deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-19 12:23:37 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream/public' into gental-giant-1909-endpoints

Browse Source
This commit is contained in:
Harun Kimani
2020-07-20 14:25:36 -07:00
parent 36377d2f35 03fa7aa96b
commit 1d0cba8919
30 changed files with 918 additions and 706 deletions
Download Patch File Download Diff File Expand all files Collapse all files

920
.openpublishing.publish.config.json
View File

@ -1,484 +1,436 @@
{ {
"build_entry_point": "", "build_entry_point": "",
"docsets_to_publish": [ "docsets_to_publish": [
{ {
"docset_name": "education", "docset_name": "education",
"build_source_folder": "education", "build_source_folder": "education",
"build_output_subfolder": "education", "build_output_subfolder": "education",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": false, "open_to_public_contributors": false,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "hololens", "docset_name": "hololens",
"build_source_folder": "devices/hololens", "build_source_folder": "devices/hololens",
"build_output_subfolder": "hololens", "build_output_subfolder": "hololens",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "internet-explorer", "docset_name": "internet-explorer",
"build_source_folder": "browsers/internet-explorer", "build_source_folder": "browsers/internet-explorer",
"build_output_subfolder": "internet-explorer", "build_output_subfolder": "internet-explorer",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": false, "open_to_public_contributors": false,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "keep-secure", "docset_name": "keep-secure",
"build_source_folder": "windows/keep-secure", "build_source_folder": "windows/keep-secure",
"build_output_subfolder": "keep-secure", "build_output_subfolder": "keep-secure",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": false, "open_to_public_contributors": false,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "mdop", "docset_name": "microsoft-edge",
"build_source_folder": "mdop", "build_source_folder": "browsers/edge",
"build_output_subfolder": "mdop", "build_output_subfolder": "microsoft-edge",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": false,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "microsoft-edge", "docset_name": "release-information",
"build_source_folder": "browsers/edge", "build_source_folder": "windows/release-information",
"build_output_subfolder": "microsoft-edge", "build_output_subfolder": "release-information",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": false, "open_to_public_contributors": false,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "release-information", "docset_name": "smb",
"build_source_folder": "windows/release-information", "build_source_folder": "smb",
"build_output_subfolder": "release-information", "build_output_subfolder": "smb",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": false, "open_to_public_contributors": false,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "smb", "docset_name": "store-for-business",
"build_source_folder": "smb", "build_source_folder": "store-for-business",
"build_output_subfolder": "smb", "build_output_subfolder": "store-for-business",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": false, "open_to_public_contributors": false,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "store-for-business", "docset_name": "win-access-protection",
"build_source_folder": "store-for-business", "build_source_folder": "windows/access-protection",
"build_output_subfolder": "store-for-business", "build_output_subfolder": "win-access-protection",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": false, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "surface", "docset_name": "win-app-management",
"build_source_folder": "devices/surface", "build_source_folder": "windows/application-management",
"build_output_subfolder": "surface", "build_output_subfolder": "win-app-management",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": false,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "surface-hub", "docset_name": "win-client-management",
"build_source_folder": "devices/surface-hub", "build_source_folder": "windows/client-management",
"build_output_subfolder": "surface-hub", "build_output_subfolder": "win-client-management",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "win-access-protection", "docset_name": "win-configuration",
"build_source_folder": "windows/access-protection", "build_source_folder": "windows/configuration",
"build_output_subfolder": "win-access-protection", "build_output_subfolder": "win-configuration",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": false,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "win-app-management", "docset_name": "win-deployment",
"build_source_folder": "windows/application-management", "build_source_folder": "windows/deployment",
"build_output_subfolder": "win-app-management", "build_output_subfolder": "win-deployment",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": false, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "win-client-management", "docset_name": "win-device-security",
"build_source_folder": "windows/client-management", "build_source_folder": "windows/device-security",
"build_output_subfolder": "win-client-management", "build_output_subfolder": "win-device-security",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "win-configuration", "docset_name": "windows-configure",
"build_source_folder": "windows/configuration", "build_source_folder": "windows/configure",
"build_output_subfolder": "win-configuration", "build_output_subfolder": "windows-configure",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": false, "open_to_public_contributors": false,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "win-deployment", "docset_name": "windows-deploy",
"build_source_folder": "windows/deployment", "build_source_folder": "windows/deploy",
"build_output_subfolder": "win-deployment", "build_output_subfolder": "windows-deploy",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "win-device-security", "docset_name": "windows-hub",
"build_source_folder": "windows/device-security", "build_source_folder": "windows/hub",
"build_output_subfolder": "win-device-security", "build_output_subfolder": "windows-hub",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "windows-configure", "docset_name": "windows-manage",
"build_source_folder": "windows/configure", "build_source_folder": "windows/manage",
"build_output_subfolder": "windows-configure", "build_output_subfolder": "windows-manage",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": false, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "windows-deploy", "docset_name": "windows-plan",
"build_source_folder": "windows/deploy", "build_source_folder": "windows/plan",
"build_output_subfolder": "windows-deploy", "build_output_subfolder": "windows-plan",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "windows-hub", "docset_name": "windows-privacy",
"build_source_folder": "windows/hub", "build_source_folder": "windows/privacy",
"build_output_subfolder": "windows-hub", "build_output_subfolder": "windows-privacy",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "windows-manage", "docset_name": "windows-security",
"build_source_folder": "windows/manage", "build_source_folder": "windows/security",
"build_output_subfolder": "windows-manage", "build_output_subfolder": "windows-security",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "windows-plan", "docset_name": "windows-update",
"build_source_folder": "windows/plan", "build_source_folder": "windows/update",
"build_output_subfolder": "windows-plan", "build_output_subfolder": "windows-update",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "windows-privacy", "docset_name": "win-threat-protection",
"build_source_folder": "windows/privacy", "build_source_folder": "windows/threat-protection",
"build_output_subfolder": "windows-privacy", "build_output_subfolder": "win-threat-protection",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, },
{ {
"docset_name": "windows-security", "docset_name": "win-whats-new",
"build_source_folder": "windows/security", "build_source_folder": "windows/whats-new",
"build_output_subfolder": "windows-security", "build_output_subfolder": "win-whats-new",
"locale": "en-us", "locale": "en-us",
"monikers": [], "monikers": [],
"moniker_ranges": [], "moniker_ranges": [],
"open_to_public_contributors": true, "open_to_public_contributors": true,
"type_mapping": { "type_mapping": {
"Conceptual": "Content", "Conceptual": "Content",
"ManagedReference": "Content", "ManagedReference": "Content",
"RestApi": "Content" "RestApi": "Content"
}, },
"build_entry_point": "docs", "build_entry_point": "docs",
"template_folder": "_themes" "template_folder": "_themes"
}, }
{ ],
"docset_name": "windows-update", "notification_subscribers": [
"build_source_folder": "windows/update", "elizapo@microsoft.com"
"build_output_subfolder": "windows-update", ],
"locale": "en-us", "sync_notification_subscribers": [
"monikers": [], "daniha@microsoft.com"
"moniker_ranges": [], ],
"open_to_public_contributors": true, "branches_to_filter": [
"type_mapping": { ""
"Conceptual": "Content", ],
"ManagedReference": "Content", "git_repository_url_open_to_public_contributors": "https://github.com/MicrosoftDocs/windows-itpro-docs",
"RestApi": "Content" "git_repository_branch_open_to_public_contributors": "public",
}, "skip_source_output_uploading": false,
"build_entry_point": "docs", "need_preview_pull_request": true,
"template_folder": "_themes" "resolve_user_profile_using_github": true,
}, "contribution_branch_mappings": {},
{ "dependent_repositories": [
"docset_name": "win-threat-protection", {
"build_source_folder": "windows/threat-protection", "path_to_root": "_themes.pdf",
"build_output_subfolder": "win-threat-protection", "url": "https://github.com/Microsoft/templates.docs.msft.pdf",
"locale": "en-us", "branch": "master",
"monikers": [], "branch_mapping": {}
"moniker_ranges": [], },
"open_to_public_contributors": true, {
"type_mapping": { "path_to_root": "_themes",
"Conceptual": "Content", "url": "https://github.com/Microsoft/templates.docs.msft",
"ManagedReference": "Content", "branch": "master",
"RestApi": "Content" "branch_mapping": {}
}, }
"build_entry_point": "docs", ],
"template_folder": "_themes" "branch_target_mapping": {
}, "live": [
{ "Publish",
"docset_name": "win-whats-new", "Pdf"
"build_source_folder": "windows/whats-new", ],
"build_output_subfolder": "win-whats-new", "master": [
"locale": "en-us", "Publish",
"monikers": [], "Pdf"
"moniker_ranges": [], ]
"open_to_public_contributors": true, },
"type_mapping": { "need_generate_pdf_url_template": true,
"Conceptual": "Content", "targets": {
"ManagedReference": "Content", "Pdf": {
"RestApi": "Content" "template_folder": "_themes.pdf"
}, }
"build_entry_point": "docs", },
"template_folder": "_themes" "need_generate_pdf": false,
} "need_generate_intellisense": false
], }
"notification_subscribers": [
"elizapo@microsoft.com"
],
"sync_notification_subscribers": [
"daniha@microsoft.com"
],
"branches_to_filter": [
""
],
"git_repository_url_open_to_public_contributors": "https://github.com/MicrosoftDocs/windows-itpro-docs",
"git_repository_branch_open_to_public_contributors": "public",
"skip_source_output_uploading": false,
"need_preview_pull_request": true,
"resolve_user_profile_using_github": true,
"contribution_branch_mappings": {},
"dependent_repositories": [
{
"path_to_root": "_themes.pdf",
"url": "https://github.com/Microsoft/templates.docs.msft.pdf",
"branch": "master",
"branch_mapping": {}
},
{
"path_to_root": "_themes",
"url": "https://github.com/Microsoft/templates.docs.msft",
"branch": "master",
"branch_mapping": {}
}
],
"branch_target_mapping": {
"live": [
"Publish",
"Pdf"
],
"master": [
"Publish",
"Pdf"
]
},
"need_generate_pdf_url_template": true,
"targets": {
"Pdf": {
"template_folder": "_themes.pdf"
}
},
"need_generate_pdf": false,
"need_generate_intellisense": false
}

2
windows/client-management/mdm/policy-csp-update.md
View File

@ -3256,7 +3256,7 @@ The following list shows the supported values:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
> [!NOTE] > [!NOTE]
> If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. > This policy is *only* recommended for managing mobile devices. If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead.
Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved. Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved.

