mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-27 00:03:45 +00:00
Merge pull request #6807 from MicrosoftDocs/repo_sync_working_branch
Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/windows-itpro-docs (branch public)
This commit is contained in:
Thomas Raya
GitHub
@ -97,6 +97,7 @@ Firewall
|
||||
----------------Protocol
|
||||
----------------LocalPortRanges
|
||||
----------------RemotePortRanges
|
||||
----------------IcmpTypesAndCodes
|
||||
----------------LocalAddressRanges
|
||||
----------------RemoteAddressRanges
|
||||
----------------Description
|
||||
@ -340,6 +341,12 @@ Comma separated list of ranges, For example, 100-120,200,300-320.
|
||||
If not specified, the default is All.
|
||||
Value type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
|
||||
<a href="" id="icmptypesandcodes"></a>**FirewallRules/_FirewallRuleName_/IcmpTypesAndCodes**
|
||||
ICMP types and codes applicable to the firewall rule. To specify all ICMP types and codes, use the “\*” character. For specific ICMP types and codes, use the “:” character to separate the type and code, for example, 3:4, 1:\*. The “\*” character can be used to represent any code. The “\*” character cannot be used to specify any type; examples such as “\*:4” or “\*:\*” are invalid.
|
||||
If not specified, the default is All.
|
||||
Value type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<a href="" id="localaddressranges"></a>**FirewallRules/*FirewallRuleName*/LocalAddressRanges**
|
||||
Comma-separated list of local addresses covered by the rule. The default value is "*". Valid tokens include:
|
||||
|
||||
|
||||
@ -1483,7 +1483,7 @@ This policy setting allows you to enable or disable low CPU priority for schedul
|
||||
|
||||
If you enable this setting, low CPU priority will be used during scheduled scans.
|
||||
|
||||
If you disable or don't configure this setting, not changes will be made to CPU priority for scheduled scans.
|
||||
If you disable or don't configure this setting, no changes will be made to CPU priority for scheduled scans.
|
||||
|
||||
Supported values:
|
||||
|
||||
@ -1922,10 +1922,7 @@ The following list shows the supported values:
|
||||
> [!NOTE]
|
||||
> This policy is only enforced in Windows 10 for desktop.
|
||||
|
||||
Selects the time of day that the Windows Defender quick scan should run.
|
||||
|
||||
> [!NOTE]
|
||||
> The scan type will depends on what scan type is selected in the **Defender/ScanParameter** setting.
|
||||
Selects the time of day that the Windows Defender quick scan should run. The Windows Defender quick scan runs daily if a time is specified.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -4415,7 +4415,7 @@ The following list shows the supported values:
|
||||
<!--/SupportedValues-->
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Allows enterprises to provide their users with a single-browser experience*
|
||||
- GP Friendly name: *Enable extended hot keys in Internet Explorer mode*
|
||||
- GP name: *EnableExtendedIEModeHotkeys*
|
||||
- GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management*
|
||||
- GP ADMX file name: *inetres.admx*
|
||||
@ -14317,4 +14317,4 @@ ADMX Info:
|
||||
|
||||
## Related topics
|
||||
|
||||
[Policy configuration service provider](policy-configuration-service-provider.md)
|
||||
[Policy configuration service provider](policy-configuration-service-provider.md)
|
||||
|
||||
@ -139,8 +139,8 @@ When you configure your MDT Build Lab deployment share, you can also add applica
|
||||
|
||||
On **MDT01**:
|
||||
|
||||
1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (AcroRdrDC2200120117_en_US.exe) to **D:\\setup\\adobe** on MDT01.
|
||||
2. Extract the .exe file that you downloaded to an .msi (ex: .\AcroRdrDC2200120117_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne).
|
||||
1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (AcroRdrDC2200120142_en_US.exe) to **D:\\setup\\adobe** on MDT01.
|
||||
2. Extract the .exe file that you downloaded to an .msi (ex: .\AcroRdrDC2200120142_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne).
