mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 23:37:22 +00:00
Merge pull request #2909 from MicrosoftDocs/jreeds-antivirus7
Jreeds antivirus7
This commit is contained in:
jreeds
GitHub
commit
1dcb555241
@ -82,7 +82,7 @@ Follow theses actions to correct known issues related to a misconfigured machine
|
|||||||
- [Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-the-diagnostics-service-is-enabled)</br>
|
- [Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-the-diagnostics-service-is-enabled)</br>
|
||||||
If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the endpoint.
|
If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the endpoint.
|
||||||
|
|
||||||
- [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)</br>
|
- [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy)</br>
|
||||||
If your machines are running a third-party antimalware client, the Microsoft Defender ATP agent needs the Windows Defender Antivirus Early Launch Antimalware (ELAM) driver to be enabled.
|
If your machines are running a third-party antimalware client, the Microsoft Defender ATP agent needs the Windows Defender Antivirus Early Launch Antimalware (ELAM) driver to be enabled.
|
||||||
|
|
||||||
If you took corrective actions and the machine status is still misconfigured, [open a support ticket](https://go.microsoft.com/fwlink/?LinkID=761093&clcid=0x409).
|
If you took corrective actions and the machine status is still misconfigured, [open a support ticket](https://go.microsoft.com/fwlink/?LinkID=761093&clcid=0x409).
|
||||||
|
|||||||
@ -56,7 +56,7 @@ For more information on how to configure exclusions from JAMF, Intune, or anothe
|
|||||||
|
|
||||||
Open the Microsoft Defender ATP application and navigate to **Manage settings** > **Add or Remove Exclusion...**, as shown in the following screenshot:
|
Open the Microsoft Defender ATP application and navigate to **Manage settings** > **Add or Remove Exclusion...**, as shown in the following screenshot:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Select the type of exclusion that you wish to add and follow the prompts.
|
Select the type of exclusion that you wish to add and follow the prompts.
|
||||||
|
|
||||||
|
|||||||
@ -51,20 +51,20 @@ To complete this process, you must have admin privileges on the machine.
|
|||||||
|
|
||||||
1. Navigate to the downloaded wdav.pkg in Finder and open it.
|
1. Navigate to the downloaded wdav.pkg in Finder and open it.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
2. Select **Continue**, agree with the License terms, and enter the password when prompted.
|
2. Select **Continue**, agree with the License terms, and enter the password when prompted.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
> You will be prompted to allow a driver from Microsoft to be installed (either "System Extension Blocked" or "Installation is on hold" or both. The driver must be allowed to be installed.
|
> You will be prompted to allow a driver from Microsoft to be installed (either "System Extension Blocked" or "Installation is on hold" or both. The driver must be allowed to be installed.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**:
|
3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The installation proceeds.
|
The installation proceeds.
|
||||||
|
|
||||||
@ -100,7 +100,7 @@ The installation proceeds.
|
|||||||
|
|
||||||
After installation, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner.
|
After installation, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## How to Allow Full Disk Access
|
## How to Allow Full Disk Access
|
||||||
|
|||||||
@ -63,7 +63,7 @@ Download the installation and onboarding packages from Microsoft Defender Securi
|
|||||||
4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory.
|
4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory.
|
||||||
5. Download **IntuneAppUtil** from [https://docs.microsoft.com/intune/lob-apps-macos](https://docs.microsoft.com/intune/lob-apps-macos).
|
5. Download **IntuneAppUtil** from [https://docs.microsoft.com/intune/lob-apps-macos](https://docs.microsoft.com/intune/lob-apps-macos).
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
6. From a command prompt, verify that you have the three files.
|
6. From a command prompt, verify that you have the three files.
|
||||||
Extract the contents of the .zip files:
|
Extract the contents of the .zip files:
|
||||||
@ -110,11 +110,11 @@ You do not need any special provisioning for a Mac device beyond a standard [Com
|
|||||||
|
|
||||||
1. Confirm device management.
|
1. Confirm device management.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**:
|
Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
2. Select **Continue** and complete the enrollment.
|
2. Select **Continue** and complete the enrollment.
|
||||||
|
|
||||||
@ -122,7 +122,7 @@ You may now enroll more devices. You can also enroll them later, after you have
|
|||||||
|
|
||||||
3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed:
|
3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Create System Configuration profiles
|
## Create System Configuration profiles
|
||||||
|
|
||||||
@ -131,7 +131,7 @@ You may now enroll more devices. You can also enroll them later, after you have
|
|||||||
3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections.
|
3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections.
|
||||||
4. Select **OK**.
|
4. Select **OK**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
|
5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
|
||||||
6. Repeat steps 1 through 5 for more profiles.
|
6. Repeat steps 1 through 5 for more profiles.
|
||||||
@ -306,7 +306,7 @@ You may now enroll more devices. You can also enroll them later, after you have
|
|||||||
|
|
||||||
Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**:
|
Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Publish application
|
## Publish application
|
||||||
|
|
||||||
@ -322,38 +322,38 @@ Once the Intune changes are propagated to the enrolled devices, you can see them
|
|||||||
>
|
>
|
||||||
> If the version uploaded by Intune is lower than the version on the device, then the lower version will be installed, effectively downgrading Defender. This could result in a non-functioning application. See [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md) for additional information about how the product is updated. If you deployed Defender with *Ignore app version* set to **No**, please change it to **Yes**. If Defender still cannot be installed on a client machine, then uninstall Defender and push the updated policy.