2
windows/client-management/mdm/update-csp.md
View File

@ -17,7 +17,7 @@ ms.date: 02/23/2018
The Update configuration service provider enables IT administrators to manage and control the rollout of new updates. The Update configuration service provider enables IT administrators to manage and control the rollout of new updates.
> [!Note] > [!Note]
> All aspects of the Update CSP aside from Rollback are not recommended for managing desktop devices. To manage desktop devices from Windows Update, see the [Policy CSP - Updates](policy-csp-update.md) documentation. Rollback can be used for desktop devices on 1803 and above. > The Update CSP functionality of 'AprrovedUpdates' is not recommended for managing desktop devices. To manage updates to desktop devices from Windows Update, see the [Policy CSP - Updates](policy-csp-update.md) documentation for the recommended policies.
The following diagram shows the Update configuration service provider in tree format. The following diagram shows the Update configuration service provider in tree format.

2
windows/deployment/windows-autopilot/white-glove.md
View File

@ -59,7 +59,7 @@ To enable white glove deployment, an additional Autopilot profile setting must b
![allow white glove](images/allow-white-glove-oobe.png) ![allow white glove](images/allow-white-glove-oobe.png)
The Windows Autopilot for white glove deployment pre-provisioning process will apply all device-targeted policies from Intune. That includes certificates, security templates, settings, apps, and more – anything targeting the device. Additionally, any apps (Win32 or LOB) that are configured to install in the device context and targeted to the user that has been pre-assigned to the Autopilot device will also be installed. Please make sure not to target both win32 and LOB apps to the same device. The Windows Autopilot for white glove deployment pre-provisioning process will apply all device-targeted policies from Intune. That includes certificates, security templates, settings, apps, and more – anything targeting the device. Additionally, any apps (Win32 or LOB) that are configured to install in the device context and targeted to the user that has been pre-assigned to the Autopilot device will also be installed. Please make sure not to target both win32 and LOB apps to the same device, as this can make troubleshooting difficult if there are app installation failures. For more information, see [Add a Windows line-of-business app to Microsoft Intune](https://docs.microsoft.com/mem/intune/apps/lob-apps-windows).
> [!NOTE] > [!NOTE]
> The white glove technician phase will install all device-targeted apps as well as any user-targeted, device-context apps that are targeted to the assigned user. If there is no assigned user, then it will only install the device-targeted apps. Other user-targeted policies will not apply until the user signs into the device. To verify these behaviors, be sure to create appropriate apps and policies targeted to devices and users. > The white glove technician phase will install all device-targeted apps as well as any user-targeted, device-context apps that are targeted to the assigned user. If there is no assigned user, then it will only install the device-targeted apps. Other user-targeted policies will not apply until the user signs into the device. To verify these behaviors, be sure to create appropriate apps and policies targeted to devices and users.

6
windows/deployment/windows-autopilot/windows-autopilot-scenarios.md
View File

@ -35,6 +35,12 @@ The following Windows Autopilot scenarios are described in this guide:
| Pre-provision a device with up-to-date applications, policies and settings.| [White glove](white-glove.md) | | Pre-provision a device with up-to-date applications, policies and settings.| [White glove](white-glove.md) |
| Deploy Windows 10 on an existing Windows 7 or 8.1 device | [Windows Autopilot for existing devices](existing-devices.md) | | Deploy Windows 10 on an existing Windows 7 or 8.1 device | [Windows Autopilot for existing devices](existing-devices.md) |
These scenarios are summarized in the following video.
&nbsp;
> [!video https://www.microsoft.com/videoplayer/embed/RE4Ci1b?autoplay=false]
## Windows Autopilot capabilities ## Windows Autopilot capabilities
### Windows Autopilot is self-updating during OOBE ### Windows Autopilot is self-updating during OOBE

18
windows/deployment/windows-autopilot/windows-autopilot.md
View File

@ -25,9 +25,13 @@ ms.topic: article
Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, repurpose and recover devices. This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple. Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, repurpose and recover devices. This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple.
Windows Autopilot is designed to simplify all parts of the lifecycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users. See the following diagram: Windows Autopilot is designed to simplify all parts of the lifecycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users. See the following video and diagram:
![Process overview](images/image1.png) &nbsp;
> [!video https://www.microsoft.com/videoplayer/embed/RE4C7G9?autoplay=false]
![Process overview](images/image1.png)
When initially deploying new Windows devices, Windows Autopilot leverages the OEM-optimized version of Windows 10 that is preinstalled on the device, saving organizations the effort of having to maintain custom images and drivers for every model of device being used. Instead of re-imaging the device, your existing Windows 10 installation can be transformed into a “business-ready” state, applying settings and policies, installing apps, and even changing the edition of Windows 10 being used (e.g. from Windows 10 Pro to Windows 10 Enterprise) to support advanced features. When initially deploying new Windows devices, Windows Autopilot leverages the OEM-optimized version of Windows 10 that is preinstalled on the device, saving organizations the effort of having to maintain custom images and drivers for every model of device being used. Instead of re-imaging the device, your existing Windows 10 installation can be transformed into a “business-ready” state, applying settings and policies, installing apps, and even changing the edition of Windows 10 being used (e.g. from Windows 10 Pro to Windows 10 Enterprise) to support advanced features.
@ -40,16 +44,6 @@ Windows Autopilot enables you to:
* Create and auto-assign devices to configuration groups based on a device's profile. * Create and auto-assign devices to configuration groups based on a device's profile.
* Customize OOBE content specific to the organization. * Customize OOBE content specific to the organization.
## Windows Autopilot walkthrough
The following video shows the process of setting up Windows Autopilot:
</br>
<iframe width="560" height="315" src="https://www.youtube.com/embed/4K4hC5NchbE" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
This video is also available [here](https://www.microsoft.com/videoplayer/embed/RE4ATOx).
## Benefits of Windows Autopilot ## Benefits of Windows Autopilot
Traditionally, IT pros spend a lot of time building and customizing images that will later be deployed to devices. Windows Autopilot introduces a new approach. Traditionally, IT pros spend a lot of time building and customizing images that will later be deployed to devices. Windows Autopilot introduces a new approach.

1
windows/privacy/manage-windows-2004-endpoints.md
View File

@ -85,6 +85,7 @@ The following methodology was used to derive these network endpoints:
|||HTTPS|*ow1.res.office365.com| |||HTTPS|*ow1.res.office365.com|
|||HTTPS|office.com| |||HTTPS|office.com|
|||HTTPS|blobs.officehome.msocdn.com| |||HTTPS|blobs.officehome.msocdn.com|
|||HTTPS|self.events.data.microsoft.com|
|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)| |OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)|
|||TLSv1.2|*g.live.com| |||TLSv1.2|*g.live.com|
|||TLSv1.2|oneclient.sfx.ms| |||TLSv1.2|oneclient.sfx.ms|

28
windows/security/identity-protection/credential-guard/credential-guard-manage.md
View File

@ -8,11 +8,14 @@ ms.pagetype: security
ms.localizationpriority: medium ms.localizationpriority: medium
audience: ITPro audience: ITPro
author: dulcemontemayor author: dulcemontemayor
ms.author: dansimp ms.author: v-tea
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
ms.reviewer: ms.reviewer:
ms.custom:
- CI 120967
- CSSTroubleshooting
--- ---
# Manage Windows Defender Credential Guard # Manage Windows Defender Credential Guard
@ -154,14 +157,25 @@ DG_Readiness_Tool_v3.6.ps1 -Ready
- You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: - You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for:
- **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials. - **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials.
- **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: 0x1, 0 - **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: \[**0x0** \| **0x1** \| **0x2**\], **0**
- The first variable: 0x1 means Windows Defender Credential Guard is configured to run. 0x0 means it's not configured to run. - The first variable: **0x1** or **0x2** means that Windows Defender Credential Guard is configured to run. **0x0** means that it's not configured to run.
- The second variable: 0 means it's configured to run in protect mode. 1 means it's configured to run in test mode. This variable should always be 0. - The second variable: **0** means that it's configured to run in protect mode. **1** means that it's configured to run in test mode. This variable should always be **0**.
- **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard. - **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard.
- **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\] - **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\]
- **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] - **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\]
You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -&gt; **Windows** -&gt; **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -&gt; **Windows** -&gt; **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0.
- **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x0. - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: **0x0**. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: **0x1**. TPM PCR mask: **0x0**.
- You can use Windows Powershell to determine whether credential guard is running on a client computer. On the computer in question, open an elevated Powershell window and run the following command:
```powershell
(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning
```
This command generates the following output:
- **0**: Windows Defender Credential Guard is disabled (not running)
- **1**: Windows Defender Credential Guard is enabled (running)
> [!NOTE]
> Checking the task list or Task Manager to see if LSAISO.exe is running is not a recommended method for determining whether Windows Defender Credential Guard is running.
## Disable Windows Defender Credential Guard ## Disable Windows Defender Credential Guard
@ -221,7 +235,7 @@ You can also disable Windows Defender Credential Guard by using the [HVCI and Wi
``` ```
DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot
``` ```
> [!IMPORTANT] > [!IMPORTANT]
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. > When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
> This is a known issue. > This is a known issue.