|
||||
3. In the Deployment Workbench, expand the **MDT Production** node and navigate to the **Applications** node.
|
||||
4. Right-click the **Applications** node, and create a new folder named **Adobe**.
|
||||
|
||||
@ -560,6 +560,12 @@ Some properties to use in the MDT Production rules file are as follows:
|
||||
- **USMTMigFiles(\*).** List of USMT templates (controlling what to backup and restore).
|
||||
- **EventService.** Activates logging information to the MDT monitoring web service.
|
||||
|
||||
> [!NOTE]
|
||||
> For more information about localization support, see the following articles:
|
||||
>
|
||||
> - [MDT sample guide](/mem/configmgr/mdt/samples-guide#fully-automated-lti-deployment-for-a-refresh-computer-scenario)
|
||||
> - [LCID (Locale ID) codes](/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a)
|
||||
|
||||
### Optional deployment share configuration
|
||||
|
||||
If your organization has a Microsoft Software Assurance agreement, you also can subscribe to the additional Microsoft Desktop Optimization Package (MDOP) license (at an additional cost). Included in MDOP is Microsoft Diagnostics and Recovery Toolkit (DaRT), which contains tools that can help you troubleshoot MDT deployments, as well as troubleshoot Windows itself.
|
||||
|
||||
@ -42,7 +42,7 @@ Each MDM Policy links to its documentation in the CSP hierarchy, providing its e
|
||||
| Policy | Data type | Value | Function |
|
||||
|--------------------------|-|-|------------------------------------------------------------|
|
||||
|**Provider/*ProviderID*/**[**CommercialID**](/windows/client-management/mdm/dmclient-csp#provider-providerid-commercialid) |String |[Your CommercialID](update-compliance-get-started.md#get-your-commercialid) |Identifies the device as belonging to your organization. |
|
||||
|**System/**[**AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) |Integer | 1 - Basic |Configures the maximum allowed diagnostic data to be sent to Microsoft. Individual users can still set this value lower than what the policy defines. For more information, see the following policy. |
|
||||
|**System/**[**AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) |Integer | 1 - Basic |Sends basic device info, including quality-related data, app compatibility, and other similar data to keep the device secure and up-to-date. For more information, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization). |
|
||||
|**System/**[**ConfigureTelemetryOptInSettingsUx**](/windows/client-management/mdm/policy-csp-system#system-configuretelemetryoptinsettingsux) |Integer |1 - Disable Telemetry opt-in Settings | (in Windows 10, version 1803 and later) Determines whether users of the device can adjust diagnostic data to levels lower than the level defined by AllowTelemetry. We recommend that you disable this policy or the effective diagnostic data level on devices might not be sufficient. |
|
||||
|**System/**[**AllowDeviceNameInDiagnosticData**](/windows/client-management/mdm/policy-csp-system#system-allowdevicenameindiagnosticdata) |Integer | 1 - Allowed | Allows device name to be sent for Windows Diagnostic Data. If this policy is Not Configured or set to 0 (Disabled), Device Name will not be sent and will not be visible in Update Compliance, showing `#` instead. |
|
||||
| **System/**[**AllowUpdateComplianceProcessing**](/windows/client-management/mdm/policy-csp-system#system-allowUpdateComplianceProcessing) |Integer | 16 - Allowed | Enables data flow through Update Compliance's data processing system and indicates a device's explicit enrollment to the service. |
|
||||
|
||||
@ -40,7 +40,7 @@ Before you begin the process to add Update Compliance to your Azure subscription
|
||||
- **Diagnostic data requirements**: Update Compliance requires devices to send diagnostic data at *Required* level (previously *Basic*). Some queries in Update Compliance require devices to send diagnostic data at *Optional* level (previously *Full*) for Windows 11 devices or *Enhanced* level for Windows 10 devices. To learn more about what's included in different diagnostic levels, see [Diagnostics, feedback, and privacy in Windows](https://support.microsoft.com/windows/diagnostics-feedback-and-privacy-in-windows-28808a2b-a31b-dd73-dcd3-4559a5199319).