|
> If the version uploaded by Intune is lower than the version on the device, then the lower version will be installed, effectively downgrading Defender. This could result in a non-functioning application. See [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md) for additional information about how the product is updated. If you deployed Defender with *Ignore app version* set to **No**, please change it to **Yes**. If Defender still cannot be installed on a client machine, then uninstall Defender and push the updated policy.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
7. Select **OK** and **Add**.
|
7. Select **OK** and **Add**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
8. It may take a few moments to upload the package. After it's done, select the package from the list and go to **Assignments** and **Add group**.
|
8. It may take a few moments to upload the package. After it's done, select the package from the list and go to **Assignments** and **Add group**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
9. Change **Assignment type** to **Required**.
|
9. Change **Assignment type** to **Required**.
|
||||||
10. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Select **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**.
|
10. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Select **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
11. After some time the application will be published to all enrolled devices. You can see it listed in **Monitor** > **Device**, under **Device install status**:
|
11. After some time the application will be published to all enrolled devices. You can see it listed in **Monitor** > **Device**, under **Device install status**:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Verify client device state
|
## Verify client device state
|
||||||
|
|
||||||
1. After the configuration profiles are deployed to your devices, open **System Preferences** > **Profiles** on your Mac device.
|
1. After the configuration profiles are deployed to your devices, open **System Preferences** > **Profiles** on your Mac device.
|
||||||
|
|
||||||
<br/>
|
<br/>
|
||||||
|
|
||||||
|
|
||||||
2. Verify that the following configuration profiles are present and installed. The **Management Profile** should be the Intune system profile. _Wdav-config_ and _wdav-kext_ are system configuration profiles that were added in Intune:
|
2. Verify that the following configuration profiles are present and installed. The **Management Profile** should be the Intune system profile. _Wdav-config_ and _wdav-kext_ are system configuration profiles that were added in Intune:
|
||||||
|
|
||||||
|
|
||||||
3. You should also see the Microsoft Defender icon in the top-right corner:
|
3. You should also see the Microsoft Defender icon in the top-right corner:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Troubleshooting
|
## Troubleshooting
|
||||||
|
|
||||||
|
|||||||
@ -65,7 +65,7 @@ Download the installation and onboarding packages from Microsoft Defender Securi
|
|||||||
4. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory.
|
4. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory.
|
||||||
5. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory.
|
5. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
6. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so:
|
6. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so:
|
||||||
|
|
||||||
@ -108,7 +108,7 @@ To approve the kernel extension:
|
|||||||
1. In **Computers > Configuration Profiles** select **Options > Approved Kernel Extensions**.
|
1. In **Computers > Configuration Profiles** select **Options > Approved Kernel Extensions**.
|
||||||
2. Use **UBF8T346G9** for Team Id.
|
2. Use **UBF8T346G9** for Team Id.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Privacy Preferences Policy Control
|
### Privacy Preferences Policy Control
|
||||||
|
|
||||||
@ -124,7 +124,7 @@ Add the following JAMF policy to grant Full Disk Access to Microsoft Defender AT
|
|||||||
3. Set Code Requirement to `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`.
|
3. Set Code Requirement to `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`.
|
||||||
4. Set app or service to SystemPolicyAllFiles and access to Allow.
|
4. Set app or service to SystemPolicyAllFiles and access to Allow.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### Configuration Profile's Scope
|
#### Configuration Profile's Scope
|
||||||
|
|
||||||
@ -132,7 +132,7 @@ Configure the appropriate scope to specify the devices that will receive the con
|
|||||||
|
|
||||||
Open **Computers** > **Configuration Profiles**, and select **Scope > Targets**. From there, select the devices you want to target.
|
Open **Computers** > **Configuration Profiles**, and select **Scope > Targets**. From there, select the devices you want to target.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Save the **Configuration Profile**.
|
Save the **Configuration Profile**.
|
||||||
|
|
||||||
@ -152,7 +152,7 @@ Starting in macOS 10.15 (Catalina) a user must manually allow to display notific
|
|||||||
|
|
||||||
1. Create a package in **Settings > Computer Management > Packages**.
|
1. Create a package in **Settings > Computer Management > Packages**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
2. Upload the package to the Distribution Point.
|
2. Upload the package to the Distribution Point.
|
||||||
3. In the **filename** field, enter the name of the package. For example, _wdav.pkg_.
|
3. In the **filename** field, enter the name of the package. For example, _wdav.pkg_.
|
||||||
@ -161,7 +161,7 @@ Starting in macOS 10.15 (Catalina) a user must manually allow to display notific
|
|||||||
|
|
||||||
Your policy should contain a single package for Microsoft Defender.
|
Your policy should contain a single package for Microsoft Defender.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Configure the appropriate scope to specify the computers that will receive this policy.
|
Configure the appropriate scope to specify the computers that will receive this policy.
|
||||||
|
|
||||||
@ -176,12 +176,12 @@ You'll need no special provisioning for a macOS computer, beyond the standard JA
|
|||||||
|
|
||||||
- Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile.
|
- Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile.
|
||||||
|
|
||||||
<br/>
|
<br/>
|
||||||
|
|
||||||
|
|
||||||
After a moment, the device's User Approved MDM status will change to **Yes**.