4
windows/security/identity-protection/hello-for-business/hello-overview.md
View File

@ -99,7 +99,9 @@ Windows Hello for Business with a key does not support RDP. RDP does not support
## Learn more ## Learn more
[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/itshowcase/implementing-windows-hello-for-business-at-microsoft) [Implementing strong user authentication with Windows Hello for Business](https://www.microsoft.com/en-us/itshowcase/implementing-strong-user-authentication-with-windows-hello-for-business)
[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/en-us/itshowcase/implementing-windows-hello-for-business-at-microsoft)
[Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy [Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy

6
windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md
View File

@ -95,7 +95,7 @@ Microsoft Defender Application Guard accesses files from a VHD mounted on the ho
### Why do the Network Isolation policies in Group Policy and CSP look different? ### Why do the Network Isolation policies in Group Policy and CSP look different?
There is not a one-to-one mapping among all the Network Isolation policies between CSP and GP. Mandatary network isolation policies to deploy WDAG are different between CSP and GP. There is not a one-to-one mapping among all the Network Isolation policies between CSP and GP. Mandatory network isolation policies to deploy WDAG are different between CSP and GP.
Mandatory network isolation GP policy to deploy WDAG: "DomainSubnets or CloudResources" Mandatory network isolation GP policy to deploy WDAG: "DomainSubnets or CloudResources"
Mandatory network isolation CSP policy to deploy WDAG: "EnterpriseCloudResources or (EnterpriseIpRange and EnterpriseNetworkDomainNames)" Mandatory network isolation CSP policy to deploy WDAG: "EnterpriseCloudResources or (EnterpriseIpRange and EnterpriseNetworkDomainNames)"
@ -107,3 +107,7 @@ Windows Defender Application Guard accesses files from a VHD mounted on the host
If hyperthreading is disabled (because of an update applied through a KB article or through BIOS settings), there is a possibility Application Guard no longer meets the minimum requirements. If hyperthreading is disabled (because of an update applied through a KB article or through BIOS settings), there is a possibility Application Guard no longer meets the minimum requirements.
### Why am I getting the error message ("ERROR_VIRTUAL_DISK_LIMITATION")?
Application Guard may not work correctly on NTFS compressed volumes. If this issue persists, try uncompressing the volume.

8
windows/security/threat-protection/microsoft-defender-atp/alerts.md
View File

@ -49,9 +49,9 @@ lastEventTime | Nullable DateTimeOffset | The last occurrence of the event that
firstEventTime | Nullable DateTimeOffset | The first occurrence of the event that triggered the alert on that device. firstEventTime | Nullable DateTimeOffset | The first occurrence of the event that triggered the alert on that device.
lastUpdateTime | Nullable DateTimeOffset | The date and time (in UTC) the alert was last updated. lastUpdateTime | Nullable DateTimeOffset | The date and time (in UTC) the alert was last updated.
resolvedTime | Nullable DateTimeOffset | The date and time in which the status of the alert was changed to 'Resolved'. resolvedTime | Nullable DateTimeOffset | The date and time in which the status of the alert was changed to 'Resolved'.
incidentId | Nullable Long | The [Incident](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) ID of the Alert. incidentId | Nullable Long | The [Incident](view-incidents-queue.md) ID of the Alert.
investigationId | Nullable Long | The [Investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) ID related to the Alert. investigationId | Nullable Long | The [Investigation](automated-investigations.md) ID related to the Alert.
investigationState | Nullable Enum | The current state of the [Investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations). Possible values are: 'Unknown', 'Terminated', 'SuccessfullyRemediated', 'Benign', 'Failed', 'PartiallyRemediated', 'Running', 'PendingApproval', 'PendingResource', 'PartiallyInvestigated', 'TerminatedByUser', 'TerminatedBySystem', 'Queued', 'InnerFailure', 'PreexistingAlert', 'UnsupportedOs', 'UnsupportedAlertType', 'SuppressedAlert'. investigationState | Nullable Enum | The current state of the [Investigation](automated-investigations.md). Possible values are: 'Unknown', 'Terminated', 'SuccessfullyRemediated', 'Benign', 'Failed', 'PartiallyRemediated', 'Running', 'PendingApproval', 'PendingResource', 'PartiallyInvestigated', 'TerminatedByUser', 'TerminatedBySystem', 'Queued', 'InnerFailure', 'PreexistingAlert', 'UnsupportedOs', 'UnsupportedAlertType', 'SuppressedAlert'.
assignedTo | String | Owner of the alert. assignedTo | String | Owner of the alert.
severity | Enum | Severity of the alert. Possible values are: 'UnSpecified', 'Informational', 'Low', 'Medium' and 'High'. severity | Enum | Severity of the alert. Possible values are: 'UnSpecified', 'Informational', 'Low', 'Medium' and 'High'.
status | Enum | Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'. status | Enum | Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'.
@ -61,6 +61,8 @@ category| String | Category of the alert.
detectionSource | String | Detection source. detectionSource | String | Detection source.
threatFamilyName | String | Threat family. threatFamilyName | String | Threat family.
machineId | String | ID of a [machine](machine.md) entity that is associated with the alert. machineId | String | ID of a [machine](machine.md) entity that is associated with the alert.
computerDnsName | String | [machine](machine.md) fully qualified name.
aadTenantId | String | The Azure Active Directory ID.
comments | List of Alert comments | Alert Comment is an object that contains: comment string, createdBy string and createTime date time. comments | List of Alert comments | Alert Comment is an object that contains: comment string, createdBy string and createTime date time.
### Response example for getting single alert: ### Response example for getting single alert:

4
windows/security/threat-protection/microsoft-defender-atp/android-configure.md
View File

@ -29,8 +29,8 @@ Directory enables enforcing Device compliance and Conditional Access policies
based on device risk levels. Microsoft Defender ATP is a Mobile Threat Defense based on device risk levels. Microsoft Defender ATP is a Mobile Threat Defense
(MTD) solution that you can deploy to leverage this capability via Intune. (MTD) solution that you can deploy to leverage this capability via Intune.
For more information on how to setup Microsoft Defender ATP for Android and Conditional Access, see [Microsoft Defender ATP and For more information about how to set up Microsoft Defender ATP for Android and Conditional Access, see [Microsoft Defender ATP and
Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection#configure-web-protection-on-devices-that-run-android). Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection).
## Configure custom indicators ## Configure custom indicators

2
windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md
View File

@ -33,7 +33,7 @@ ms.date: 04/16/2020
Microsoft Defender ATP supports non-persistent VDI session onboarding. Microsoft Defender ATP supports non-persistent VDI session onboarding.
>[!Note] >[!Note]
>To onboard non-persistent VDI sessions, VDI machines must be on Windows 10. >To onboard non-persistent VDI sessions, VDI devices must be on Windows 10.
> >
>While other Windows versions might work, only Windows 10 is supported. >While other Windows versions might work, only Windows 10 is supported.