|
||||
- **Data transmission requirements**: Devices must be able to contact specific endpoints required to authenticate and send diagnostic data. These are enumerated in detail at [Configuring Devices for Update Compliance manually](update-compliance-configuration-manual.md).
|
||||
- **Showing device names in Update Compliance**: For Windows 10, version 1803 or later, device names will not appear in Update Compliance unless you individually opt-in devices by using policy. The steps to accomplish this is outlined in [Configuring Devices for Update Compliance](update-compliance-configuration-manual.md).
|
||||
- **Azure AD device join**: All devices enrolled in Update Compliance must meet all prerequisites for enabling Windows diagnostic data processor configuration, including the Azure AD join requirement. This prerequisite will be enforced for Update Compliance starting on October 15, 2022.
|
||||
- **Azure AD device join** or **hybrid Azure AD join**: All devices enrolled in Update Compliance must meet all prerequisites for enabling Windows diagnostic data processor configuration, including the Azure AD join requirement. This prerequisite will be enforced for Update Compliance starting on October 15, 2022.
|
||||
|
||||
## Add Update Compliance to your Azure subscription
|
||||
|
||||
|
||||
@ -25,6 +25,9 @@ ms.topic: article
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
> [!NOTE]
|
||||
> Windows Server _doesn't_ get feature updates from Windows Update, so only the quality update policies apply. This behavior doesn't apply to [Azure Stack hyperconverged infrastructure (HCI)](/azure-stack/hci/).
|
||||
|
||||
You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. The sections in this topic provide the Group Policy and MDM policies for Windows 10, version 1511 and later, including Windows 11. The MDM policies use the OMA-URI setting from the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider).
|
||||
|
||||
> [!IMPORTANT]
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Delivery Optimization Frequently Asked Questions
|
||||
ms.reviewer:
|
||||
ms.reviewer: aaroncz
|
||||
manager: dougeby
|
||||
description: The following is a list of frequently asked questions for Delivery Optimization.
|
||||
ms.prod: w10
|
||||
@ -37,17 +37,23 @@ For Delivery Optimization to successfully use the proxy, you should set up the p
|
||||
|
||||
## What hostnames should I allow through my firewall to support Delivery Optimization?
|
||||
|
||||
For communication between clients and the Delivery Optimization cloud service: **\*.do.dsp.mp.microsoft.com**.