|
After a moment, the device's User Approved MDM status will change to **Yes**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
You may now enroll additional devices. You may also enroll them later, after you have finished provisioning system configuration and application packages.
|
You may now enroll additional devices. You may also enroll them later, after you have finished provisioning system configuration and application packages.
|
||||||
|
|
||||||
@ -196,17 +196,17 @@ You can monitor deployment status in the **Logs** tab:
|
|||||||
- **Pending** means that the deployment is scheduled but has not yet happened
|
- **Pending** means that the deployment is scheduled but has not yet happened
|
||||||
- **Completed** means that the deployment succeeded and is no longer scheduled
|
- **Completed** means that the deployment succeeded and is no longer scheduled
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Status on client device
|
### Status on client device
|
||||||
|
|
||||||
After the Configuration Profile is deployed, you'll see the profile for the device in **System Preferences** > **Profiles >**.
|
After the Configuration Profile is deployed, you'll see the profile for the device in **System Preferences** > **Profiles >**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Once the policy is applied, you'll see the Microsoft Defender ATP icon in the macOS status bar in the top-right corner.
|
Once the policy is applied, you'll see the Microsoft Defender ATP icon in the macOS status bar in the top-right corner.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
You can monitor policy installation on a device by following the JAMF log file:
|
You can monitor policy installation on a device by following the JAMF log file:
|
||||||
|
|
||||||
@ -279,12 +279,12 @@ This script removes Microsoft Defender ATP from the /Applications directory:
|
|||||||
echo "Done!"
|
echo "Done!"
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Policy
|
### Policy
|
||||||
|
|
||||||
Your policy should contain a single script:
|
Your policy should contain a single script:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Configure the appropriate scope in the **Scope** tab to specify the machines that will receive this policy.
|
Configure the appropriate scope in the **Scope** tab to specify the machines that will receive this policy.
|
||||||
|
|||||||
@ -29,7 +29,7 @@ Starting with macOS High Sierra (10.13), macOS requires all kernel extensions to
|
|||||||
|
|
||||||
If you did not approve the kernel extension during the deployment / installation of Microsoft Defender ATP for Mac, then the application displays a banner prompting you to enable it:
|
If you did not approve the kernel extension during the deployment / installation of Microsoft Defender ATP for Mac, then the application displays a banner prompting you to enable it:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
You can also run ```mdatp --health```. It reports if real-time protection is enabled but not available. This is an indication that the kernel extension is not approved to run on your device.
|
You can also run ```mdatp --health```. It reports if real-time protection is enabled but not available. This is an indication that the kernel extension is not approved to run on your device.
|
||||||
|
|
||||||
@ -56,7 +56,7 @@ If less than 30 minutes have passed since the product was installed, navigate to
|
|||||||
|
|
||||||
If you don't see this prompt, it means that 30 or more minutes have passed, and the kernel extension still not been approved to run on your device:
|
If you don't see this prompt, it means that 30 or more minutes have passed, and the kernel extension still not been approved to run on your device:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
In this case, you need to perform the following steps to trigger the approval flow again.
|
In this case, you need to perform the following steps to trigger the approval flow again.
|
||||||
|
|
||||||
|
|||||||
@ -37,7 +37,7 @@ The following steps can be used to troubleshoot and mitigate these issues:
|
|||||||
|
|
||||||
- From the user interface. Open Microsoft Defender ATP for Mac and navigate to **Manage settings**.
|
- From the user interface. Open Microsoft Defender ATP for Mac and navigate to **Manage settings**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- From the Terminal. For security purposes, this operation requires elevation.
|
- From the Terminal. For security purposes, this operation requires elevation.
|
||||||
|
|
||||||
|
|||||||
@ -27,7 +27,7 @@ Microsoft regularly publishes software updates to improve performance, security,
|
|||||||
|
|
||||||
To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. By default, MAU automatically checks for updates daily, but you can change that to weekly, monthly, or manually.
|
To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. By default, MAU automatically checks for updates daily, but you can change that to weekly, monthly, or manually.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
If you decide to deploy updates by using your software distribution tools, you should configure MAU to manually check for software updates. You can deploy preferences to configure how and when MAU checks for updates for the Macs in your organization.
|
If you decide to deploy updates by using your software distribution tools, you should configure MAU to manually check for software updates. You can deploy preferences to configure how and when MAU checks for updates for the Macs in your organization.
|
||||||
|
|
||||||
|
|||||||
@ -76,7 +76,7 @@ Create custom rules to control when alerts are suppressed, or resolved. You can
|
|||||||
* URL - wildcard supported
|
* URL - wildcard supported
|
||||||
* Command line - wildcard supported
|
* Command line - wildcard supported
|
||||||
|
|
||||||
3. Select the **Trigerring IOC**.
|
3. Select the **Triggering IOC**.
|
||||||
|
|
||||||
4. Specify the action and scope on the alert. <br>
|
4. Specify the action and scope on the alert. <br>
|
||||||
You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue, alert page, and machine timeline and will appear as resolved across Microsoft Defender ATP APIs. <br><br> Alerts that are marked as hidden will be suppressed from the entire system, both on the machine's associated alerts and from the dashboard and will not be streamed across Microsoft Defender ATP APIs.
|
You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue, alert page, and machine timeline and will appear as resolved across Microsoft Defender ATP APIs. <br><br> Alerts that are marked as hidden will be suppressed from the entire system, both on the machine's associated alerts and from the dashboard and will not be streamed across Microsoft Defender ATP APIs.