102
windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md
View File

@ -1,6 +1,6 @@
--- ---
title: Onboard servers to the Microsoft Defender ATP service title: Onboard Windows servers to the Microsoft Defender ATP service
description: Onboard servers so that they can send sensor data to the Microsoft Defender ATP sensor. description: Onboard Windows servers so that they can send sensor data to the Microsoft Defender ATP sensor.
keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, device management, configure Windows ATP servers, onboard Microsoft Defender Advanced Threat Protection servers keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, device management, configure Windows ATP servers, onboard Microsoft Defender Advanced Threat Protection servers
search.product: eADQiWindows 10XVcnh search.product: eADQiWindows 10XVcnh
search.appverid: met150 search.appverid: met150
@ -17,7 +17,7 @@ ms.collection: M365-security-compliance
ms.topic: article ms.topic: article
--- ---
# Onboard servers to the Microsoft Defender ATP service # Onboard Windows servers to the Microsoft Defender ATP service
**Applies to:** **Applies to:**
@ -34,7 +34,7 @@ ms.topic: article
Microsoft Defender ATP extends support to also include the Windows Server operating system. This support provides advanced attack detection and investigation capabilities seamlessly through the Microsoft Defender Security Center console. Microsoft Defender ATP extends support to also include the Windows Server operating system. This support provides advanced attack detection and investigation capabilities seamlessly through the Microsoft Defender Security Center console.
The service supports the onboarding of the following servers: The service supports the onboarding of the following Windows servers:
- Windows Server 2008 R2 SP1 - Windows Server 2008 R2 SP1
- Windows Server 2012 R2 - Windows Server 2012 R2
- Windows Server 2016 - Windows Server 2016
@ -44,38 +44,41 @@ The service supports the onboarding of the following servers:
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128). For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
For guidance on how to download and use Windows Security Baselines for Windows servers, see [Windows Security Baselines](https://docs.microsoft.com/windows/device-security/windows-security-baselines).
## Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016
There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016 to Microsoft Defender ATP: ## Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016
- **Option 1**: Onboard through Microsoft Defender Security Center You can onboard Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016 to Microsoft Defender ATP by using any of the following options:
- **Option 2**: Onboard through Azure Security Center
- **Option 1**: [Onboard through Microsoft Defender Security Center](#option-1-onboard-windows-servers-through-microsoft-defender-security-center)
- **Option 2**: [Onboard through Azure Security Center](#option-2-onboard-windows-servers-through-azure-security-center)
- **Option 3**: [Onboard through Microsoft Endpoint Configuration Manager version 2002 and later (only for Windows Server 2012 R2 and Windows Server 2016)](#option-3-onboard-windows-servers-through-microsoft-endpoint-configuration-manager-version-2002-and-later)
> [!NOTE] > [!NOTE]
> Microsoft defender ATP standalone server license is required, per node, in order to onboard the server through Microsoft Defender Security Center (Option 1), or an Azure Security Center Standard license is required, per node, in order to onboard a server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services). > Microsoft defender ATP standalone server license is required, per node, in order to onboard a Windows server through Microsoft Defender Security Center (Option 1), or an Azure Security Center Standard license is required, per node, in order to onboard a Windows server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services).
### Option 1: Onboard servers through Microsoft Defender Security Center ### Option 1: Onboard Windows servers through Microsoft Defender Security Center
You'll need to take the following steps if you choose to onboard servers through Microsoft Defender Security Center. Perform the following steps to onboard Windows servers through Microsoft Defender Security Center:
- For Windows Server 2008 R2 SP1 or Windows Server 2012 R2, ensure that you install the following hotfix: - For Windows Server 2008 R2 SP1 or Windows Server 2012 R2, ensure that you install the following hotfix:
- [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/en-us/help/3080149/update-for-customer-experience-and-diagnostic-telemetry) - [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/help/3080149/update-for-customer-experience-and-diagnostic-telemetry)
- In addition, for Windows Server 2008 R2 SP1, ensure that you fulfill the following requirements: - In addition, for Windows Server 2008 R2 SP1, ensure that you fulfill the following requirements:
- Install the [February monthly update rollup](https://support.microsoft.com/en-us/help/4074598/windows-7-update-kb4074598) - Install the [February monthly update rollup](https://support.microsoft.com/help/4074598/windows-7-update-kb4074598)
- Install either [.NET framework 4.5](https://www.microsoft.com/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework) - Install either [.NET framework 4.5](https://www.microsoft.com/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework)
- For Windows Server 2008 R2 SP1 and Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients. - For Windows Server 2008 R2 SP1 and Windows Server 2012 R2: [Configure and update System Center Endpoint Protection clients](#configure-and-update-system-center-endpoint-protection-clients).
> [!NOTE] > [!NOTE]
> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2. > This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2.
- Turn on server monitoring from Microsoft Defender Security Center. - [Turn on server monitoring from Microsoft Defender Security Center](#turn-on-server-monitoring-from-the-microsoft-defender-security-center-portal).
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multihoming support. - If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multihoming support.
Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent). Otherwise, [install and configure MMA to report sensor data to Microsoft Defender ATP](#install-and-configure-microsoft-monitoring-agent-mma-to-report-sensor-data-to-microsoft-defender-atp). For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
> [!TIP] > [!TIP]
> After onboarding the device, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md). > After onboarding the device, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md).
@ -94,7 +97,7 @@ The following steps are required to enable this integration:
1. In the navigation pane, select **Settings** > **Device management** > **Onboarding**. 1. In the navigation pane, select **Settings** > **Device management** > **Onboarding**.
2. Select Windows Server 2008 R2 SP1, 2012 R2 and 2016 as the operating system. 2. Select **Windows Server 2008 R2 SP1, 2012 R2 and 2016** as the operating system.
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment setup. When the setup completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent. 3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment setup. When the setup completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
@ -104,52 +107,50 @@ The following steps are required to enable this integration:
1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603). 1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603).
2. Using the Workspace ID and Workspace key provided in the previous procedure, choose any of the following installation methods to install the agent on the server: 2. Using the Workspace ID and Workspace key obtained in the previous procedure, choose any of the following installation methods to install the agent on the Windows server:
- [Manually install the agent using setup](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-setup) <br> - [Manually install the agent using setup](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-setup) <br>
On the **Agent Setup Options** page, choose **Connect the agent to Azure Log Analytics (OMS)**. On the **Agent Setup Options** page, choose **Connect the agent to Azure Log Analytics (OMS)**.
- [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script). - [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script).
3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](configure-proxy-internet.md). 3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](configure-proxy-internet.md).
Once completed, you should see onboarded servers in the portal within an hour. Once completed, you should see onboarded Windows servers in the portal within an hour.
<span id="server-proxy"/> <span id="server-proxy"/>
### Configure server proxy and Internet connectivity settings ### Configure Windows server proxy and Internet connectivity settings
- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the <a href="https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway" data-raw-source="[OMS Gateway](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway)">OMS Gateway</a>. - Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the <a href="https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway" data-raw-source="[OMS Gateway](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway)">OMS Gateway</a>.
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that you [enable access to Microsoft Defender ATP service URLs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). - If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that you [enable access to Microsoft Defender ATP service URLs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
### Option 2: Onboard Windows servers through Azure Security Center
1. In the Microsoft Defender Security Center navigation pane, select **Settings** > **Device management** > **Onboarding**.
2. Select **Windows Server 2008 R2 SP1, 2012 R2 and 2016** as the operating system.
### Option 2: Onboard servers through Azure Security Center
1. In the navigation pane, select **Settings** > **Device management** > **Onboarding**.
2. Select Windows Server 2008 R2 SP1, 2012 R2 and 2016 as the operating system.
3. Click **Onboard Servers in Azure Security Center**. 3. Click **Onboard Servers in Azure Security Center**.
4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp). 4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
### Option 3: Onboard Windows servers through Microsoft Endpoint Configuration Manager version 2002 and later
You can onboard Windows Server 2012 R2 and Windows Server 2016 by using Microsoft Endpoint Configuration Manager version 2002 and later. For more information, see [Microsoft Defender Advanced Threat Protection in Microsoft Endpoint Configuration Manager current branch](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection).
## Windows Server (SAC) version 1803, Windows Server 2019, and Windows Server 2019 Core edition ## Windows Server (SAC) version 1803, Windows Server 2019, and Windows Server 2019 Core edition
To onboard Windows Server (SAC) version 1803, Windows Server 2019, or Windows Server 2019 Core edition, refer to the supported methods and versions below. You can onboard Windows Server (SAC) version 1803, Windows Server 2019, or Windows Server 2019 Core edition by using the following deployment methods:
- [Local script](configure-endpoints-script.md)
- [Group Policy](configure-endpoints-gp.md)
- [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md#onboard-windows-10-devices-using-microsoft-endpoint-configuration-manager-current-branch)
- [System Center Configuration Manager 2012 / 2012 R2 1511 / 1602](configure-endpoints-sccm.md#onboard-windows-10-devices-using-earlier-versions-of-system-center-configuration-manager)
- [VDI onboarding scripts for non-persistent devices](configure-endpoints-vdi.md)
> [!NOTE] > [!NOTE]
> The Onboarding package for Windows Server 2019 through Microsoft Endpoint Configuration Manager currently ships a script. For more information on how to deploy scripts in Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/packages-and-programs). > - The Onboarding package for Windows Server 2019 through Microsoft Endpoint Configuration Manager currently ships a script. For more information on how to deploy scripts in Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/packages-and-programs).
> - A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, Microsoft Endpoint Configuration Manager, or Intune.
Supported tools include: Support for Windows Server, provide deeper insight into activities happening on the Windows server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
- Local script
- Group Policy
- Microsoft Endpoint Configuration Manager
- System Center Configuration Manager 2012 / 2012 R2 1511 / 1602
- VDI onboarding scripts for non-persistent devices
For more information, see [Onboard Windows 10 devices](configure-endpoints.md). 1. Configure Microsoft Defender ATP onboarding settings on the Windows server. For more information, see [Onboard Windows 10 devices](configure-endpoints.md).
Support for Windows Server, provide deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
1. Configure Microsoft Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 devices](configure-endpoints.md).
2. If you're running a third-party antimalware solution, you'll need to apply the following Microsoft Defender AV passive mode settings. Verify that it was configured correctly: 2. If you're running a third-party antimalware solution, you'll need to apply the following Microsoft Defender AV passive mode settings. Verify that it was configured correctly:
@ -174,10 +175,11 @@ Support for Windows Server, provide deeper insight into activities happening on
```sc.exe query Windefend``` ```sc.exe query Windefend```
If the result is 'The specified service does not exist as an installed service', then you'll need to install Microsoft Defender AV. For more information, see [Microsoft Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10). If the result is 'The specified service does not exist as an installed service', then you'll need to install Microsoft Defender AV. For more information, see [Microsoft Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10).
For information on how to use Group Policy to configure and manage Microsoft Defender Antivirus on your Windows servers, see [Use Group Policy settings to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus).
## Integration with Azure Security Center ## Integration with Azure Security Center
Microsoft Defender ATP can integrate with Azure Security Center to provide a comprehensive server protection solution. With this integration, Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers. Microsoft Defender ATP can integrate with Azure Security Center to provide a comprehensive Windows server protection solution. With this integration, Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers.
The following capabilities are included in this integration: The following capabilities are included in this integration:
- Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding). - Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
@ -185,31 +187,30 @@ The following capabilities are included in this integration:
> [!NOTE] > [!NOTE]
> Automated onboarding is only applicable for Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016. > Automated onboarding is only applicable for Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016.
- Servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console. - Windows servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console.
- Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach. - Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach.
> [!IMPORTANT] > [!IMPORTANT]
> - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created (in the US for US users, in the EU for European and UK users). > - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created (in the US for US users, in the EU for European and UK users).
> - If you use Microsoft Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time. > - If you use Microsoft Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
> - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created and the Microsoft Defender ATP data is stored in Europe by default. If you need to move your data to another location, you need to contact Microsoft Support to reset the tenant. Server endpoint monitoring utilizing this integration has been disabled for Office 365 GCC customers. > - When you use Azure Security Center to monitor Windows servers, a Microsoft Defender ATP tenant is automatically created and the Microsoft Defender ATP data is stored in Europe by default. If you need to move your data to another location, you need to contact Microsoft Support to reset the tenant. Server endpoint monitoring utilizing this integration has been disabled for Office 365 GCC customers.
## Offboard Windows servers
## Offboard servers
You can offboard Windows Server (SAC), Windows Server 2019, and Windows Server 2019 Core edition in the same method available for Windows 10 client devices. You can offboard Windows Server (SAC), Windows Server 2019, and Windows Server 2019 Core edition in the same method available for Windows 10 client devices.
For other server versions, you have two options to offboard servers from the service: For other Windows server versions, you have two options to offboard Windows servers from the service:
- Uninstall the MMA agent - Uninstall the MMA agent
- Remove the Microsoft Defender ATP workspace configuration - Remove the Microsoft Defender ATP workspace configuration
> [!NOTE] > [!NOTE]
> Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months. > Offboarding causes the Windows server to stop sending sensor data to the portal but data from the Windows server, including reference to any alerts it has had will be retained for up to 6 months.
### Uninstall servers by uninstalling the MMA agent ### Uninstall Windows servers by uninstalling the MMA agent
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Microsoft Defender ATP. To offboard the Windows server, you can uninstall the MMA agent from the Windows server or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the Windows server will no longer send sensor data to Microsoft Defender ATP.
For more information, see [To disable an agent](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent). For more information, see [To disable an agent](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).
### Remove the Microsoft Defender ATP workspace configuration ### Remove the Microsoft Defender ATP workspace configuration
To offboard the server, you can use either of the following methods: To offboard the Windows server, you can use either of the following methods:
- Remove the Microsoft Defender ATP workspace configuration from the MMA agent - Remove the Microsoft Defender ATP workspace configuration from the MMA agent
- Run a PowerShell command to remove the configuration - Run a PowerShell command to remove the configuration
@ -230,7 +231,7 @@ To offboard the server, you can use either of the following methods:
1. Select **Windows Server 2008 R2 SP1, 2012 R2 and 2016** as the operating system and get your Workspace ID: 1. Select **Windows Server 2008 R2 SP1, 2012 R2 and 2016** as the operating system and get your Workspace ID:
![Image of server onboarding](images/atp-server-offboarding-workspaceid.png) ![Image of Windows server onboarding](images/atp-server-offboarding-workspaceid.png)
2. Open an elevated PowerShell and run the following command. Use the Workspace ID you obtained and replacing `WorkspaceID`: 2. Open an elevated PowerShell and run the following command. Use the Workspace ID you obtained and replacing `WorkspaceID`:
@ -242,7 +243,6 @@ To offboard the server, you can use either of the following methods:
# Reload the configuration and apply changes # Reload the configuration and apply changes
$AgentCfg.ReloadConfiguration() $AgentCfg.ReloadConfiguration()
``` ```
## Related topics ## Related topics
- [Onboard Windows 10 devices](configure-endpoints.md) - [Onboard Windows 10 devices](configure-endpoints.md)
- [Onboard non-Windows devices](configure-endpoints-non-windows.md) - [Onboard non-Windows devices](configure-endpoints-non-windows.md)