|
||||
**For communication between clients and the Delivery Optimization cloud service**:
|
||||
|
||||
- `*.do.dsp.mp.microsoft.com`
|
||||
|
||||
**For Delivery Optimization metadata**:
|
||||
|
||||
- *.dl.delivery.mp.microsoft.com
|
||||
- *.emdl.ws.microsoft.com
|
||||
- `*.dl.delivery.mp.microsoft.com`
|
||||
- `*.emdl.ws.microsoft.com`
|
||||
|
||||
**For the payloads (optional)**:
|
||||
|
||||
- *.download.windowsupdate.com
|
||||
- *.windowsupdate.com
|
||||
- `*.download.windowsupdate.com`
|
||||
- `*.windowsupdate.com`
|
||||
|
||||
**For group peers across multiple NATs (Teredo)**:
|
||||
|
||||
- `win1910.ipv6.microsoft.com`
|
||||
|
||||
## Does Delivery Optimization use multicast?
|
||||
|
||||
|
||||
@ -147,15 +147,19 @@ S = Supported; Not considered a downgrade or an upgrade
|
||||
|
||||
**Destination Edition: (Starting)**
|
||||
|
||||
|Edition|Home|Pro|Pro for Workstations|Pro Education|Education|Enterprise LTSC|Enterprise|
|
||||
|--- |--- |--- |--- |--- |--- |--- |--- |
|
||||
|Home||||||||
|
||||
|Pro||||||||
|
||||
|Pro for Workstations||||||||
|
||||
|Pro Education||||||||
|
||||
|Education||✔|✔|✔|||S|
|
||||
|Enterprise LTSC||||||||
|
||||
|Enterprise||✔|✔|✔|S|||
|
||||
 (green checkmark) = Supported downgrade path</br>
|
||||
 (blue checkmark) = Not considered a downgrade or an upgrade<br>
|
||||
 (X) = not supported or not a downgrade</br>
|
||||
|
||||
| **Edition** | **Home** | **Pro** | **Pro for Workstations** | **Pro Education** | **Education** | **Enterprise LTSC** | **Enterprise** |
|
||||
|-----------------| ------------------------------------ | --------------------------- | ------------------------- | -------------------------------------- | ----------------------------------- | --------------------------------------------- |--------------------------------------------- |
|
||||
| **Home** |  |  |  |  |  |  |  |
|
||||
| **Pro** |  |  |  |  |  |  |  |
|
||||
| **Pro for Workstations** |  |  |  |  |  |  |  |
|
||||
| **Pro Education** |  |  |  |  |  |  |  |
|
||||
| **Education** |  |  |  |  |  |  |  |
|
||||
| **Enterprise LTSC** |  |  |  |  |  |  |  |
|
||||
| **Enterprise** |  |  |  |  |  |  |  |
|
||||
|
||||
> **Windows N/KN**: Windows "N" and "KN" SKUs follow the same rules shown above.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ sections:
|
||||
- question: Is Windows 365 for Enterprise supported with Windows Autopatch?
|
||||
answer: |
|
||||
Windows Autopatch supports Windows 365 for Enterprise. Windows 365 for Business isn't supported.
|
||||
- question: Does Windows Autopatch support Windows Education (A3) or Windows Front Line Worker (F3) licensing?
|
||||
- question: Does Windows Autopatch support Windows Education (A3/A5) or Windows Front Line Worker (F3) licensing?
|
||||
answer: |
|
||||
Autopatch isn't available for 'A' or 'F' series licensing.
|
||||
- question: Will Windows Autopatch support local domain join Windows 10?
|
||||
|
||||
@ -11,7 +11,7 @@ ms.collection:
|
||||
- M365-modern-desktop
|
||||
- highpri
|
||||
ms.topic: tutorial
|
||||
ms.date: 05/12/2022
|
||||
ms.date: 07/12/2022
|
||||
---
|
||||
|
||||
# Demonstrate Autopilot deployment
|
||||
@ -42,14 +42,11 @@ You'll need the following components to complete this lab:
|
||||
|
||||
| Component | Description |
|
||||
|:---|:---|
|
||||
|**Windows 10 installation media**|Windows 10 Professional or Enterprise ISO file for a supported version of Windows 10, general availability channel. If you don't already have an ISO to use, download an evaluation version of Windows 10 Enterprise.|
|
||||
|**Windows 10 installation media**|Windows 10 Enterprise ISO file for a supported version of Windows 10, general availability channel. If you don't already have an ISO to use, download an [evaluation version of Windows 10 Enterprise](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise).|
|
||||
|**Internet access**|If you're behind a firewall, see the detailed [networking requirements](/mem/autopilot/software-requirements#networking-requirements). Otherwise, just make sure that you have a connection to the internet.|
|
||||
|**Hyper-V or a physical device running Windows 10**|The guide assumes that you'll use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.|
|
||||
|**An account with Azure Active Directory (Azure AD) Premium license**|This guide will describe how to get a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.|
|
||||
|
||||
> [!NOTE]
|
||||
> The Microsoft Evaluation Center is temporarily unavailable. To access Windows client evaluation media, see [Accessing trials and kits for Windows (Eval Center workaround)](https://techcommunity.microsoft.com/t5/windows-11/accessing-trials-and-kits-for-windows-eval-center-workaround/m-p/3361125).<!-- 6049663 -->
|
||||
|
||||
## Procedures
|
||||
|
||||
A summary of the sections and procedures in the lab is provided below. Follow each section in the order it's presented, skipping the sections that don't apply to you. Optional procedures are provided in the appendices.