|
||||||
|
|||||||
@ -70,7 +70,7 @@ There are two ways you can create indicators for files:
|
|||||||
### Before you begin
|
### Before you begin
|
||||||
It's important to understand the following prerequisites prior to creating indicators for files:
|
It's important to understand the following prerequisites prior to creating indicators for files:
|
||||||
|
|
||||||
- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md).
|
- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md).
|
||||||
- The Antimalware client version must be 4.18.1901.x or later.
|
- The Antimalware client version must be 4.18.1901.x or later.
|
||||||
- Supported on machines on Windows 10, version 1703 or later.
|
- Supported on machines on Windows 10, version 1703 or later.
|
||||||
- To start blocking files, you first need to [turn the **Block or allow** feature on](advanced-features.md) in Settings.
|
- To start blocking files, you first need to [turn the **Block or allow** feature on](advanced-features.md) in Settings.
|
||||||
@ -160,7 +160,7 @@ You can create indicators for certificates. Some common use cases include:
|
|||||||
|
|
||||||
It's important to understand the following requirements prior to creating indicators for certificates:
|
It's important to understand the following requirements prior to creating indicators for certificates:
|
||||||
|
|
||||||
- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md).
|
- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md).
|
||||||
- The Antimalware client version must be 4.18.1901.x or later.
|
- The Antimalware client version must be 4.18.1901.x or later.
|
||||||
- Supported on machines on Windows 10, version 1703 or later.
|
- Supported on machines on Windows 10, version 1703 or later.
|
||||||
- The virus and threat protection definitions must be up-to-date.
|
- The virus and threat protection definitions must be up-to-date.
|
||||||
|
|||||||
@ -87,7 +87,7 @@ The attack surface reduction set of capabilities provide the first line of defen
|
|||||||
|
|
||||||
<a name="ngp"></a>
|
<a name="ngp"></a>
|
||||||
|
|
||||||
**[Next generation protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)**<br>
|
**[Next generation protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10)**<br>
|
||||||
To further reinforce the security perimeter of your network, Microsoft Defender ATP uses next generation protection designed to catch all types of emerging threats.
|
To further reinforce the security perimeter of your network, Microsoft Defender ATP uses next generation protection designed to catch all types of emerging threats.
|
||||||
|
|
||||||
<a name="edr"></a>
|
<a name="edr"></a>
|
||||||
|
|||||||
@ -168,7 +168,7 @@ Before you onboard machines, the diagnostic data service must be enabled. The se
|
|||||||
## Windows Defender Antivirus configuration requirement
|
## Windows Defender Antivirus configuration requirement
|
||||||
The Microsoft Defender ATP agent depends on the ability of Windows Defender Antivirus to scan files and provide information about them.
|
The Microsoft Defender ATP agent depends on the ability of Windows Defender Antivirus to scan files and provide information about them.
|
||||||
|
|
||||||
You must configure Security intelligence updates on the Microsoft Defender ATP machines whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md).
|
You must configure Security intelligence updates on the Microsoft Defender ATP machines whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md).
|
||||||
|
|
||||||
When Windows Defender Antivirus is not the active antimalware in your organization and you use the Microsoft Defender ATP service, Windows Defender Antivirus goes on passive mode. If your organization has disabled Windows Defender Antivirus through group policy or other methods, machines that are onboarded to Microsoft Defender ATP must be excluded from this group policy.
|
When Windows Defender Antivirus is not the active antimalware in your organization and you use the Microsoft Defender ATP service, Windows Defender Antivirus goes on passive mode. If your organization has disabled Windows Defender Antivirus through group policy or other methods, machines that are onboarded to Microsoft Defender ATP must be excluded from this group policy.
|
||||||
|
|
||||||
@ -178,12 +178,12 @@ If you are onboarding servers and Windows Defender Antivirus is not the active a
|
|||||||
> Your regular group policy doesn't apply to Tamper Protection, and changes to Windows Defender Antivirus settings will be ignored when Tamper Protection is on.
|
> Your regular group policy doesn't apply to Tamper Protection, and changes to Windows Defender Antivirus settings will be ignored when Tamper Protection is on.
|
||||||
|
|
||||||
|
|
||||||
For more information, see [Windows Defender Antivirus compatibility](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
|
For more information, see [Windows Defender Antivirus compatibility](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||||
|
|
||||||
## Windows Defender Antivirus Early Launch Antimalware (ELAM) driver is enabled
|
## Windows Defender Antivirus Early Launch Antimalware (ELAM) driver is enabled
|
||||||
If you're running Windows Defender Antivirus as the primary antimalware product on your machines, the Microsoft Defender ATP agent will successfully onboard.
|
If you're running Windows Defender Antivirus as the primary antimalware product on your machines, the Microsoft Defender ATP agent will successfully onboard.
|
||||||
|
|
||||||
If you're running a third-party antimalware client and use Mobile Device Management solutions or Microsoft Endpoint Configuration Manager (current branch), you'll need to ensure that the Windows Defender Antivirus ELAM driver is enabled. For more information, see [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy).
|
If you're running a third-party antimalware client and use Mobile Device Management solutions or Microsoft Endpoint Configuration Manager (current branch), you'll need to ensure that the Windows Defender Antivirus ELAM driver is enabled. For more information, see [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy).