23
windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md
View File

@ -60,19 +60,21 @@ For more information about disabling local list merging, see [Prevent or allow u
## Intune ## Intune
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune. 1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
1. Click **Device configuration** > **Profiles** > **Create profile**.
1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
![Create endpoint protection profile](../images/create-endpoint-protection-profile.png)
1. Click **Configure** > **Windows Defender Exploit Guard** > **Controlled folder access** > **Enable**.
1. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click **Add**.
![Enable controlled folder access in Intune](../images/enable-cfa-intune.png) 2. Click **Device configuration** > **Profiles** > **Create profile**.
3. Name the profile, choose **Windows 10 and later** and **Endpoint protection**. <br/> ![Create endpoint protection profile](../images/create-endpoint-protection-profile.png) <br/>
4. Click **Configure** > **Windows Defender Exploit Guard** > **Controlled folder access** > **Enable**.
5. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click **Add**.<br/> ![Enable controlled folder access in Intune](../images/enable-cfa-intune.png)<br/>
> [!NOTE] > [!NOTE]
> Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted. > Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted.
1. Click **OK** to save each open blade and click **Create**. 6. Click **OK** to save each open blade and click **Create**.
1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
7. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
## MDM ## MDM
@ -81,12 +83,17 @@ Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](htt
## Microsoft Endpoint Configuration Manager ## Microsoft Endpoint Configuration Manager
1. In Microsoft Endpoint Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. 1. In Microsoft Endpoint Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**.
2. Click **Home** > **Create Exploit Guard Policy**. 2. Click **Home** > **Create Exploit Guard Policy**.
3. Enter a name and a description, click **Controlled folder access**, and click **Next**. 3. Enter a name and a description, click **Controlled folder access**, and click **Next**.
4. Choose whether block or audit changes, allow other apps, or add other folders, and click **Next**. 4. Choose whether block or audit changes, allow other apps, or add other folders, and click **Next**.
> [!NOTE] > [!NOTE]
> Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted. > Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted.
5. Review the settings and click **Next** to create the policy. 5. Review the settings and click **Next** to create the policy.
6. After the policy is created, click **Close**. 6. After the policy is created, click **Close**.
## Group Policy ## Group Policy

36
windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md
View File

@ -108,13 +108,18 @@ The result will be that DEP will be enabled for *test.exe*. DEP will not be enab
## Intune ## Intune
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune. 1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
2. Click **Device configuration** > **Profiles** > **Create profile**. 2. Click **Device configuration** > **Profiles** > **Create profile**.
3. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
![Create endpoint protection profile](../images/create-endpoint-protection-profile.png) 3. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.<br/>
![Create endpoint protection profile](../images/create-endpoint-protection-profile.png)<br/>
4. Click **Configure** > **Windows Defender Exploit Guard** > **Exploit protection**. 4. Click **Configure** > **Windows Defender Exploit Guard** > **Exploit protection**.
5. Upload an [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) with the exploit protection settings:
![Enable network protection in Intune](../images/enable-ep-intune.png) 5. Upload an [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) with the exploit protection settings:<br/>![Enable network protection in Intune](../images/enable-ep-intune.png)<br/>
6. Click **OK** to save each open blade and click **Create**. 6. Click **OK** to save each open blade and click **Create**.
7. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**. 7. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
## MDM ## MDM
@ -124,19 +129,26 @@ Use the [./Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings](htt
## Microsoft Endpoint Configuration Manager ## Microsoft Endpoint Configuration Manager
1. In Microsoft Endpoint Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. 1. In Microsoft Endpoint Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**.
1. Click **Home** > **Create Exploit Guard Policy**.
1. Enter a name and a description, click **Exploit protection**, and click **Next**. 2. Click **Home** > **Create Exploit Guard Policy**.
1. Browse to the location of the exploit protection XML file and click **Next**.
1. Review the settings and click **Next** to create the policy. 3. Enter a name and a description, click **Exploit protection**, and click **Next**.
1. After the policy is created, click **Close**.
4. Browse to the location of the exploit protection XML file and click **Next**.
5. Review the settings and click **Next** to create the policy.
6. After the policy is created, click **Close**.
## Group Policy ## Group Policy
1. On your Group Policy management device, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. 1. On your Group Policy management device, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
1. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. 2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
2. Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit Protection** > **Use a common set of exploit protection settings**.
3. Click **Enabled** and type the location of the [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) and click **OK**. 3. Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit Protection** > **Use a common set of exploit protection settings**.
4. Click **Enabled** and type the location of the [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) and click **OK**.
## PowerShell ## PowerShell