|
||||
@ -142,10 +139,7 @@ After you determine the ISO file location and the name of the appropriate networ
|
||||
|
||||
### Set ISO file location
|
||||
|
||||
Download an ISO file for an evaluation version of the latest release of Windows 10 Enterprise. Choose a 64-bit version.
|
||||
|
||||
> [!NOTE]
|
||||
> The Microsoft Evaluation Center is temporarily unavailable. To access this download, see [Accessing trials and kits for Windows (Eval Center workaround)](https://techcommunity.microsoft.com/t5/windows-11/accessing-trials-and-kits-for-windows-eval-center-workaround/m-p/3361125).<!-- 6049663 -->
|
||||
Download an ISO file for an evaluation version of the latest release of Windows 10 Enterprise from the [Evaluation Center](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise). Choose a 64-bit version.
|
||||
|
||||
After you download an ISO file, the name will be long. For example, `19042.508.200927-1902.20h2_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso`
|
||||
|
||||
@ -180,7 +174,8 @@ All VM data will be created under the current path in your PowerShell prompt. Co
|
||||
|
||||
```powershell
|
||||
New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter | Where-Object {$_.Status -eq "Up" -and !$_.Virtual}).Name
|
||||
New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal
|
||||
New-VM -Name WindowsAutopilot -MemoryStartupBytes 4GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal
|
||||
Set-VMProcessor WindowsAutopilot -Count 2
|
||||
Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot
|
||||
Start-VM -VMName WindowsAutopilot
|
||||
```
|
||||
|
||||
@ -38,3 +38,8 @@ By enabling Windows Defender Credential Guard, the following features and soluti
|
||||
- [What's New in Kerberos Authentication for Windows Server 2012](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831747(v=ws.11))
|
||||
- [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd378897(v=ws.10))
|
||||
- [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview)
|
||||
- [Mitigating Credential Theft using the Windows 10 Isolated User Mode](/shows/seth-juarez/mitigating-credential-theft-using-windows-10-isolated-user-mode)
|
||||
- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel](/shows/seth-juarez/isolated-user-mode-processes-features-in-windows-10-logan-gabriel)
|
||||
- [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert](/shows/seth-juarez/more-on-processes-features-in-windows-10-isolated-user-mode-dave-probert)
|
||||
- [Isolated User Mode in Windows 10 with Dave Probert](/shows/seth-juarez/isolated-user-mode-in-windows-10-dave-probert)
|
||||
- [Windows 10 Virtual Secure Mode with David Hepkin](/shows/seth-juarez/windows-10-virtual-secure-mode-david-hepkin)
|
||||
|
||||
@ -809,143 +809,23 @@ Sign-in the NDES server with access equivalent to _local administrator_.
|
||||
|
||||
The Intune Certificate Connector application enables Microsoft Intune to enroll certificates using your on-premises PKI for users on devices managed by Microsoft Intune.
|
||||
|
||||
### Download Intune Certificate Connector
|
||||
|
||||
Sign-in a workstation with access equivalent to a _domain user_.
|
||||
|
||||
1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/).
|
||||
|
||||
2. Select **Tenant administration** > **Connectors and tokens** > **Certificate connectors** > **Add**.
|
||||
|
||||
3. Click **Download the certificate connector software** under the **Install Certificate Connectors** section.
|
||||
|
||||
|
||||
|
||||
4. Save the downloaded file (NDESConnectorSetup.exe) to a location accessible from the NDES server.
|
||||
|
||||
5. Sign-out of the Microsoft Endpoint Manager admin center.
|
||||
|
||||
### Install the Intune Certificate Connector
|
||||
|
||||
Sign-in the NDES server with access equivalent to _domain administrator_.
|
||||
|
||||
1. Copy the Intune Certificate Connector Setup (NDESConnectorSetup.exe) downloaded in the previous task locally to the NDES server.