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|||||||
@ -48,7 +48,7 @@ Network protection requires Windows 10 Pro, Enterprise E3, E5 and Windows Defend
|
|||||||
|
|
||||||
Windows 10 version | Windows Defender Antivirus
|
Windows 10 version | Windows Defender Antivirus
|
||||||
-|-
|
-|-
|
||||||
Windows 10 version 1709 or later | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled
|
Windows 10 version 1709 or later | [Windows Defender AV real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) and [cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) must be enabled
|
||||||
|
|
||||||
## Review network protection events in the Microsoft Defender ATP Security Center
|
## Review network protection events in the Microsoft Defender ATP Security Center
|
||||||
|
|
||||||
|
|||||||
@ -34,7 +34,7 @@
|
|||||||
#### [Network firewall](../windows-firewall/windows-firewall-with-advanced-security.md)
|
#### [Network firewall](../windows-firewall/windows-firewall-with-advanced-security.md)
|
||||||
|
|
||||||
|
|
||||||
### [Next generation protection](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
|
### [Next generation protection](../microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md)
|
||||||
|
|
||||||
|
|
||||||
### [Endpoint detection and response]()
|
### [Endpoint detection and response]()
|
||||||
@ -72,7 +72,7 @@
|
|||||||
###### [Initiate Automated Investigation](respond-machine-alerts.md#initiate-automated-investigation)
|
###### [Initiate Automated Investigation](respond-machine-alerts.md#initiate-automated-investigation)
|
||||||
###### [Initiate Live Response Session](respond-machine-alerts.md#initiate-live-response-session)
|
###### [Initiate Live Response Session](respond-machine-alerts.md#initiate-live-response-session)
|
||||||
###### [Collect investigation package from machines](respond-machine-alerts.md#collect-investigation-package-from-machines)
|
###### [Collect investigation package from machines](respond-machine-alerts.md#collect-investigation-package-from-machines)
|
||||||
###### [Run Windows Defender Antivirus scan on machines](respond-machine-alerts.md#run-windows-defender-antivirus-scan-on-machines)
|
###### [Run Windows Defender Antivirus scan on machines](respond-machine-alerts.md#run-microsoft-defender-antivirus-scan-on-machines)
|
||||||
###### [Restrict app execution](respond-machine-alerts.md#restrict-app-execution)
|
###### [Restrict app execution](respond-machine-alerts.md#restrict-app-execution)
|
||||||
###### [Isolate machines from the network](respond-machine-alerts.md#isolate-machines-from-the-network)
|
###### [Isolate machines from the network](respond-machine-alerts.md#isolate-machines-from-the-network)
|
||||||
###### [Check activity details in Action center](respond-machine-alerts.md#check-activity-details-in-action-center)
|
###### [Check activity details in Action center](respond-machine-alerts.md#check-activity-details-in-action-center)
|
||||||
@ -158,7 +158,7 @@
|
|||||||
###### [Controlled folder access](../windows-defender-exploit-guard/evaluate-controlled-folder-access.md)
|
###### [Controlled folder access](../windows-defender-exploit-guard/evaluate-controlled-folder-access.md)
|
||||||
###### [Attack surface reduction](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md)
|
###### [Attack surface reduction](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md)
|
||||||
###### [Network firewall](../windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md)
|
###### [Network firewall](../windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md)
|
||||||
##### [Evaluate next generation protection](../windows-defender-antivirus/evaluate-windows-defender-antivirus.md)
|
##### [Evaluate next generation protection](../microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
### [Access the Microsoft Defender Security Center Community Center](community.md)
|
### [Access the Microsoft Defender Security Center Community Center](community.md)
|
||||||
|
|
||||||
@ -204,95 +204,95 @@
|
|||||||
|
|
||||||
|
|
||||||
### [Configure next generation protection]()
|
### [Configure next generation protection]()
|
||||||
#### [Configure Windows Defender Antivirus features](../windows-defender-antivirus/configure-windows-defender-antivirus-features.md)
|
#### [Configure Windows Defender Antivirus features](../microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md)
|
||||||
#### [Utilize Microsoft cloud-delivered protection]()
|
#### [Utilize Microsoft cloud-delivered protection]()
|
||||||
##### [Understand cloud-delivered protection](../windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md)
|
##### [Understand cloud-delivered protection](../microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md)
|
||||||
##### [Enable cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md)
|
##### [Enable cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md)
|
||||||
##### [Specify the cloud-delivered protection level](../windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md)
|
##### [Specify the cloud-delivered protection level](../microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md)
|
||||||
##### [Configure and validate network connections](../windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md)
|
##### [Configure and validate network connections](../microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md)
|
||||||
##### [Enable Block at first sight](../windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md)
|
##### [Enable Block at first sight](../microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md)
|
||||||
##### [Configure the cloud block timeout period](../windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md)
|
##### [Configure the cloud block timeout period](../microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
#### [Configure behavioral, heuristic, and real-time protection]()
|
#### [Configure behavioral, heuristic, and real-time protection]()
|
||||||
##### [Configuration overview](../windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md)
|
##### [Configuration overview](../microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md)
|
||||||
##### [Detect and block potentially unwanted applications](../windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md)
|
##### [Detect and block potentially unwanted applications](../microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md)
|
||||||
##### [Enable and configure always-on protection and monitoring](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md)
|
##### [Enable and configure always-on protection and monitoring](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
#### [Antivirus on Windows Server 2016](../windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md)
|
#### [Antivirus on Windows Server 2016](../microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md)
|
||||||
|
|
||||||
#### [Antivirus compatibility]()
|
#### [Antivirus compatibility]()
|
||||||
##### [Compatibility charts](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md)
|
##### [Compatibility charts](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md)
|
||||||
##### [Use limited periodic antivirus scanning](../windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md)
|
##### [Use limited periodic antivirus scanning](../microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
#### [Deploy, manage updates, and report on antivirus]()
|
#### [Deploy, manage updates, and report on antivirus]()
|
||||||
##### [Using Windows Defender Antivirus](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md)
|
