Exempt ICMP from Authentication (Windows) description: Learn how to add exemptions for any network traffic that uses the ICMP protocol in Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Exempt ICMP from Authentication -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This procedure shows you how to add exemptions for any network traffic that uses the ICMP protocol. diff --git a/windows/security/threat-protection/windows-firewall/exemption-list.md b/windows/security/threat-protection/windows-firewall/exemption-list.md index 487eb1a25d..ac27c34d95 100644 --- a/windows/security/threat-protection/windows-firewall/exemption-list.md +++ b/windows/security/threat-protection/windows-firewall/exemption-list.md @@ -1,24 +1,26 @@ --- title: Exemption List (Windows) description: Learn about reasons to add devices to an exemption list in Windows Defender Firewall with Advanced Security and the trade-offs of having too many exemptions. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Exemption List -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above When you implement a server and domain isolation security model in your organization, you're likely to find more challenges. Key infrastructure servers such as DNS servers and DHCP servers typically must be available to all devices on the internal network, yet secured from network attacks. However, if they must remain available to all devices on the network, not just to isolated domain members, then these servers can't require IPsec for inbound access, nor can they use IPsec transport mode for outbound traffic. diff --git a/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md b/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md index 73db668581..f13a1094ec 100644 --- a/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md +++ b/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md @@ -1,17 +1,23 @@ --- title: Filter origin audit log improvements description: Filter origin documentation audit log improvements -ms.reviewer: -ms.author: v-bshilpa +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: normal -author: Benny-54 -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: - m365-security-compliance - m365-initiative-windows-security ms.topic: troubleshooting ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Filter origin audit log improvements diff --git a/windows/security/threat-protection/windows-firewall/firewall-gpos.md b/windows/security/threat-protection/windows-firewall/firewall-gpos.md index acce618f02..80b417b9a0 100644 --- a/windows/security/threat-protection/windows-firewall/firewall-gpos.md +++ b/windows/security/threat-protection/windows-firewall/firewall-gpos.md @@ -1,24 +1,26 @@ --- title: Firewall GPOs (Windows) description: In this example, a Group Policy Object is linked to the domain container because the domain controllers aren't part of the isolated domain. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Firewall GPOs -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above All the devices on Woodgrove Bank's network that run Windows are part of the isolated domain, except domain controllers. To configure firewall rules, the GPO described in this section is linked to the domain container in the Active Directory OU hierarchy, and then filtered by using security group filters and WMI filters. diff --git a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md index 71610970dc..d52cb81f95 100644 --- a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md @@ -1,24 +1,26 @@ --- title: Basic Firewall Policy Design Example (Windows) description: This example features a fictitious company and illustrates firewall policy design for Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Basic Firewall Policy Design Example -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above In this example, the fictitious company Woodgrove Bank is a financial services institution. diff --git a/windows/security/threat-protection/windows-firewall/firewall-settings-lost-on-upgrade.md b/windows/security/threat-protection/windows-firewall/firewall-settings-lost-on-upgrade.md index 777d827e77..9d3ccfc6b4 100644 --- a/windows/security/threat-protection/windows-firewall/firewall-settings-lost-on-upgrade.md +++ b/windows/security/threat-protection/windows-firewall/firewall-settings-lost-on-upgrade.md @@ -1,17 +1,23 @@ --- title: Troubleshooting Windows Firewall settings after a Windows upgrade description: Firewall settings lost on upgrade -ms.reviewer: -ms.author: v-bshilpa +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: Benny-54 -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: - m365-security-compliance - m365-initiative-windows-security ms.topic: troubleshooting ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Troubleshooting Windows Firewall settings after a Windows upgrade diff --git a/windows/security/threat-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md index da7ae54f60..8725d0c4ed 100644 --- a/windows/security/threat-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md +++ b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md @@ -1,24 +1,26 @@ --- title: Gathering Information about Your Active Directory Deployment (Windows) description: Learn about gathering Active Directory information, including domain layout, organizational unit architecture, and site topology, for your firewall deployment. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Gathering Information about Your Active Directory Deployment -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Active Directory is another important item about which you must gather information. You must understand the forest structure. This structure includes domain layout, organizational unit (OU) architecture, and site topology. This information makes it possible to know where devices are currently placed, their configuration, and the impact of changes to Active Directory that result from implementing Windows Defender Firewall with Advanced Security. Review the following list for information needed: diff --git a/windows/security/threat-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md index 1477bbc36c..bfe7c5a55b 100644 --- a/windows/security/threat-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md +++ b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md @@ -1,24 +1,26 @@ --- title: Gathering Info about Your Network Infrastructure (Windows) description: Learn how to gather info about your network infrastructure so that you can effectively plan for Windows Defender Firewall with Advanced Security deployment. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Gathering Information about Your Current Network Infrastructure -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Perhaps the most important aspect of planning for Windows Defender Firewall with Advanced Security deployment is the network architecture, because IPsec is layered on the Internet Protocol itself. An incomplete or inaccurate understanding of the network can prevent any Windows Defender Firewall solution from being successful. Understanding subnet layout, IP addressing schemes, and traffic patterns are part of this effort, but accurately documenting the following components are important to completing the planning phase of this project: diff --git a/windows/security/threat-protection/windows-firewall/gathering-information-about-your-devices.md b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-devices.md index 6cdefe354a..eb25dfbbce 100644 --- a/windows/security/threat-protection/windows-firewall/gathering-information-about-your-devices.md +++ b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-devices.md @@ -1,24 +1,26 @@ --- title: Gathering Information about Your Devices (Windows) description: Learn what information to gather about the devices in your enterprise to plan your Windows Defender Firewall with Advanced Security deployment. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Gathering Information about Your Devices -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above One of the most valuable benefits of conducting an asset discovery project is the large amount of data that is obtained about the client and server devices on the network. When you start designing and planning your isolation zones, you must make decisions that require accurate information about the state of all hosts to ensure that they can use IPsec as planned. diff --git a/windows/security/threat-protection/windows-firewall/gathering-other-relevant-information.md b/windows/security/threat-protection/windows-firewall/gathering-other-relevant-information.md index 7f6cefda53..27ebec7226 100644 --- a/windows/security/threat-protection/windows-firewall/gathering-other-relevant-information.md +++ b/windows/security/threat-protection/windows-firewall/gathering-other-relevant-information.md @@ -1,24 +1,26 @@ --- title: Gathering Other Relevant Information (Windows) description: Learn about additional information you may need to gather to deploy Windows Defender Firewall with Advanced Security policies in your organization. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Gathering Other Relevant Information -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This topic discusses several other things that you should examine to see whether they'll cause any complications in your ability to deploy Windows Defender Firewall with Advanced Security policies in your organization. diff --git a/windows/security/threat-protection/windows-firewall/gathering-the-information-you-need.md b/windows/security/threat-protection/windows-firewall/gathering-the-information-you-need.md index f009728af3..5f8c2be8fe 100644 --- a/windows/security/threat-protection/windows-firewall/gathering-the-information-you-need.md +++ b/windows/security/threat-protection/windows-firewall/gathering-the-information-you-need.md @@ -1,24 +1,26 @@ --- title: Gathering the Information You Need (Windows) description: Collect and analyze information about your network, directory services, and devices to prepare for Windows Defender Firewall with Advanced Security deployment. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Gathering the Information You Need -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Before starting the planning process for a Windows Defender Firewall with Advanced Security deployment, you must collect and analyze up-to-date information about the network, the directory services, and the devices that are already deployed in the organization. This information enables you to create a design that accounts for all possible elements of the existing infrastructure. If the gathered information isn't accurate, problems can occur when devices and devices that weren't considered during the planning phase are encountered during implementation. diff --git a/windows/security/threat-protection/windows-firewall/gpo-domiso-boundary.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-boundary.md index 9d4cea8c27..a9b3bb3f08 100644 --- a/windows/security/threat-protection/windows-firewall/gpo-domiso-boundary.md +++ b/windows/security/threat-protection/windows-firewall/gpo-domiso-boundary.md @@ -1,24 +1,26 @@ --- title: GPO\_DOMISO\_Boundary (Windows) description: This example GPO supports devices that aren't part of the isolated domain to access specific servers that must be available to those untrusted devices. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # GPO\_DOMISO\_Boundary -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This GPO is authored by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. Woodgrove Bank began by copying and pasting the GPO for the Windows Server 2008 version of the isolated domain GPO, and then renamed the copy to reflect its new purpose. diff --git a/windows/security/threat-protection/windows-firewall/gpo-domiso-encryption.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-encryption.md index a325feb5ed..9849e51f4d 100644 --- a/windows/security/threat-protection/windows-firewall/gpo-domiso-encryption.md +++ b/windows/security/threat-protection/windows-firewall/gpo-domiso-encryption.md @@ -1,16 +1,22 @@ --- title: GPO\_DOMISO\_Encryption\_WS2008 (Windows) description: This example GPO supports the ability for servers that contain sensitive data to require encryption for all connection requests. -ms.reviewer: -ms.author: dansimp -author: dansimp -manager: dansimp +ms.reviewer: jekrynit +ms.author: paoloma +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.prod: m365-security ms.localizationpriority: medium ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # GPO\_DOMISO\_Encryption\_WS2008 diff --git a/windows/security/threat-protection/windows-firewall/gpo-domiso-firewall.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-firewall.md index 6cd30ab0e7..c50f026cc3 100644 --- a/windows/security/threat-protection/windows-firewall/gpo-domiso-firewall.md +++ b/windows/security/threat-protection/windows-firewall/gpo-domiso-firewall.md @@ -1,24 +1,26 @@ --- title: GPO\_DOMISO\_Firewall (Windows) description: Learn about the settings and rules in this example GPO, which is authored by using the Group Policy editing tools. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # GPO\_DOMISO\_Firewall -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This GPO is authored by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to devices that are running at least Windows 7 or Windows Server 2008. diff --git a/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md index be3ef61a55..40f53282db 100644 --- a/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md +++ b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md @@ -1,24 +1,26 @@ --- title: GPO\_DOMISO\_IsolatedDomain\_Clients (Windows) description: Author this GPO by using Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # GPO\_DOMISO\_IsolatedDomain\_Clients -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This GPO is authored by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It's intended to only apply to client devices that are running Windows 8, Windows 7, or Windows Vista. diff --git a/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md index 3e4b545348..cd7824dccc 100644 --- a/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md +++ b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md @@ -1,24 +1,26 @@ --- title: GPO\_DOMISO\_IsolatedDomain\_Servers (Windows) description: Author this GPO by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # GPO\_DOMISO\_IsolatedDomain\_Servers -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This GPO is authored by using the Windows Defender Firewall interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It's intended to only apply to server devices that are running at least Windows Server 2008. diff --git a/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md b/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md index da1df7152e..393ecebb5b 100644 --- a/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md +++ b/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md @@ -1,23 +1,25 @@ --- title: Identify implementation goals for Windows Defender Firewall with Advanced Security Deployment (Windows) description: Identifying Your Windows Defender Firewall with Advanced Security (WFAS) implementation goals -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Identifying Windows Defender Firewall with Advanced Security implementation goals -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Correctly identifying your Windows Defender Firewall with Advanced Security implementation goals is essential for the success of your Windows Defender Firewall design project. Form a project team that can clearly articulate deployment issues in a vision statement. When you write your vision statement, identify, clarify, and refine your implementation goals. Prioritize and, if possible, combine your implementation goals so that you can design and deploy Windows Defender Firewall by using an iterative approach. You can take advantage of the predefined Windows Defender Firewall implementation goals presented in this guide that are relevant to your scenarios. diff --git a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md index e99fb5bdc3..663cee3cb9 100644 --- a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md +++ b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md @@ -1,24 +1,26 @@ --- title: Implementing Your Windows Defender Firewall with Advanced Security Design Plan (Windows) description: Implementing Your Windows Defender Firewall with Advanced Security Design Plan -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Implementing Your Windows Defender Firewall with Advanced Security Design Plan -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above The following are important factors in the implementation of your Windows Defender Firewall design plan: diff --git a/windows/security/threat-protection/windows-firewall/isolated-domain-gpos.md b/windows/security/threat-protection/windows-firewall/isolated-domain-gpos.md index b2b51c8bed..d15da4ef92 100644 --- a/windows/security/threat-protection/windows-firewall/isolated-domain-gpos.md +++ b/windows/security/threat-protection/windows-firewall/isolated-domain-gpos.md @@ -1,24 +1,26 @@ --- title: Isolated Domain GPOs (Windows) description: Learn about GPOs for isolated domains in this example configuration of Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Isolated Domain GPOs -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above All of the devices in the isolated domain are added to the group CG\_DOMISO\_IsolatedDomain. You must create multiple GPOs to align with this group, one for each Windows operating system that must have different rules or settings to implement the basic isolated domain functionality that you have in your isolated domain. This group is granted Read and Apply Group Policy permissions on all the GPOs described in this section. diff --git a/windows/security/threat-protection/windows-firewall/isolated-domain.md b/windows/security/threat-protection/windows-firewall/isolated-domain.md index ab40a0617d..16663963fe 100644 --- a/windows/security/threat-protection/windows-firewall/isolated-domain.md +++ b/windows/security/threat-protection/windows-firewall/isolated-domain.md @@ -1,16 +1,22 @@ --- title: Isolated Domain (Windows) description: Learn about the isolated domain, which is the primary zone for trusted devices, which use connection security and firewall rules to control communication. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Isolated Domain diff --git a/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md b/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md index 94c2d1efc2..4da13f6712 100644 --- a/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md +++ b/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md @@ -3,22 +3,24 @@ title: Isolating Microsoft Store Apps on Your Network (Windows) description: Learn how to customize your firewall configuration to isolate the network access of the new Microsoft Store apps that run on devices added to your network. ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Isolating Microsoft Store Apps on Your Network -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above When you add new devices to your network, you may want to customize your Windows Defender Firewall with Advanced Security configuration to isolate the network access of the new Microsoft Store apps that run on them. Developers who build Microsoft Store apps can declare certain app capabilities that enable different classes of network access. A developer can decide what kind of network access the app requires and configure this capability for the app. When the app is installed on a device, appropriate firewall rules are automatically created to enable access. You can then customize the firewall configuration to further fine-tune this access if they desire more control over the network access for the app. diff --git a/windows/security/threat-protection/windows-firewall/link-the-gpo-to-the-domain.md b/windows/security/threat-protection/windows-firewall/link-the-gpo-to-the-domain.md index 27ca0787a6..50361255a5 100644 --- a/windows/security/threat-protection/windows-firewall/link-the-gpo-to-the-domain.md +++ b/windows/security/threat-protection/windows-firewall/link-the-gpo-to-the-domain.md @@ -1,24 +1,26 @@ --- title: Link the GPO to the Domain (Windows) description: Learn how to link a GPO to the Active Directory container for the target devices, after you configure it in Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Link the GPO to the Domain -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After you create the GPO and configure it with security group filters and WMI filters, you must link the GPO to the container in Active Directory that contains all of the target devices. diff --git a/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md b/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md index e14954cb74..b729a362be 100644 --- a/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md +++ b/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md @@ -1,24 +1,26 @@ --- title: Mapping your implementation goals to a Windows Firewall with Advanced Security design (Windows) description: Mapping your implementation goals to a Windows Firewall with Advanced Security design -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Mapping your implementation goals to a Windows Firewall with Advanced Security design -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After you finish reviewing the existing Windows Firewall with Advanced Security implementation goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Firewall with Advanced Security design. > [!IMPORTANT] diff --git a/windows/security/threat-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md b/windows/security/threat-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md index 20c89d309f..ce5e5032ad 100644 --- a/windows/security/threat-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md +++ b/windows/security/threat-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md @@ -1,24 +1,26 @@ --- title: Modify GPO Filters (Windows) description: Learn how to modify GPO filters to apply to a different zone or version of windows in Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Modify GPO Filters to Apply to a Different Zone or Version of Windows -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above You must reconfigure your copied GPO so that it contains the correct security group and WMI filters for its new role. If you are creating the GPO for the isolated domain, use the [Block members of a group from applying a GPO](#to-block-members-of-a-group-from-applying-a-gpo) procedure to prevent members of the boundary and encryption zones from incorrectly applying the GPOs for the main isolated domain. diff --git a/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md index 27d55010fe..2a59a2ec1e 100644 --- a/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md +++ b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md @@ -1,24 +1,26 @@ --- title: Open the Group Policy Management Console to IP Security Policies (Windows) description: Learn how to open the Group Policy Management Console to IP Security Policies to configure GPOs for earlier versions of the Windows operating system. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Open the Group Policy Management Console to IP Security Policies -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Procedures in this guide that refer to GPOs for earlier versions of the Windows operating system instruct you to work with the IP Security Policy section in the Group Policy Management Console (GPMC). diff --git a/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md index 6b414fd0e1..fbbda89fb9 100644 --- a/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md +++ b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md @@ -1,24 +1,26 @@ --- title: Group Policy Management of Windows Firewall with Advanced Security (Windows) description: Group Policy Management of Windows Firewall with Advanced Security -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Group Policy Management of Windows Firewall with Advanced Security -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Most of the procedures in this guide instruct you to use Group Policy settings for Windows Firewall with Advanced Security. diff --git a/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md index 7c1ef5c3ab..548d290e41 100644 --- a/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md +++ b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md @@ -1,24 +1,26 @@ --- title: Group Policy Management of Windows Defender Firewall (Windows) description: Group Policy Management of Windows Defender Firewall with Advanced Security -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Group Policy Management of Windows Defender Firewall -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To open a GPO to Windows Defender Firewall: diff --git a/windows/security/threat-protection/windows-firewall/open-windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/open-windows-firewall-with-advanced-security.md index 31a3fba50f..7d3b9aafd8 100644 --- a/windows/security/threat-protection/windows-firewall/open-windows-firewall-with-advanced-security.md +++ b/windows/security/threat-protection/windows-firewall/open-windows-firewall-with-advanced-security.md @@ -1,24 +1,26 @@ --- title: Open Windows Defender Firewall with Advanced Security (Windows) description: Learn how to open the Windows Defender Firewall with Advanced Security console. You must be a member of the Administrators group. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Open Windows Defender Firewall with Advanced Security -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This procedure shows you how to open the Windows Defender Firewall with Advanced Security console. diff --git a/windows/security/threat-protection/windows-firewall/planning-certificate-based-authentication.md b/windows/security/threat-protection/windows-firewall/planning-certificate-based-authentication.md index 0e6eba3376..6ed68f701c 100644 --- a/windows/security/threat-protection/windows-firewall/planning-certificate-based-authentication.md +++ b/windows/security/threat-protection/windows-firewall/planning-certificate-based-authentication.md @@ -1,24 +1,26 @@ --- title: Planning Certificate-based Authentication (Windows) description: Learn how a device unable to join an Active Directory domain can still participate in an isolated domain by using certificate-based authentication. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Planning Certificate-based Authentication -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Sometimes a device can't join an Active Directory domain, and therefore can't use Kerberos V5 authentication with domain credentials. However, the device can still participate in the isolated domain by using certificate-based authentication. diff --git a/windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md index 1df3ac69c7..0edcdd46c3 100644 --- a/windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md +++ b/windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md @@ -1,24 +1,26 @@ --- title: Planning Domain Isolation Zones (Windows) description: Learn how to use information you've gathered to make decisions about isolation zones for your environment in Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Planning Domain Isolation Zones -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After you have the required information about your network, Active Directory, and client and server devices, you can use that information to make decisions about the isolation zones you want to use in your environment. diff --git a/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md b/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md index 356ce2a71e..12a6970f24 100644 --- a/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md +++ b/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md @@ -1,24 +1,26 @@ --- title: Planning GPO Deployment (Windows) description: Learn how to use security group filtering and WMI filtering to provide the most flexible options for applying GPOs to devices in Active Directory. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Planning GPO Deployment -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above You can control which GPOs are applied to devices in Active Directory in a combination of three ways: diff --git a/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md index a4b877a50f..a63f2b239f 100644 --- a/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md +++ b/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md @@ -1,24 +1,26 @@ --- title: Planning Group Policy Deployment for Your Isolation Zones (Windows) description: Learn how to plan a group policy deployment for your isolation zones after you determine the best logical design for your isolation environment. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Planning Group Policy Deployment for Your Isolation Zones -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After you've decided on the best logical design of your isolation environment for the network and device security requirements, you can start the implementation plan. diff --git a/windows/security/threat-protection/windows-firewall/planning-isolation-groups-for-the-zones.md b/windows/security/threat-protection/windows-firewall/planning-isolation-groups-for-the-zones.md index 3b9d484653..ee193d5c3d 100644 --- a/windows/security/threat-protection/windows-firewall/planning-isolation-groups-for-the-zones.md +++ b/windows/security/threat-protection/windows-firewall/planning-isolation-groups-for-the-zones.md @@ -1,24 +1,26 @@ --- title: Planning Isolation Groups for the Zones (Windows) description: Learn about planning isolation groups for the zones in Microsoft Firewall, including information on universal groups and GPOs. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Planning Isolation Groups for the Zones -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Isolation groups in Active Directory are how you implement the various domain and server isolation zones. A device is assigned to a zone by adding its device account to the group that represents that zone. diff --git a/windows/security/threat-protection/windows-firewall/planning-network-access-groups.md b/windows/security/threat-protection/windows-firewall/planning-network-access-groups.md index a46279468a..ebc3e779ce 100644 --- a/windows/security/threat-protection/windows-firewall/planning-network-access-groups.md +++ b/windows/security/threat-protection/windows-firewall/planning-network-access-groups.md @@ -1,24 +1,26 @@ --- title: Planning Network Access Groups (Windows) description: Learn how to implement a network access group for users and devices that can access an isolated server in Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Planning Network Access Groups -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above A network access group (NAG) is used to identify users and devices that have permission to access an isolated server. The server is configured with firewall rules that allow only network connections that are authenticated as originating from a device, and optionally a user, whose accounts are members of its NAG. A member of the isolated domain can belong to as many NAGs as required. diff --git a/windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md index 9e0486133d..6cdcc36dc6 100644 --- a/windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md +++ b/windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md @@ -1,24 +1,26 @@ --- title: Planning Server Isolation Zones (Windows) description: Learn how to restrict access to a server to approved users by using a server isolation zone in Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Planning Server Isolation Zones -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Sometimes a server hosts data that is sensitive. If your servers host data that must not be compromised, you have several options to help protect that data. One was already addressed: adding the server to the encryption zone. Membership in that zone prevents the server from being accessed by any devices that are outside the isolated domain, and encrypts all network connections to server. diff --git a/windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md b/windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md index 6f5c67f5bd..f4bcdca804 100644 --- a/windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md +++ b/windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md @@ -1,24 +1,26 @@ --- title: Planning Settings for a Basic Firewall Policy (Windows) description: Learn how to design a basic policy for Windows Defender Firewall with Advanced Security, the settings and rules that enforce your requirements on devices. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Planning Settings for a Basic Firewall Policy -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After you've identified your requirements, and have the information about the network layout and devices available, you can begin to design the GPO settings and rules that will enable you to enforce your requirements on the devices. diff --git a/windows/security/threat-protection/windows-firewall/planning-the-gpos.md b/windows/security/threat-protection/windows-firewall/planning-the-gpos.md index c61cc01904..1a921ebe00 100644 --- a/windows/security/threat-protection/windows-firewall/planning-the-gpos.md +++ b/windows/security/threat-protection/windows-firewall/planning-the-gpos.md @@ -1,24 +1,26 @@ --- title: Planning the GPOs (Windows) description: Learn about planning Group Policy Objects for your isolation zones in Windows Defender Firewall with Advanced Security, after you design the zone layout. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Planning the GPOs -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above When you plan the GPOs for your different isolation zones, you must complete the layout of the required zones and their mappings to the groups that link the devices to the zones. diff --git a/windows/security/threat-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md index b2922c2dd6..1411d23007 100644 --- a/windows/security/threat-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md +++ b/windows/security/threat-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md @@ -1,24 +1,26 @@ --- title: Plan to Deploy Windows Defender Firewall with Advanced Security (Windows) description: Use the design information in this article to plan for the deployment of Windows Defender Firewall with Advanced Security in your organization. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Planning to Deploy Windows Defender Firewall with Advanced Security -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After you collect information about your environment and decide on a design by following the guidance in the [Windows Defender Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md), you can begin to plan the deployment of your design. With the completed design and the information in this topic, you can determine which tasks to perform to deploy Windows Defender Firewall with Advanced Security in your organization. diff --git a/windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md b/windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md index 3c54199363..9d104e67c2 100644 --- a/windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md +++ b/windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md @@ -1,24 +1,26 @@ --- title: Planning Your Windows Defender Firewall with Advanced Security Design (Windows) description: After you gather the relevant information, select the design or combination of designs for Windows Defender Firewall with Advanced Security in your environment. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Planning Your Windows Defender Firewall with Advanced Security Design -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After you've gathered the relevant information in the previous sections, and understood the basics of the designs as described earlier in this guide, you can select the design (or combination of designs) that meet your needs. diff --git a/windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md b/windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md index 8c98be2b77..b12f025700 100644 --- a/windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md +++ b/windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md @@ -1,24 +1,26 @@ --- title: Procedures Used in This Guide (Windows) description: Refer to this summary of procedures for Windows Defender Firewall with Advanced Security from checklists in this guide. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Procedures Used in This Guide -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above The procedures in this section appear in the checklists found earlier in this document. They should be used only in the context of the checklists in which they appear. They are presented here in alphabetical order. diff --git a/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md b/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md index 0ae3e5785f..e143a06c23 100644 --- a/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md +++ b/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md @@ -1,24 +1,26 @@ --- title: Protect devices from unwanted network traffic (Windows) description: Learn how running a host-based firewall on every device in your organization can help protect against attacks as part of a defense-in-depth security strategy. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 01/18/2022 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Protect devices from unwanted network traffic -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Although network perimeter firewalls provide important protection to network resources from external threats, there are network threats that a perimeter firewall can't protect against. Some attacks might successfully penetrate the perimeter firewall, and at that point what can stop it? Other attacks might originate from inside the network, such as malware that is brought in on portable media and run on a trusted device. Portable devices are often taken outside the network and connected directly to the Internet, without adequate protection between the device and security threats. diff --git a/windows/security/threat-protection/windows-firewall/quarantine.md b/windows/security/threat-protection/windows-firewall/quarantine.md index debe26322b..c914408573 100644 --- a/windows/security/threat-protection/windows-firewall/quarantine.md +++ b/windows/security/threat-protection/windows-firewall/quarantine.md @@ -1,16 +1,22 @@ --- title: Quarantine behavior description: Quarantine behavior is explained in detail. -ms.author: v-bshilpa -author: Benny-54 -manager: dansimp -ms.reviewer: +ms.author: paoloma +author: paolomatarazzo +manager: aaroncz +ms.reviewer: jekrynit ms.prod: m365-security ms.localizationpriority: normal ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Quarantine behavior diff --git a/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md index 92a170d7ef..eda42f13e6 100644 --- a/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md +++ b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md @@ -1,24 +1,26 @@ --- title: Require Encryption When Accessing Sensitive Network Resources (Windows) description: Windows Defender Firewall with Advanced Security allows you to require that all network traffic in an isolated domain be encrypted. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Require Encryption When Accessing Sensitive Network Resources -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above The use of authentication in the previously described goal ([Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)) enables a device in the isolated domain to block traffic from untrusted devices. However, it doesn't prevent an untrusted device from eavesdropping on the network traffic shared between two trusted devices, because by default network packets aren't encrypted. diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md index f9a9247b52..1b7a5eef66 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md @@ -1,24 +1,26 @@ --- title: Restrict Access to Only Specified Users or Devices (Windows) description: Restrict access to devices and users that are members of domain groups authorized to access that device using Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Restrict Access to Only Specified Users or Computers -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Domain isolation (as described in the previous goal [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)) prevents devices that are members of the isolated domain from accepting network traffic from untrusted devices. However, some devices on the network might host sensitive data that must be additionally restricted to only those users and computers that have a business requirement to access the data. diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md index 6f48e70c2f..83e9ef9191 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md @@ -1,24 +1,26 @@ --- title: Restrict access to only trusted devices (Windows) description: Windows Defender Firewall with Advanced Security enables you to isolate devices you trust and restrict access of untrusted devices to trusted devices. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Restrict access to only trusted devices -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Your organizational network likely has a connection to the Internet. You also likely have partners, vendors, or contractors who attach devices that aren't owned by your organization to your network. Because you don't manage those devices, you can't trust them to be free of malicious software, maintained with the latest security updates, or in any way in compliance with your organization's security policies. These untrustworthy devices both on and outside of your physical network must not be permitted to access your organization's devices except where it's truly required. diff --git a/windows/security/threat-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md b/windows/security/threat-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md index d405ae9ad9..ccd8c1f678 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md +++ b/windows/security/threat-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md @@ -1,24 +1,26 @@ --- title: Restrict Server Access to Members of a Group Only (Windows) description: Create a firewall rule to access isolated servers running Windows Server 2008 or later and restrict server access to members of a group. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Restrict Server Access to Members of a Group Only -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After you have configured the IPsec connection security rules that force client devices to authenticate their connections to the isolated server, you must configure the rules that restrict access to only those devices or users who have been identified through the authentication process as members of the isolated server’s access group. diff --git a/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md index e43a977d74..5de4aeebab 100644 --- a/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md +++ b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md @@ -3,22 +3,24 @@ title: Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 20 description: Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012 ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Securing End-to-End IPsec connections by using IKEv2 -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above IKEv2 offers the following: diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-gpos.md b/windows/security/threat-protection/windows-firewall/server-isolation-gpos.md index 6c2574d928..15f710e53b 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-gpos.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-gpos.md @@ -1,24 +1,26 @@ --- title: Server Isolation GPOs (Windows) description: Learn about required GPOs for isolation zones and how many server isolation zones you need in Windows Defender Firewall with Advanced Security. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Server Isolation GPOs -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Each set of devices that have different users or devices accessing them require a separate server isolation zone. Each zone requires one GPO for each version of Windows running on devices in the zone. The Woodgrove Bank example has an isolation zone for their devices that run SQL Server. The server isolation zone is logically considered part of the encryption zone. Therefore, server isolation zone GPOs must also include rules for encrypting all isolated server traffic. Woodgrove Bank copied the encryption zone GPOs to serve as a starting point, and renamed them to reflect their new purpose. diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md index bfade02b3c..f920003a00 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md @@ -1,24 +1,26 @@ --- title: Server Isolation Policy Design Example (Windows) description: Learn about server isolation policy design in Windows Defender Firewall with Advanced Security by referring to this example of a fictitious company. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Server Isolation Policy Design Example -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This design example continues to use the fictitious company Woodgrove Bank, as described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section and the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) section. diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md index 91160b8e0a..5dc27f7b43 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md @@ -1,24 +1,26 @@ --- title: Server Isolation Policy Design (Windows) description: Learn about server isolation policy design, where you assign servers to a zone that allows access only to members of an approved network access group. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Server Isolation Policy Design -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above In the server isolation policy design, you assign servers to a zone that allows access only to users and devices that authenticate as members of an approved network access group (NAG). diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index a0116d71eb..9796a30b9e 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -1,17 +1,23 @@ --- title: Troubleshooting UWP App Connectivity Issues in Windows Firewall description: Troubleshooting UWP App Connectivity Issues in Windows Firewall -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: - m365-security-compliance - m365-initiative-windows-security ms.topic: troubleshooting ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Troubleshooting UWP App Connectivity Issues diff --git a/windows/security/threat-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md b/windows/security/threat-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md index 64a55b790e..72d9d7fa43 100644 --- a/windows/security/threat-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md +++ b/windows/security/threat-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md @@ -1,24 +1,26 @@ --- title: Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior (Windows) description: Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above To enable Windows Defender Firewall with Advanced Security and configure its default behavior, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console. diff --git a/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md b/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md index dd58d0c8d0..e924d932ea 100644 --- a/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md +++ b/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md @@ -3,14 +3,20 @@ title: Understand WFAS Deployment (Windows) description: Resources for helping you understand the Windows Defender Firewall with Advanced Security (WFAS) Design Process ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Understanding the Windows Defender Firewall with Advanced Security Design Process diff --git a/windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md b/windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md index 3f49bc068c..9359451826 100644 --- a/windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md +++ b/windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md @@ -1,24 +1,26 @@ --- title: Verify That Network Traffic Is Authenticated (Windows) description: Learn how to confirm that network traffic is being protected by IPsec authentication after you configure your domain isolation rule to require authentication. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Verify That Network Traffic Is Authenticated -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above After you've configured your domain isolation rule to request, rather than require, authentication, you must confirm that the network traffic sent by the devices on the network is being protected by IPsec authentication as expected. If you switch your rules to require authentication before all of the devices have received and applied the correct GPOs, or if there are any errors in your rules, then communications on the network can fail. By first setting the rules to request authentication, any network connections that fail authentication can continue in clear text while you diagnose and troubleshoot. diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md index 7173220848..14a6de27f4 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md @@ -3,22 +3,24 @@ title: Windows Defender Firewall with Advanced Security Administration with Wind description: Windows Defender Firewall with Advanced Security Administration with Windows PowerShell ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Windows Defender Firewall with Advanced Security Administration with Windows PowerShell -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above The Windows Defender Firewall with Advanced Security Administration with Windows PowerShell Guide provides essential scriptlets for automating Windows Defender Firewall management. It's designed for IT pros, system administrators, IT managers, and others who use and need to automate Windows Defender Firewall management in Windows. diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md index f0ec1fb9dc..b2d5a9b049 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md @@ -1,24 +1,26 @@ --- title: Windows Defender Firewall with Advanced Security deployment overview (Windows) description: Use this guide to deploy Windows Defender Firewall with Advanced Security for your enterprise to help protect devices and data that they share across a network. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Windows Defender Firewall with Advanced Security deployment overview -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above You can use the Windows Defender Firewall with Advanced Security MMC snap-in with devices running at least Windows Vista or Windows Server 2008 to help protect the devices and the data that they share across a network. diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md index 791816f439..b23f7bc963 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md @@ -1,24 +1,26 @@ --- title: Windows Defender Firewall with Advanced Security design guide (Windows) description: Learn about common goals for using Windows Defender Firewall with Advanced Security to choose or create a design for deploying the firewall in your enterprise. -ms.reviewer: -ms.author: dansimp +ms.reviewer: jekrynit +ms.author: paoloma ms.prod: m365-security ms.localizationpriority: medium -author: dansimp -manager: dansimp +author: paolomatarazzo +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Windows Defender Firewall with Advanced Security design guide -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above Windows Defender Firewall with Advanced Security is a host firewall that helps secure the device in two ways. First, it can filter the network traffic permitted to enter the device from the network, and also control what network traffic the device is allowed to send to the network. Second, Windows Defender Firewall supports IPsec, which enables you to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that can't authenticate can't communicate with your device. By using IPsec, you can also require that specific network traffic be encrypted to prevent it from being read or intercepted while in transit between devices. diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md index 297a720a7a..dc08cf7455 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md @@ -3,23 +3,25 @@ title: Windows Defender Firewall with Advanced Security (Windows) description: Learn overview information about the Windows Defender Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features. ms.prod: m365-security ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -manager: dansimp +author: paolomatarazzo +ms.author: paoloma +manager: aaroncz ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/08/2021 -ms.reviewer: +ms.reviewer: jekrynit ms.custom: asr ms.technology: windows-sec +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 +- ✅ Windows Server 2016 +- ✅ Windows Server 2019 +- ✅ Windows Server 2022 --- # Windows Defender Firewall with Advanced Security -**Applies to** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above This topic is an overview of the Windows Defender Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features.