|
||||
|
||||
2. Run **NDESConnectorSetup.exe** as an administrator. If the setup shows a dialog that reads **Microsoft Intune NDES Connector requires HTTP Activation**, ensure you started the application as an administrator, then check HTTP Activation is enabled on the NDES server.
|
||||
|
||||
3. On the **Microsoft Intune** page, click **Next**.
|
||||
|
||||
|
||||
|
||||
4. Read the **End User License Agreement**. Click **Next** to accept the agreement and to proceed with the installation.
|
||||
|
||||
5. On the **Destination Folder** page, click **Next**.
|
||||
|
||||
6. On the **Installation Options** page, select **SCEP and PFX Profile Distribution** and click **Next**.
|
||||
|
||||
|
||||
|
||||
7. On the **Client certificate for Microsoft Intune** page, Click **Select**. Select the certificate previously enrolled for the NDES server. Click **Next**.
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> The **Client certificate for Microsoft Intune** page does not update after selecting the client authentication certificate. However, the application rembers the selection and shows it in the next page.
|
||||
|
||||
8. On the **Client certificate for the NDES Policy Module** page, verify the certificate information and then click **Next**.
|
||||
|
||||
9. ON the **Ready to install Microsoft Intune Connector** page. Click **Install**.
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> You can review the results of the install using the **SetupMsi.log** file located in the **C:\\NDESConnectorSetupMsi** folder.
|
||||
|
||||
10. When the installation completes, select **Launch Intune Connector** and click Finish. Proceed to the Configure the Intune Certificate Connector task.
|
||||
|
||||
|
||||
|
||||
### Configure the Intune Certificate Connector
|
||||
|
||||
Sign-in the NDES server with access equivalent to _domain administrator_.
|
||||
|
||||
1. The **NDES Connector** user interface should be open from the last task.
|
||||
|
||||
> [!NOTE]
|
||||
> If the **NDES Connector** user interface is not open, you can start it from **\<install_Path>\NDESConnectorUI\NDESConnectorUI.exe**.
|
||||
|
||||
2. If your organization uses a proxy server and the proxy is needed for the NDES server to access the Internet, select **Use proxy server**, and then enter the proxy server name, port, and credentials to connect. Click **Apply**
|
||||
|
||||
|
||||
|
||||
3. Click **Sign-in**. Type credentials for your Intune administrator, or tenant administrator that has the **Global Administrator** directory role.
|
||||
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The user account must have a valid Intune license assigned. If the user account does not have a valid Intune license, the sign-in fails.
|
||||
|
||||
4. Optionally, you can configure the NDES Connector for certificate revocation. If you want to do this, continue to the next task. Otherwise, Click **Close**, restart the **Intune Connector Service** and the **World Wide Web Publishing Service**, and skip the next task.
|
||||
|
||||
To learn how to download, install, and configure the Intune Certificate Connector, see [Install the Certificate Connector for Microsoft Intune](/mem/intune/protect/certificate-connector-install).
|
||||
|
||||
### Configure the NDES Connector for certificate revocation (**Optional**)
|
||||
|
||||
Optionally (not required), you can configure the Intune connector for certificate revocation when a device is wiped, unenrolled, or when the certificate profile falls out of scope for the targeted user (users is removed, deleted, or the profile is deleted).
|
||||
Optionally (not required), you can configure the Intune connector for certificate revocation when a device is wiped, unenrolled, or when the certificate profile falls out of scope for the targeted user (users are removed, deleted, or the profile is deleted). You need to select the **Certificate revocation** option during the connector configuration to enable automatic certificate revocation for certificates issued from a Microsoft Active Directory Certification Authority. Additionally, you need to enable the NDES Service account for revocation.
|
||||
|
||||
#### Enabling the NDES Service account for revocation
|
||||
1. Sign in the certificate authority used by the NDES Connector with access equivalent to _domain administrator_.
|
||||
|
||||
Sign-in the certificate authority used by the NDES Connector with access equivalent to _domain administrator_.