##### [Using Windows Defender Antivirus](../microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
##### [Deploy and enable antivirus]()
|
##### [Deploy and enable antivirus]()
|
||||||
###### [Preparing to deploy](../windows-defender-antivirus/deploy-windows-defender-antivirus.md)
|
###### [Preparing to deploy](../microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md)
|
||||||
###### [Deployment guide for VDI environments](../windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md)
|
###### [Deployment guide for VDI environments](../microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
##### [Report on antivirus protection]()
|
##### [Report on antivirus protection]()
|
||||||
###### [Review protection status and aqlerts](../windows-defender-antivirus/report-monitor-windows-defender-antivirus.md)
|
###### [Review protection status and aqlerts](../microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md)
|
||||||
###### [Troubleshoot antivirus reporting in Update Compliance](../windows-defender-antivirus/troubleshoot-reporting.md)
|
###### [Troubleshoot antivirus reporting in Update Compliance](../microsoft-defender-antivirus/troubleshoot-reporting.md)
|
||||||
|
|
||||||
##### [Manage updates and apply baselines]()
|
##### [Manage updates and apply baselines]()
|
||||||
###### [Learn about the different kinds of updates](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md)
|
###### [Learn about the different kinds of updates](../microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md)
|
||||||
###### [Manage protection and Security intelligence updates](../windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md)
|
###### [Manage protection and Security intelligence updates](../microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md)
|
||||||
###### [Manage when protection updates should be downloaded and applied](../windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md)
|
###### [Manage when protection updates should be downloaded and applied](../microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md)
|
||||||
###### [Manage updates for endpoints that are out of date](../windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md)
|
###### [Manage updates for endpoints that are out of date](../microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md)
|
||||||
###### [Manage event-based forced updates](../windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md)
|
###### [Manage event-based forced updates](../microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md)
|
||||||
###### [Manage updates for mobile devices and VMs](../windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md)
|
###### [Manage updates for mobile devices and VMs](../microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
#### [Customize, initiate, and review the results of scans and remediation]()
|
#### [Customize, initiate, and review the results of scans and remediation]()
|
||||||
##### [Configuration overview](../windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md)
|
##### [Configuration overview](../microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
##### [Configure and validate exclusions in antivirus scans]()
|
##### [Configure and validate exclusions in antivirus scans]()
|
||||||
###### [Exclusions overview](../windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md)
|
###### [Exclusions overview](../microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md)
|
||||||
###### [Configure and validate exclusions based on file name, extension, and folder location](../windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md)
|
###### [Configure and validate exclusions based on file name, extension, and folder location](../microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md)
|
||||||
###### [Configure and validate exclusions for files opened by processes](../windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md)
|
###### [Configure and validate exclusions for files opened by processes](../microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md)
|
||||||
###### [Configure antivirus exclusions Windows Server 2016](../windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md)
|
###### [Configure antivirus exclusions Windows Server 2016](../microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
##### [Configure antivirus scanning options](../windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md)
|
##### [Configure antivirus scanning options](../microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md)
|
||||||
##### [Configure remediation for scans](../windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md)
|
##### [Configure remediation for scans](../microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md)
|
||||||
##### [Configure scheduled scans](../windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md)
|
##### [Configure scheduled scans](../microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md)
|
||||||
##### [Configure and run scans](../windows-defender-antivirus/run-scan-windows-defender-antivirus.md)
|
##### [Configure and run scans](../microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md)
|
||||||
##### [Review scan results](../windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md)
|
##### [Review scan results](../microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md)
|
||||||
##### [Run and review the results of an offline scan](../windows-defender-antivirus/windows-defender-offline.md)
|
##### [Run and review the results of an offline scan](../microsoft-defender-antivirus/windows-defender-offline.md)
|
||||||
|
|
||||||
#### [Restore quarantined files](../windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md)
|
#### [Restore quarantined files](../microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
#### [Manage antivirus in your business]()
|
#### [Manage antivirus in your business]()
|
||||||
##### [Management overview](../windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md)
|
##### [Management overview](../microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md)
|
||||||
##### [Use Group Policy settings to configure and manage antivirus](../windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md)
|
##### [Use Group Policy settings to configure and manage antivirus](../microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md)
|
||||||
##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage antivirus](../windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md)
|
##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage antivirus](../microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md)
|
||||||
##### [Use PowerShell cmdlets to configure and manage antivirus](../windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md)
|
##### [Use PowerShell cmdlets to configure and manage antivirus](../microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md)
|
||||||
##### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](../windows-defender-antivirus/use-wmi-windows-defender-antivirus.md)
|
##### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](../microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md)
|
||||||
##### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](../windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md)
|
##### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](../microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
#### [Manage scans and remediation]()
|
#### [Manage scans and remediation]()
|