221
windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md
View File

@ -29,98 +29,172 @@ Not all properties are filterable.
## Properties that supports $filter: ## Properties that supports $filter:
- [Alert](alerts.md): Id, IncidentId, AlertCreationTime, Status, Severity and Category. - [Alert](alerts.md): ```alertCreationTime```, ```lastUpdateTime```, ```incidentId```,```InvestigationId```, ```status```, ```severity``` and ```category```.
- [Machine](machine.md): Id, ComputerDnsName, LastSeen, LastIpAddress, HealthStatus, OsPlatform, RiskScore, MachineTags and RbacGroupId. - [Machine](machine.md): ```ComputerDnsName```, ```LastSeen```, ```HealthStatus```, ```OsPlatform```, ```RiskScore``` and ```RbacGroupId```.
- [MachineAction](machineaction.md): Id, Status, MachineId, Type, Requestor and CreationDateTimeUtc. - [MachineAction](machineaction.md): ```Status```, ```MachineId```, ```Type```, ```Requestor``` and ```CreationDateTimeUtc```.
- [Indicator](ti-indicator.md): ```indicatorValue```, ```indicatorType```, ```creationTimeDateTimeUtc```, ```createdBy```, ```severity ``` and ```action ```.
### Example 1 ### Example 1
Get all the devices with the tag 'ExampleTag' Get 10 latest Alerts with related Evidence
``` ```
HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=machineTags/any(tag: tag eq 'ExampleTag') HTTP GET https://api.securitycenter.microsoft.com/api/alerts?$top=10&$expand=evidence
``` ```
**Response:** **Response:**
``` ```json
HTTP/1.1 200 OK
Content-type: application/json
{ {
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Alerts",
"value": [ "value": [
{ {
"id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", "id": "da637306396589640224_1753239473",
"computerDnsName": "mymachine1.contoso.com", "incidentId": 875832,
"firstSeen": "2018-08-02T14:55:03.7791856Z", "investigationId": 478434,
"lastSeen": "2018-08-02T14:55:03.7791856Z", "assignedTo": null,
"osPlatform": "Windows10", "severity": "Low",
"version": "1709", "status": "New",
"osProcessor": "x64", "classification": null,
"lastIpAddress": "172.17.230.209", "determination": null,
"lastExternalIpAddress": "167.220.196.71", "investigationState": "PendingApproval",
"osBuild": 18209, "detectionSource": "WindowsDefenderAv",
"healthStatus": "Active", "category": "UnwantedSoftware",
"rbacGroupId": 140, "threatFamilyName": "InstallCore",
"rbacGroupName": "The-A-Team", "title": "An active 'InstallCore' unwanted software was detected",
"riskScore": "Low", "description": "Potentially unwanted applications (PUA) often impact productivity and performance and are often unwanted in enterprise environments. This category of applications include torrent downloaders, cryptocurrency miners, browser advertising software, and evasion software.\n\nAn application is considered active if it is found running on the machine or it already has persistence mechanisms in place.\n\nBecause this PUA was active, take precautionary measures and check for residual signs of infection.",
"exposureLevel": "Medium", "alertCreationTime": "2020-07-18T03:27:38.9483995Z",
"isAadJoined": true, "firstEventTime": "2020-07-18T03:25:39.6124549Z",
"aadDeviceId": "80fe8ff8-2624-418e-9591-41f0491218f9", "lastEventTime": "2020-07-18T03:26:18.4362304Z",
"machineTags": [ "test tag 1", "ExampleTag" ] "lastUpdateTime": "2020-07-18T03:28:19.76Z",
}, "resolvedTime": null,
... "machineId": "97868b864dc8fa09cc8726c37a1fcd8ab582f3aa",
] "computerDnsName": "temp2.redmond.corp.microsoft.com",
"rbacGroupName": "Ring0",
"aadTenantId": "12f988bf-1234-1234-91ab-2d7cd011db47",
"relatedUser": {
"userName": "temp2",
"domainName": "REDMOND"
},
"comments": [],
"evidence": [
{
"entityType": "File",
"sha1": "ff02786682af8a6ae2842b64c8da543c4d76823c",
"sha256": "16dafd771171b619a472bb23cd55bc069625be8de5ee01b37b41de1216b2bbb2",
"fileName": "Your File Is Ready To Download_1911150169.exe",
"filePath": "C:\\Users\\temp2\\Downloads",
"processId": null,
"processCommandLine": null,
"processCreationTime": null,
"parentProcessId": null,
"parentProcessCreationTime": null,
"ipAddress": null,
"url": null,
"accountName": null,
"domainName": null,
"userSid": null,
"aadUserId": null,
"userPrincipalName": null
},
{
"entityType": "Process",
"sha1": "ff02786682af8a6ae2842b64c8da543c4d76823c",
"sha256": "16dafd771171b619a472bb23cd55bc069625be8de5ee01b37b41de1216b2bbb2",
"fileName": "Your File Is Ready To Download_1911150169.exe",
"filePath": "C:\\Users\\temp2\\Downloads",
"processId": 24348,
"processCommandLine": "\"Your File Is Ready To Download_1911150169.exe\" ",
"processCreationTime": "2020-07-18T03:25:38.5269993Z",
"parentProcessId": 16840,
"parentProcessCreationTime": "2020-07-18T02:12:32.8616797Z",
"ipAddress": null,
"url": null,
"accountName": null,
"domainName": null,
"userSid": null,
"aadUserId": null,
"userPrincipalName": null
},
{
"entityType": "User",
"sha1": null,
"sha256": null,
"fileName": null,
"filePath": null,
"processId": null,
"processCommandLine": null,
"processCreationTime": null,
"parentProcessId": null,
"parentProcessCreationTime": null,
"ipAddress": null,
"url": null,
"accountName": "temp2",
"domainName": "REDMOND",
"userSid": "S-1-5-21-1127532184-1642412920-1887927527-75363",
"aadUserId": "319dc320-4ce3-4cd7-a0de-c476d146342d",
"userPrincipalName": "temp2@microsoft.com"
}
]
},
...
]
} }
``` ```
### Example 2 ### Example 2
Get all the alerts that created after 2018-10-20 00:00:00 Get all the alerts last updated after 2019-10-20 00:00:00
``` ```
HTTP GET https://api.securitycenter.windows.com/api/alerts?$filter=alertCreationTime+gt+2018-11-22T00:00:00Z HTTP GET https://api.securitycenter.windows.com/api/alerts?$filter=lastUpdateTime+ge+2019-11-22T00:00:00Z
``` ```
**Response:** **Response:**
``` ```json
HTTP/1.1 200 OK
Content-type: application/json
{ {
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts", "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts",
"value": [ "value": [
{ {
"id": "da637084217856368682_-292920499", "id": "da637308392288907382_-880718168",
"incidentId": 66860, "incidentId": 7587,
"investigationId": 4416234, "investigationId": 723156,
"investigationState": "Running", "assignedTo": "secop123@contoso.com",
"assignedTo": "secop@contoso.com", "severity": "Low",
"severity": "Low", "status": "New",
"status": "New", "classification": "TruePositive",
"classification": "TruePositive", "determination": null,
"determination": null, "investigationState": "Queued",
"detectionSource": "WindowsDefenderAtp", "detectionSource": "WindowsDefenderAv",
"category": "CommandAndControl", "category": "SuspiciousActivity",
"threatFamilyName": null, "threatFamilyName": "Meterpreter",
"title": "Network connection to a risky host", "title": "Suspicious 'Meterpreter' behavior was detected",
"description": "A network connection was made to a risky host which has exhibited malicious activity.", "description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.",
"alertCreationTime": "2019-11-03T23:49:45.3823185Z", "alertCreationTime": "2020-07-20T10:53:48.7657932Z",
"firstEventTime": "2019-11-03T23:47:16.2288822Z", "firstEventTime": "2020-07-20T10:52:17.6654369Z",
"lastEventTime": "2019-11-03T23:47:51.2966758Z", "lastEventTime": "2020-07-20T10:52:18.1362905Z",
"lastUpdateTime": "2019-11-03T23:55:52.6Z", "lastUpdateTime": "2020-07-20T10:53:50.19Z",
"resolvedTime": null, "resolvedTime": null,
"machineId": "986e5df8b73dacd43c8917d17e523e76b13c75cd", "machineId": "12ee6dd8c833c8a052ea231ec1b19adaf497b625",
"computerDnsName": "temp123.middleeast.corp.microsoft.com",
"rbacGroupName": "MiddleEast",
"aadTenantId": "a839b112-1253-6432-9bf6-94542403f21c",
"relatedUser": {
"userName": "temp123",
"domainName": "MIDDLEEAST"
},
"comments": [ "comments": [
{ {
"comment": "test comment for docs", "comment": "test comment for docs",
"createdBy": "secop@contoso.com", "createdBy": "secop123@contoso.com",
"createdTime": "2019-11-05T14:08:37.8404534Z" "createdTime": "2020-07-21T01:00:37.8404534Z"
} }
] ],
}, "evidence": []
... }
] ...
]
} }
``` ```
@ -134,9 +208,7 @@ HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=riskScore+
**Response:** **Response:**
``` ```json
HTTP/1.1 200 OK
Content-type: application/json
{ {
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
"value": [ "value": [
@ -175,9 +247,7 @@ HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=healthStat
**Response:** **Response:**
``` ```json
HTTP/1.1 200 OK
Content-type: application/json
{ {
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
"value": [ "value": [
@ -216,9 +286,7 @@ HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=lastSeen g
**Response:** **Response:**
``` ```json
HTTP/1.1 200 OK
Content-type: application/json
{ {
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
"value": [ "value": [
@ -257,10 +325,8 @@ HTTP GET https://api.securitycenter.windows.com/api/machineactions?$filter=requ
**Response:** **Response:**
``` ```json
HTTP/1.1 200 OK json{
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions", "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions",
"value": [ "value": [
{ {
@ -291,10 +357,7 @@ HTTP GET https://api.securitycenter.windows.com/api/machines/123321d0c675eaa415
**Response:** **Response:**
``` ```json
HTTP/1.1 200 OK
Content-type: application/json
4 4
``` ```

184
windows/security/threat-protection/microsoft-defender-atp/get-alerts.md
View File

