From 79effbe3a7d95dd7299acb06ba258e8e4ca8a21d Mon Sep 17 00:00:00 2001 From: educabanillas <142420277+educabanillas@users.noreply.github.com> Date: Wed, 20 Sep 2023 13:03:44 +0200 Subject: [PATCH 01/12] Update dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md Wrong description of procedure. All DCOM permission are retired --- ...ns-in-security-descriptor-definition-language-sddl-syntax.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 81cfb68761..449f99f377 100644 --- a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -37,7 +37,7 @@ Access and Remote Access permissions to users and groups. We recommend that you - Blank - This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it to Not defined. The Blank value is set by using the ACL editor to empty the list, and then pressing OK. + This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it as Not defined. To set a blank value, select "Define this policy setting" and leave the Security descriptor empty, and then select OK. - *User-defined input* of the SDDL representation of the groups and privileges From ebc22ff43e6a978d3a3ac2f43b4e546a78fe7b50 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Fri, 29 Sep 2023 15:38:51 -0700 Subject: [PATCH 02/12] Learn Editor: Update best-practices-configuring.md --- .../best-practices-configuring.md | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index a61bf25eec..6b3171e2a1 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -208,3 +208,34 @@ For tasks related to creating outbound rules, see [Checklist: Creating Outbound ## Document your changes When creating an inbound or outbound rule, you should specify details about the app itself, the port range used, and important notes like creation date. Rules must be well-documented for ease of review both by you and other admins. We highly encourage taking the time to make the work of reviewing your firewall rules at a later date easier. And *never* create unnecessary holes in your firewall. + +## Configure Windows Firewall rules with WDAG tagging policies + +Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: + +**Step 1: Deploy WDAC AppId Tagging Policies** + +A Windows Defender Application Control (WDAC) policy needs to be deployed which specifies individual applications or groups of applications to apply a PolicyAppId tag to the process token(s). Then, the admin can define firewall rules which are scoped to all processes tagged with the matching PolicyAppId.   + +Follow the detailed [WDAC Application ID (AppId) Tagging Guide](/windows/security/threat-protection/windows-defender-application-control/appidtagging/windows-defender-application-control-appid-tagging-guide) to create, deploy, and test an AppID (Application ID) policy to tag applications.  + +**Step 2: Configure Firewall Rules using PolicyAppId Tags**  + +- **Deploy firewall rules with Intune:** When creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider ](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. +You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules. + +OR + +- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2022-ps) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  + +> [!NOTE] +> WDAC AppId Tagging Policies are available on the following versions of the Windows platform:  +> +> - Windows 10, versions 20H1 and above  + +> - Windows 11  + +> - Windows Server 2022 and above  + +> + From b5ca81edd4f369cf9295aaf0852e87c9e5236675 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Tue, 3 Oct 2023 14:20:22 -0700 Subject: [PATCH 04/12] Update best-practices-configuring.md removed notes for editions --- .../windows-firewall/best-practices-configuring.md | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 6b3171e2a1..2f4aaaafc8 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -228,14 +228,4 @@ OR - **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2022-ps) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  -> [!NOTE] -> WDAC AppId Tagging Policies are available on the following versions of the Windows platform:  -> -> - Windows 10, versions 20H1 and above  - -> - Windows 11  - -> - Windows Server 2022 and above  - -> From 477d5ea2f7769124f0413f46fcbe90fb01a88563 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Tue, 3 Oct 2023 14:29:38 -0700 Subject: [PATCH 05/12] Update best-practices-configuring.md url correction --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 2f4aaaafc8..cc0305632e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -226,6 +226,6 @@ You can do this through the Intune admin center under Endpoint security > Firewa OR -- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2022-ps) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  +- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  From 090e7ae13bf9aff5fa085c7070f5cf91672bddc6 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Tue, 3 Oct 2023 14:30:15 -0700 Subject: [PATCH 06/12] Update best-practices-configuring.md --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index cc0305632e..0eab04c64d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -209,7 +209,7 @@ For tasks related to creating outbound rules, see [Checklist: Creating Outbound When creating an inbound or outbound rule, you should specify details about the app itself, the port range used, and important notes like creation date. Rules must be well-documented for ease of review both by you and other admins. We highly encourage taking the time to make the work of reviewing your firewall rules at a later date easier. And *never* create unnecessary holes in your firewall. -## Configure Windows Firewall rules with WDAG tagging policies +## Configure Windows Firewall rules with WDAC tagging policies Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: From ac951fcbdc940aa4513476e37ae79df953a220ed Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Wed, 11 Oct 2023 10:51:49 -0700 Subject: [PATCH 07/12] Update windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 0eab04c64d..37c7bd40cd 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -213,7 +213,7 @@ When creating an inbound or outbound rule, you should specify details about the Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: -**Step 1: Deploy WDAC AppId Tagging Policies** +### Step 1: Deploy WDAC AppId Tagging Policies A Windows Defender Application Control (WDAC) policy needs to be deployed which specifies individual applications or groups of applications to apply a PolicyAppId tag to the process token(s). Then, the admin can define firewall rules which are scoped to all processes tagged with the matching PolicyAppId.   