||||||
##### [Management overview](../windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md)
|
##### [Management overview](../microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
##### [Configure and validate exclusions in antivirus scans]()
|
##### [Configure and validate exclusions in antivirus scans]()
|
||||||
###### [Exclusions overview](../windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md)
|
###### [Exclusions overview](../microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md)
|
||||||
###### [Configure and validate exclusions based on file name, extension, and folder location](../windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md)
|
###### [Configure and validate exclusions based on file name, extension, and folder location](../microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md)
|
||||||
###### [Configure and validate exclusions for files opened by processes](../windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md)
|
###### [Configure and validate exclusions for files opened by processes](../microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md)
|
||||||
###### [Configure antivirus exclusions on Windows Server 2016](../windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md)
|
###### [Configure antivirus exclusions on Windows Server 2016](../microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
##### [Configure scanning options](../windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md)
|
##### [Configure scanning options](../microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md)
|
||||||
##### [Configure remediation for scans](../windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md)
|
##### [Configure remediation for scans](../microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md)
|
||||||
##### [Configure scheduled scans](../windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md)
|
##### [Configure scheduled scans](../microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md)
|
||||||
##### [Configure and run scans](../windows-defender-antivirus/run-scan-windows-defender-antivirus.md)
|
##### [Configure and run scans](../microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md)
|
||||||
##### [Review scan results](../windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md)
|
##### [Review scan results](../microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md)
|
||||||
##### [Run and review the results of an offline scan](../windows-defender-antivirus/windows-defender-offline.md)
|
##### [Run and review the results of an offline scan](../microsoft-defender-antivirus/windows-defender-offline.md)
|
||||||
##### [Restore quarantined files](../windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md)
|
##### [Restore quarantined files](../microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
#### [Manage next generation protection in your business]()
|
#### [Manage next generation protection in your business]()
|
||||||
##### [Management overview](../windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md)
|
##### [Management overview](../microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md)
|
||||||
##### [Use Microsoft Intune and System Center Configuration Manager to manage next generation protection](../windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md)
|
##### [Use Microsoft Intune and System Center Configuration Manager to manage next generation protection](../microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md)
|
||||||
##### [Use Group Policy settings to manage next generation protection](../windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md)
|
##### [Use Group Policy settings to manage next generation protection](../microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md)
|
||||||
##### [Use PowerShell cmdlets to manage next generation protection](../windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md)
|
##### [Use PowerShell cmdlets to manage next generation protection](../microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md)
|
||||||
##### [Use Windows Management Instrumentation (WMI) to manage next generation protection](../windows-defender-antivirus/use-wmi-windows-defender-antivirus.md)
|
##### [Use Windows Management Instrumentation (WMI) to manage next generation protection](../microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md)
|
||||||
##### [Use the mpcmdrun.exe command line tool to manage next generation protection](../windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md)
|
##### [Use the mpcmdrun.exe command line tool to manage next generation protection](../microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -525,4 +525,4 @@
|
|||||||
#### [Collect diagnostic data for files](../windows-defender-exploit-guard/troubleshoot-np.md)
|
#### [Collect diagnostic data for files](../windows-defender-exploit-guard/troubleshoot-np.md)
|
||||||
|
|
||||||
|
|
||||||
### [Troubleshoot next generation protection issues](../windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md)
|
### [Troubleshoot next generation protection issues](../microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md)
|
||||||
|
|||||||
@ -51,7 +51,7 @@ Microsoft Defender ATP integrates with System Center Endpoint Protection to prov
|
|||||||
The following steps are required to enable this integration:
|
The following steps are required to enable this integration:
|
||||||
- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie)
|
- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie)
|
||||||
- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting
|
- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting
|
||||||
- Configure your network to allow connections to the Windows Defender Antivirus cloud. For more information, see [Allow connections to the Windows Defender Antivirus cloud](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus#allow-connections-to-the-windows-defender-antivirus-cloud)
|
- Configure your network to allow connections to the Windows Defender Antivirus cloud. For more information, see [Allow connections to the Windows Defender Antivirus cloud](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus#allow-connections-to-the-microsoft-defender-antivirus-cloud)
|
||||||
|
|
||||||
## Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender ATP
|
## Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender ATP
|
||||||
|
|
||||||
|
|||||||
@ -30,7 +30,7 @@ Configure and manage all the Microsoft Defender ATP capabilities to get the best
|
|||||||
Topic | Description
|
Topic | Description
|
||||||
:---|:---
|
:---|:---
|
||||||
[Configure attack surface reduction capabilities](configure-attack-surface-reduction.md) | By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations.
|
[Configure attack surface reduction capabilities](configure-attack-surface-reduction.md) | By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations.
|
||||||
[Configure next generation protection](../windows-defender-antivirus/configure-windows-defender-antivirus-features.md) | Configure next generation protection to catch all types of emerging threats.
|
[Configure next generation protection](../microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md) | Configure next generation protection to catch all types of emerging threats.
|
||||||
[Configure Microsoft Threat Experts capabilities](configure-microsoft-threat-experts.md) | Configure and manage how you would like to get cybersecurity threat intelligence from Microsoft Threat Experts.