@ -26,7 +26,11 @@ ms.topic: article
## API description ## API description
Retrieves a collection of Alerts. Retrieves a collection of Alerts.
<br>Supports [OData V4 queries](https://www.odata.org/documentation/). <br>Supports [OData V4 queries](https://www.odata.org/documentation/).
<br>The OData's ```$filter``` query is supported on: ```alertCreationTime```, ```lastUpdateTime```, ```incidentId```,```InvestigationId```, ```status```, ```severity``` and ```category``` properties. <br>OData supported operators:
<br>```$filter``` on: ```alertCreationTime```, ```lastUpdateTime```, ```incidentId```,```InvestigationId```, ```status```, ```severity``` and ```category``` properties.
<br>```$top``` with max value of 10,000
<br>```$skip```
<br>```$expand``` of ```evidence```
<br>See examples at [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md) <br>See examples at [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)
@ -70,14 +74,14 @@ Empty
If successful, this method returns 200 OK, and a list of [alert](alerts.md) objects in the response body. If successful, this method returns 200 OK, and a list of [alert](alerts.md) objects in the response body.
## Example ## Example 1 - Default
**Request** **Request**
Here is an example of the request. Here is an example of the request.
``` ```
GET https://api.securitycenter.windows.com/api/alerts GET https://api.securitycenter.microsoft.com/api/alerts
``` ```
[!include[Improve request performance](../../includes/improve-request-performance.md)] [!include[Improve request performance](../../includes/improve-request-performance.md)]
@ -93,41 +97,167 @@ Here is an example of the response.
```json ```json
{ {
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts", "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Alerts",
"value": [ "value": [
{ {
"id": "da637084217856368682_-292920499", "id": "da637308392288907382_-880718168",
"incidentId": 66860, "incidentId": 7587,
"investigationId": 4416234, "investigationId": 723156,
"assignedTo": "secop@contoso.com", "assignedTo": "secop123@contoso.com",
"severity": "Low", "severity": "Low",
"status": "New", "status": "New",
"classification": "TruePositive", "classification": "TruePositive",
"determination": null, "determination": null,
"investigationState": "Running", "investigationState": "Queued",
"detectionSource": "WindowsDefenderAtp", "detectionSource": "WindowsDefenderAv",
"category": "CommandAndControl", "category": "SuspiciousActivity",
"threatFamilyName": null, "threatFamilyName": "Meterpreter",
"title": "Network connection to a risky host", "title": "Suspicious 'Meterpreter' behavior was detected",
"description": "A network connection was made to a risky host which has exhibited malicious activity.", "description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.",
"alertCreationTime": "2019-11-03T23:49:45.3823185Z", "alertCreationTime": "2020-07-20T10:53:48.7657932Z",
"firstEventTime": "2019-11-03T23:47:16.2288822Z", "firstEventTime": "2020-07-20T10:52:17.6654369Z",
"lastEventTime": "2019-11-03T23:47:51.2966758Z", "lastEventTime": "2020-07-20T10:52:18.1362905Z",
"lastUpdateTime": "2019-11-03T23:55:52.6Z", "lastUpdateTime": "2020-07-20T10:53:50.19Z",
"resolvedTime": null, "resolvedTime": null,
"machineId": "986e5df8b73dacd43c8917d17e523e76b13c75cd", "machineId": "12ee6dd8c833c8a052ea231ec1b19adaf497b625",
"computerDnsName": "temp123.middleeast.corp.microsoft.com",
"rbacGroupName": "MiddleEast",
"aadTenantId": "a839b112-1253-6432-9bf6-94542403f21c",
"relatedUser": {
"userName": "temp123",
"domainName": "MIDDLEEAST"
},
"comments": [ "comments": [
{ {
"comment": "test comment for docs", "comment": "test comment for docs",
"createdBy": "secop@contoso.com", "createdBy": "secop123@contoso.com",
"createdTime": "2019-11-05T14:08:37.8404534Z" "createdTime": "2020-07-21T01:00:37.8404534Z"
} }
] ],
"evidence": []
} }
... ...
] ]
} }
``` ```
## Example 2 - Get 10 latest Alerts with related Evidence
**Request**
Here is an example of the request.
```
GET https://api.securitycenter.microsoft.com/api/alerts?$top=10&$expand=evidence
```
**Response**
Here is an example of the response.
>[!NOTE]
>The response list shown here may be truncated for brevity. All alerts will be returned from an actual call.
```json
{
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Alerts",
"value": [
{
"id": "da637306396589640224_1753239473",
"incidentId": 875832,
"investigationId": 478434,
"assignedTo": null,
"severity": "Low",
"status": "New",
"classification": null,
"determination": null,
"investigationState": "PendingApproval",
"detectionSource": "WindowsDefenderAv",
"category": "UnwantedSoftware",
"threatFamilyName": "InstallCore",
"title": "An active 'InstallCore' unwanted software was detected",
"description": "Potentially unwanted applications (PUA) often impact productivity and performance and are often unwanted in enterprise environments. This category of applications include torrent downloaders, cryptocurrency miners, browser advertising software, and evasion software.\n\nAn application is considered active if it is found running on the machine or it already has persistence mechanisms in place.\n\nBecause this PUA was active, take precautionary measures and check for residual signs of infection.",
"alertCreationTime": "2020-07-18T03:27:38.9483995Z",
"firstEventTime": "2020-07-18T03:25:39.6124549Z",
"lastEventTime": "2020-07-18T03:26:18.4362304Z",
"lastUpdateTime": "2020-07-18T03:28:19.76Z",
"resolvedTime": null,
"machineId": "97868b864dc8fa09cc8726c37a1fcd8ab582f3aa",
"computerDnsName": "temp2.redmond.corp.microsoft.com",
"rbacGroupName": "Ring0",
"aadTenantId": "12f988bf-1234-1234-91ab-2d7cd011db47",
"relatedUser": {
"userName": "temp2",
"domainName": "REDMOND"
},
"comments": [],
"evidence": [
{
"entityType": "File",
"sha1": "ff02786682af8a6ae2842b64c8da543c4d76823c",
"sha256": "16dafd771171b619a472bb23cd55bc069625be8de5ee01b37b41de1216b2bbb2",
"fileName": "Your File Is Ready To Download_1911150169.exe",
"filePath": "C:\\Users\\temp2\\Downloads",
"processId": null,
"processCommandLine": null,
"processCreationTime": null,
"parentProcessId": null,
"parentProcessCreationTime": null,
"ipAddress": null,
"url": null,
"accountName": null,
"domainName": null,
"userSid": null,
"aadUserId": null,
"userPrincipalName": null
},
{
"entityType": "Process",
"sha1": "ff02786682af8a6ae2842b64c8da543c4d76823c",
"sha256": "16dafd771171b619a472bb23cd55bc069625be8de5ee01b37b41de1216b2bbb2",
"fileName": "Your File Is Ready To Download_1911150169.exe",
"filePath": "C:\\Users\\temp2\\Downloads",
"processId": 24348,
"processCommandLine": "\"Your File Is Ready To Download_1911150169.exe\" ",
"processCreationTime": "2020-07-18T03:25:38.5269993Z",
"parentProcessId": 16840,
"parentProcessCreationTime": "2020-07-18T02:12:32.8616797Z",
"ipAddress": null,
"url": null,
"accountName": null,
"domainName": null,
"userSid": null,
"aadUserId": null,
"userPrincipalName": null
},
{
"entityType": "User",
"sha1": null,
"sha256": null,
"fileName": null,
"filePath": null,
"processId": null,
"processCommandLine": null,
"processCreationTime": null,
"parentProcessId": null,
"parentProcessCreationTime": null,
"ipAddress": null,
"url": null,
"accountName": "temp2",
"domainName": "REDMOND",
"userSid": "S-1-5-21-1127532184-1642412920-1887927527-75363",
"aadUserId": "319dc320-4ce3-4cd7-a0de-c476d146342d",
"userPrincipalName": "temp2@microsoft.com"
}
]
},
...
]
}
```
## Related topics ## Related topics
- [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md) - [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)

16
windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities-by-machines.md
View File