From 3819fb16e3dcd5666c337098380a971a8c8fda46 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Wed, 11 Oct 2023 10:52:06 -0700 Subject: [PATCH 08/12] Update windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 37c7bd40cd..9db1183c80 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -219,7 +219,7 @@ A Windows Defender Application Control (WDAC) policy needs to be deployed which Follow the detailed [WDAC Application ID (AppId) Tagging Guide](/windows/security/threat-protection/windows-defender-application-control/appidtagging/windows-defender-application-control-appid-tagging-guide) to create, deploy, and test an AppID (Application ID) policy to tag applications.  -**Step 2: Configure Firewall Rules using PolicyAppId Tags**  +### Step 2: Configure Firewall Rules using PolicyAppId Tags - **Deploy firewall rules with Intune:** When creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider ](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules. From 03f7d28f345d252eba145843d31783c67efa7bfe Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Wed, 11 Oct 2023 10:52:36 -0700 Subject: [PATCH 09/12] Update windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 9db1183c80..45c223f957 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -226,6 +226,6 @@ You can do this through the Intune admin center under Endpoint security > Firewa OR -- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  +- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the `–PolicyAppId` tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  From 710cfe8cca823f8ace97c489c9249b3a89551eee Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 17 Oct 2023 10:39:00 -0400 Subject: [PATCH 10/12] Update windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...ns-in-security-descriptor-definition-language-sddl-syntax.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 449f99f377..d4c07f3415 100644 --- a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -37,7 +37,7 @@ Access and Remote Access permissions to users and groups. We recommend that you - Blank - This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it as Not defined. To set a blank value, select "Define this policy setting" and leave the Security descriptor empty, and then select OK. + This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it as Not defined. To set a blank value, select "Define this policy setting" and leave the Security descriptor empty, then select OK. - *User-defined input* of the SDDL representation of the groups and privileges From af383407f685b2696cd9d9ee0cda7689b0fed290 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 17 Oct 2023 13:58:34 -0700 Subject: [PATCH 11/12] Add image borders to screenshots without visible borders type="content" adds 1-pixel grey borders --- .../windows-firewall/best-practices-configuring.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index a61bf25eec..4c281e49a8 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -105,7 +105,7 @@ To determine why some applications are blocked from communicating in the network Creation of application rules at runtime can also be prohibited by administrators using the Settings app or Group Policy. -![Windows Firewall prompt.](images/fw04-userquery.png) +:::image type="content" alt-text="Windows Firewall prompt." source="images/fw04-userquery.png"::: *Figure 4: Dialog box to allow access* @@ -185,7 +185,7 @@ incoming connections, including those in the list of allowed apps** setting foun *Figure 6: Windows settings App/Windows Security/Firewall Protection/Network Type* -![Firewall cpl.](images/fw07-legacy.png) +:::image type="content" alt-text="Firewall cpl." source="images/fw07-legacy.png"::: *Figure 7: Legacy firewall.cpl* From d81b5b3a59551541a647e1afad0acc322eb86d89 Mon Sep 17 00:00:00 2001 From: Alex Buck Date: Tue, 17 Oct 2023 23:07:08 -0400 Subject: [PATCH 12/12] [BULK] - DocuTune - Rebranding of Azure Active Dir --- .../private-app-repository-mdm-company-portal-windows-11.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md index 93ceaacb2c..cb4377d22d 100644 --- a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md +++ b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md @@ -63,7 +63,7 @@ To install the Company Portal app, you have some options: - [What is co-management?](/mem/configmgr/comanage/overview) - [Use the Company Portal app on co-managed devices](/mem/configmgr/comanage/company-portal) -- **Use Windows Autopilot**: Windows Autopilot automatically provisions devices, registers them in your Azure AD organization (tenant), and gets them ready for production. If you're purchasing new devices, then we recommend using Windows Autopilot to preconfigure the devices, and get them ready for use. +- **Use Windows Autopilot**: Windows Autopilot automatically provisions devices, registers them in your Microsoft Entra organization (tenant), and gets them ready for production. If you're purchasing new devices, then we recommend using Windows Autopilot to preconfigure the devices, and get them ready for use. - In the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), you add the Company Portal app from the Microsoft Store. Once it's added, the app can be included in your Windows Autopilot deployment. When the device turns on and is getting ready, the Company Portal app is also installed, before users sign in.