|
||||
2. Start the **Certification Authority** management console.
|
||||
|
||||
1. Start the **Certification Authority** management console.
|
||||
3. In the navigation pane, right-click the name of the certificate authority and select **Properties**.
|
||||
|
||||
2. In the navigation pane, right-click the name of the certificate authority and select **Properties**.
|
||||
|
||||
3. Click the **Security** tab. Click **Add**. In **Enter the object names to select** box, type **NDESSvc** (or the name you gave the NDES Service account). Click *Check Names*. Click **OK**. Select the NDES Service account from the **Group or user names** list. Select **Allow** for the **Issue and Manage Certificates** permission. Click **OK**.
|
||||
4. Select the **Security** tab, then select **Add**. In the **Enter the object names to select** box, enter **NDESSvc** (or the name you gave the NDES Service account). Select *Check Names*, then select **OK**. Select the NDES Service account from the **Group or user names** list. Select **Allow** for the **Issue and Manage Certificates** permission. Select **OK**.
|
||||
|
||||
|
||||
|
||||
4. Close the **Certification Authority**
|
||||
|
||||
#### Enable the NDES Connector for certificate revocation
|
||||
|
||||
Sign-in the NDES server with access equivalent to _domain administrator_.
|
||||
|
||||
1. Open the **NDES Connector** user interface (**\<install_Path>\NDESConnectorUI\NDESConnectorUI.exe**).
|
||||
|
||||
2. Click the **Advanced** tab. Select **Specify a different account username and password**. Type the NDES service account username and password. Click **Apply**. Click **OK** to close the confirmation dialog box. Click **Close**.
|
||||
|
||||
|
||||
|
||||
3. Restart the **Intune Connector Service** and the **World Wide Web Publishing Service**.
|
||||
|
||||
### Test the NDES Connector
|
||||
|
||||
Sign-in the NDES server with access equivalent to _domain admin_.
|
||||
|
||||
1. Open a command prompt.
|
||||
|
||||
2. Type the following command to confirm the NDES Connector's last connection time is current.
|
||||
|
||||
```console
|
||||
reg query hklm\software\Microsoft\MicrosoftIntune\NDESConnector\ConnectionStatus
|
||||
```
|
||||
|
||||
3. Close the command prompt.
|
||||
|
||||
4. Open **Internet Explorer**.
|
||||
|
||||
5. In the navigation bar, type:
|
||||
|
||||
```console
|
||||
https://[fqdnHostName]/certsrv/mscep/mscep.dll
|
||||
```
|
||||
|
||||
where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server.
|
||||
A web page showing a 403 error (similar to the following) should appear in your web browser. If you do not see a similar page, or you get a **503 Service unavailable** message, ensure the NDES Service account has the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source.
|
||||
|
||||
|
||||
|
||||
6. Using **Server Manager**, enable **Internet Explorer Enhanced Security Configuration**.
|
||||
5. Close the **Certification Authority**.
|
||||
|
||||
## Create and Assign a Simple Certificate Enrollment Protocol (SCEP) Certificate Profile
|
||||
|
||||
|
||||
@ -223,7 +223,7 @@ Value | Description
|
||||
**4.** | If present, Secure Memory Overwrite is available.
|
||||
**5.** | If present, NX protections are available.
|
||||
**6.** | If present, SMM mitigations are available.
|
||||
**7.** | If present, Mode Based Execution Control is available.
|
||||
**7.** | If present, MBEC/GMET is available.
|
||||
**8.** | If present, APIC virtualization is available.
|
||||
|
||||
#### InstanceIdentifier
|
||||
@ -243,7 +243,7 @@ Value | Description
|
||||
**4.** | If present, Secure Memory Overwrite is needed.
|
||||
**5.** | If present, NX protections are needed.
|
||||
**6.** | If present, SMM mitigations are needed.
|
||||
**7.** | If present, Mode Based Execution Control is needed.
|
||||
**7.** | If present, MBEC/GMET is needed.
|
||||
|
||||
#### SecurityServicesConfigured
|
||||
|
||||
|
||||
@ -85,7 +85,7 @@ This section describes how an attacker might exploit a feature or its configurat
|
||||
|
||||
### Vulnerability
|
||||
|
||||
The **Log on as a batch job** user right presents a low-risk vulnerability. For most organizations, the default settings are sufficient. Members of the local Administrators group have this right by default.