@ -1,5 +1,5 @@
--- ---
title: Get all vulnerabilities by Machine and Software title: Get all vulnerabilities by machine and software
description: Retrieves a list of all the vulnerabilities affecting the organization by Machine and Software description: Retrieves a list of all the vulnerabilities affecting the organization by Machine and Software
keywords: apis, graph api, supported apis, get, vulnerability information, mdatp tvm api keywords: apis, graph api, supported apis, get, vulnerability information, mdatp tvm api
search.product: eADQiWindows 10XVcnh search.product: eADQiWindows 10XVcnh
@ -16,13 +16,14 @@ ms.collection: M365-security-compliance
ms.topic: article ms.topic: article
--- ---
# List vulnerabilities by Machine and Software # List vulnerabilities by machine and software
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) **Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
Retrieves a list of all the vulnerabilities affecting the organization per [Machine](machine.md) and [Software](software.md). Retrieves a list of all the vulnerabilities affecting the organization per [machine](machine.md) and [software](software.md).
<br>If the vulnerability has a fixing KB, it will appear in the response. - If the vulnerability has a fixing KB, it will appear in the response.
<br>Supports [OData V4 queries](https://www.odata.org/documentation/). - Supports [OData V4 queries](https://www.odata.org/documentation/).
<br>The OData ```$filter``` is supported on all properties. - The OData ```$filter``` is supported on all properties.
>[!Tip] >[!Tip]
>This is great API for [Power BI integration](api-power-bi.md). >This is great API for [Power BI integration](api-power-bi.md).
@ -100,5 +101,6 @@ Here is an example of the response.
``` ```
## Related topics ## Related topics
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
- [Risk-based threat and vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
- [Vulnerabilities in your organization](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses) - [Vulnerabilities in your organization](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)

2
windows/security/threat-protection/microsoft-defender-atp/get-machines.md
View File

@ -26,7 +26,7 @@ ms.topic: article
## API description ## API description
Retrieves a collection of [Machines](machine.md) that have communicated with Microsoft Defender ATP cloud on the last 30 days. Retrieves a collection of [Machines](machine.md) that have communicated with Microsoft Defender ATP cloud on the last 30 days.
<br>Supports [OData V4 queries](https://www.odata.org/documentation/). <br>Supports [OData V4 queries](https://www.odata.org/documentation/).
<br>The OData's ```$filter``` query is supported on: ```computerDnsName```, ```lastSeen```, ```lastIpAddress```, ```healthStatus```, ```osPlatform```, ```riskScore```, ```rbacGroupId``` and ```machineTags``` properties. <br>The OData's ```$filter``` query is supported on: ```computerDnsName```, ```lastSeen```, ```healthStatus```, ```osPlatform```, ```riskScore``` and ```rbacGroupId```.
<br>See examples at [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md) <br>See examples at [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)

BIN
windows/security/threat-protection/microsoft-defender-atp/images/atp-incident-details-updated.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 51 KiB

BIN
windows/security/threat-protection/microsoft-defender-atp/images/atp-incidents-mgt-pane-updated.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 102 KiB

BIN
windows/security/threat-protection/microsoft-defender-atp/images/atp-server-offboarding-workspaceid.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 273 KiB

After

Width:  |  Height:  |  Size: 273 KiB

3
windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md
View File

@ -67,6 +67,9 @@ You can specify the file names that you want to be excluded in a specific direct
4. Click **Save**. 4. Click **Save**.
>[!NOTE]
> Live Response commands to collect or examine excluded files will fail with error: "File is excluded". In addition, automated investigations will ignore the excluded items.
## Edit an automation folder exclusion ## Edit an automation folder exclusion
1. In the navigation pane, select **Settings** > **Automation folder exclusions**. 1. In the navigation pane, select **Settings** > **Automation folder exclusions**.

14
windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md
View File

@ -29,12 +29,20 @@ Managing incidents is an important part of every cybersecurity operation. You ca
Selecting an incident from the **Incidents queue** brings up the **Incident management pane** where you can open the incident page for details. Selecting an incident from the **Incidents queue** brings up the **Incident management pane** where you can open the incident page for details.
![Image of the incidents management pane](images/atp-incidents-mgt-pane.png) ![Image of the incidents management pane](images/atp-incidents-mgt-pane-updated.png)
You can assign incidents to yourself, change the status and classification, rename, or comment on them to keep track of their progress. You can assign incidents to yourself, change the status and classification, rename, or comment on them to keep track of their progress.
![Image of incident detail page](images/atp-incident-details-page.png) > [!TIP]
> For additional visibility at-a-glance, automatic incident naming, currently in public preview, generates incident names based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories. This allows you to quickly understand the scope of the incident.
>
> For example: *Multi-stage incident on multiple endpoints reported by multiple sources.*
>
> Incidents that existed prior the rollout of automatic incident naming will not have their name changed.
>
> Learn more about [turning on preview features](preview.md#turn-on-preview-features).
![Image of incident detail page](images/atp-incident-details-updated.png)
## Assign incidents ## Assign incidents
If an incident has not been assigned yet, you can select **Assign to me** to assign the incident to yourself. Doing so assumes ownership of not just the incident, but also all the alerts associated with it. If an incident has not been assigned yet, you can select **Assign to me** to assign the incident to yourself. Doing so assumes ownership of not just the incident, but also all the alerts associated with it.

1
windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md
View File

@ -110,6 +110,7 @@ See the following topics for related APIs:
- [Score APIs](score.md) - [Score APIs](score.md)
- [Software APIs](software.md) - [Software APIs](software.md)
- [Vulnerability APIs](vulnerability.md) - [Vulnerability APIs](vulnerability.md)
- [List vulnerabilities by machine and software](get-all-vulnerabilities-by-machines.md)
## Related topics ## Related topics

2
windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md
View File

@ -37,7 +37,7 @@ Follow the corresponding instructions depending on your preferred deployment met
- [Offboard devices using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-and-monitor-devices-using-mobile-device-management-tools) - [Offboard devices using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-and-monitor-devices-using-mobile-device-management-tools)
## Offboard Servers ## Offboard Servers
- [Offboard servers](configure-server-endpoints.md#offboard-servers) - [Offboard servers](configure-server-endpoints.md#offboard-windows-servers)
## Offboard non-Windows devices ## Offboard non-Windows devices
- [Offboard non-Windows devices](configure-endpoints-non-windows.md#offboard-non-windows-devices) - [Offboard non-Windows devices](configure-endpoints-non-windows.md#offboard-non-windows-devices)

4
windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md
View File

@ -49,9 +49,9 @@ Deployment methods vary, depending on which operating system is selected. Refer
|---------|---------| |---------|---------|
|Windows 10 |- [Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp)<br/>- [Configuration Manager](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm)<br/>- [Mobile Device Management (Intune)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm)<br/>- [Local script](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script) <br/><br/>**NOTE**: A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, Microsoft Endpoint Configuration Manager, or Intune. | |Windows 10 |- [Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp)<br/>- [Configuration Manager](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm)<br/>- [Mobile Device Management (Intune)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm)<br/>- [Local script](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script) <br/><br/>**NOTE**: A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, Microsoft Endpoint Configuration Manager, or Intune. |
|- Windows 8.1 Enterprise <br/>- Windows 8.1 Pro <br/>- Windows 7 SP1 Enterprise <br/>- Windows 7 SP1 Pro | [Microsoft Monitoring Agent](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel#install-and-configure-microsoft-monitoring-agent-mma-to-report-sensor-data-to-microsoft-defender-atp)<br/><br/>**NOTE**: Microsoft Monitoring Agent is now Azure Log Analytics agent. To learn more, see [Log Analytics agent overview](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent). | |- Windows 8.1 Enterprise <br/>- Windows 8.1 Pro <br/>- Windows 7 SP1 Enterprise <br/>- Windows 7 SP1 Pro | [Microsoft Monitoring Agent](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel#install-and-configure-microsoft-monitoring-agent-mma-to-report-sensor-data-to-microsoft-defender-atp)<br/><br/>**NOTE**: Microsoft Monitoring Agent is now Azure Log Analytics agent. To learn more, see [Log Analytics agent overview](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent). |
|- Windows Server 2019 and later <br/>- Windows Server 2019 core edition <br/>- Windows Server version 1803 and later |- [Local script](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script) <br/>- [Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp) <br/>- [Configuration Manager](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm) <br/>- [System Center Configuration Manager](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm#onboard-windows-10-machines-using-earlier-versions-of-system-center-configuration-manager) <br/>- [VDI onboarding scripts for non-persistent machines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi) <br/><br/>**NOTE**: A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, Microsoft Endpoint Configuration Manager, or Intune. | |- Windows Server 2019 and later <br/>- Windows Server 2019 core edition <br/>- Windows Server version 1803 and later |- [Local script](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script) <br/>- [Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp) <br/>- [Configuration Manager](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm) <br/>- [System Center Configuration Manager](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm#onboard-windows-10-devices-using-earlier-versions-of-system-center-configuration-manager) <br/>- [VDI onboarding scripts for non-persistent devices](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi) <br/><br/>**NOTE**: A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, Microsoft Endpoint Configuration Manager, or Intune. |
|- Windows Server 2016 <br/>- Windows Server 2012 R2 <br/>- Windows Server 2008 R2 SP1 |- [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints#option-1-onboard-servers-through-microsoft-defender-security-center)<br/>- [Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp) | |- Windows Server 2016 <br/>- Windows Server 2012 R2 <br/>- Windows Server 2008 R2 SP1 |- [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints#option-1-onboard-servers-through-microsoft-defender-security-center)<br/>- [Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp) |
|macOS<br/>- 10.15 (Catalina)<br/>- 10.14 (Mojave)<br/>- 10.13 (High Sierra)<br/><br/>iOS<br/><br/>Linux:<br/>- RHEL 7.2+<br/>- CentOS Linux 7.2+<br/>- Ubuntu 16 LTS, or higher LTS<br/>- SLES 12+<br/>- Debian 9+<br/>- Oracle Linux 7.2 |[Onboard non-Windows machines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows) | |macOS<br/>- 10.15 (Catalina)<br/>- 10.14 (Mojave)<br/>- 10.13 (High Sierra)<br/><br/>iOS<br/><br/>Linux:<br/>- RHEL 7.2+<br/>- CentOS Linux 7.2+<br/>- Ubuntu 16 LTS, or higher LTS<br/>- SLES 12+<br/>- Debian 9+<br/>- Oracle Linux 7.2 |[Onboard non-Windows devices](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows) |
## Run a detection test ## Run a detection test

2
windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md
View File

@ -94,7 +94,7 @@ From the flyout, you can do any of the following:
- [**Exception options**](tvm-security-recommendation.md#file-for-exception) - Submit an exception, provide justification, and set exception duration if you can't remediate the issue just yet. - [**Exception options**](tvm-security-recommendation.md#file-for-exception) - Submit an exception, provide justification, and set exception duration if you can't remediate the issue just yet.
>[!NOTE] >[!NOTE]
>When a change is made on a device, it may take up to two hours for the data to be reflected in the Microsoft Defender Security Center. >When a change is made on a device, it typically takes two hours for the data to be reflected in the Microsoft Defender Security Center. However, it may sometimes take longer.
### Investigate changes in machine exposure or impact ### Investigate changes in machine exposure or impact

11
windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md
View File

@ -63,6 +63,17 @@ You can choose to limit the list of incidents shown based on their status to see
### Data sensitivity ### Data sensitivity
Use this filter to show incidents that contain sensitivity labels. Use this filter to show incidents that contain sensitivity labels.
## Incident naming
To understand the incident's scope at-a-glance, automatic incident naming, currently in public preview, generates incident names based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories.
For example: *Multi-stage incident on multiple endpoints reported by multiple sources.*
> [!NOTE]
> Incidents that existed prior the rollout of automatic incident naming will not have their name changed.
Learn more about [turning on preview features](preview.md#turn-on-preview-features).
## Related topics ## Related topics
- [Incidents queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) - [Incidents queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue)
- [Manage incidents](manage-incidents.md) - [Manage incidents](manage-incidents.md)