|
||||
The **Log on as a batch job** user right presents a low-risk vulnerability that allows non-administrators to perform administrator-like functions. If not assessed, understood, and restricted accordingly, attackers can easily exploit this potential attack vector to compromise systems, credentials, and data. For most organizations, the default settings are sufficient. Members of the local Administrators group have this right by default.
|
||||
|
||||
### Countermeasure
|
||||
|
||||
|
||||
@ -47,9 +47,13 @@ When you enable this audit policy, it functions in the same way as the **Network
|
||||
|
||||
The domain controller will log events for NTLM authentication logon attempts that use domain accounts when NTLM authentication would be denied because the **Network security: Restrict NTLM: NTLM authentication in this domain** policy setting is set to **Deny for domain accounts**.
|
||||
|
||||
- Not defined
|
||||
- **Enable for domain servers**
|
||||
|
||||
This is the same as **Disable** and results in no auditing of NTLM traffic.
|
||||
The domain controller will log events for NTLM authentication requests to all servers in the domain when NTLM authentication would be denied because the **Network security: Restrict NTLM: NTLM authentication in this domain** policy setting is set to **Deny for domain servers**.
|
||||
|
||||
- **Enable all**
|
||||
|
||||
The domain controller on which this policy is set will log all events for incoming NTLM traffic.
|
||||
|
||||
### Best practices
|
||||
|
||||
|
||||
@ -113,3 +113,10 @@ See [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-c
|
||||
|
||||
> [!NOTE]
|
||||
> WMI and GP do not currently support multiple policies. Instead, customers who cannot directly access the MDM stack should use the [ApplicationControl CSP via the MDM Bridge WMI Provider](/windows/client-management/mdm/applicationcontrol-csp#powershell-and-wmi-bridge-usage-guidance) to manage Multiple Policy Format Windows Defender Application Control policies.
|
||||
|
||||
### Known Issues in Multiple Policy Format
|
||||
|
||||
* If the maximum number of policies is exceeded, the device may bluescreen referencing ci.dll with a bug check value of 0x0000003b.
|
||||
* If policies are loaded without requiring a reboot such as `PS_UpdateAndCompareCIPolicy`, they will still count towards this limit.
|
||||
* This may pose an especially large challenge if the value of `{PolicyGUID}.cip` changes between releases. It may result in a long window between a change and the resultant reboot.
|
||||
|
||||
|
||||
@ -48,7 +48,7 @@ The blocking filters can be categorized under these filter origins:
|
||||
|
||||
g. Windows Service Hardening (WSH) default
|
||||
|
||||
The next section describes the improvements made to audits 5157 and 5152, and how the above filter origins are used in these events. These improvements were added in Iron release.
|
||||
The next section describes the improvements made to audits 5157 and 5152, and how the above filter origins are used in these events. These improvements were added in the Windows Server 2022 and Windows 11 releases.
|
||||
|
||||
## Improved firewall audit
|
||||
|
||||
|
||||
@ -112,7 +112,7 @@ An array of folders, each representing a location on the host machine that will
|
||||
|
||||
### Logon command
|
||||
|
||||
Specifies a single command that will be invoked automatically after the sandbox logs on. Apps in the sandbox are run under the container user account.
|
||||
Specifies a single command that will be invoked automatically after the sandbox logs on. Apps in the sandbox are run under the container user account. The container user account should be an administrator account.
|
||||
|
||||
```xml
|
||||
<LogonCommand>
|
||||
|
||||
Reference in New Issue
Block a user