|
[Configure Microsoft Threat Experts capabilities](configure-microsoft-threat-experts.md) | Configure and manage how you would like to get cybersecurity threat intelligence from Microsoft Threat Experts.
|
||||||
[Configure Microsoft Threat Protection integration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration)| Configure other solutions that integrate with Microsoft Defender ATP.
|
[Configure Microsoft Threat Protection integration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration)| Configure other solutions that integrate with Microsoft Defender ATP.
|
||||||
[Management and API support](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/management-apis)| Pull alerts to your SIEM or use APIs to create custom alerts. Create and build Power BI reports.
|
[Management and API support](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/management-apis)| Pull alerts to your SIEM or use APIs to create custom alerts. Create and build Power BI reports.
|
||||||
|
|||||||
@ -234,7 +234,7 @@ Microsoft Defender Antivirus is a built-in antimalware solution that provides ne
|
|||||||
needs on how Antivirus is configured.
|
needs on how Antivirus is configured.
|
||||||
|
|
||||||
|
|
||||||
[Quick scan versus full scan and custom scan](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus#quick-scan-versus-full-scan-and-custom-scan)
|
[Quick scan versus full scan and custom scan](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus#quick-scan-versus-full-scan-and-custom-scan)
|
||||||
|
|
||||||
For more details, see [Windows Security configuration framework](https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework)
|
For more details, see [Windows Security configuration framework](https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework)
|
||||||
|
|
||||||
|
|||||||
@ -172,7 +172,7 @@ how the endpoint security suite should be enabled.
|
|||||||
|-----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------|
|
|-----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------|
|
||||||
| Endpoint Detection & Response (EDR) | Microsoft Defender ATP endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response) | 1 |
|
| Endpoint Detection & Response (EDR) | Microsoft Defender ATP endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response) | 1 |
|
||||||
|Threat & Vulnerability Management (TVM)|Threat & Vulnerability Management is a component of Microsoft Defender ATP, and provides both security administrators and security operations teams with unique value, including: <br> - Real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities <br> - Invaluable machine vulnerability context during incident investigations <br> - Built-in remediation processes through Microsoft Intune and Microsoft System Center Configuration Manager <br> [Learn more](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Introducing-a-risk-based-approach-to-threat-and-vulnerability/ba-p/377845).| 2 |
|
|Threat & Vulnerability Management (TVM)|Threat & Vulnerability Management is a component of Microsoft Defender ATP, and provides both security administrators and security operations teams with unique value, including: <br> - Real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities <br> - Invaluable machine vulnerability context during incident investigations <br> - Built-in remediation processes through Microsoft Intune and Microsoft System Center Configuration Manager <br> [Learn more](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Introducing-a-risk-based-approach-to-threat-and-vulnerability/ba-p/377845).| 2 |
|
||||||
| Next Generation Protection (NGP) | Microsoft Defender Antivirus is a built-in antimalware solution that provides next generation protection for desktops, portable computers, and servers. Windows Defender Antivirus includes: <br> -Cloud-delivered protection for near-instant detection and blocking of new and emerging threats. Along with machine learning and the Intelligent Security Graph, cloud-delivered protection is part of the next-gen technologies that power Windows Defender Antivirus. <br> - Always-on scanning using advanced file and process behavior monitoring and other heuristics (also known as "real-time protection"). <br> - Dedicated protection updates based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research. <br> [Learn more](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10). |3 |
|
| Next Generation Protection (NGP) | Microsoft Defender Antivirus is a built-in antimalware solution that provides next generation protection for desktops, portable computers, and servers. Windows Defender Antivirus includes: <br> -Cloud-delivered protection for near-instant detection and blocking of new and emerging threats. Along with machine learning and the Intelligent Security Graph, cloud-delivered protection is part of the next-gen technologies that power Windows Defender Antivirus. <br> - Always-on scanning using advanced file and process behavior monitoring and other heuristics (also known as "real-time protection"). <br> - Dedicated protection updates based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research. <br> [Learn more](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10). |3 |
|
||||||
| Attack Surface Reduction (ASR) | Attack surface reduction capabilities in Microsoft Defender ATP helps protect the devices and applications in the organization from new and emerging threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) | 4 |
|
| Attack Surface Reduction (ASR) | Attack surface reduction capabilities in Microsoft Defender ATP helps protect the devices and applications in the organization from new and emerging threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) | 4 |
|
||||||
| Auto Investigation & Remediation (AIR) | Microsoft Defender ATP uses Automated investigations to significantly reduce the volume of alerts that need to be investigated individually. The Automated investigation feature leverages various inspection algorithms, and processes used by analysts (such as playbooks) to examine alerts and take immediate remediation action to resolve breaches. This significantly reduces alert volume, allowing security operations experts to focus on more sophisticated threats and other high value initiatives. <br>[Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection) | Not applicable |
|
| Auto Investigation & Remediation (AIR) | Microsoft Defender ATP uses Automated investigations to significantly reduce the volume of alerts that need to be investigated individually. The Automated investigation feature leverages various inspection algorithms, and processes used by analysts (such as playbooks) to examine alerts and take immediate remediation action to resolve breaches. This significantly reduces alert volume, allowing security operations experts to focus on more sophisticated threats and other high value initiatives. <br>[Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection) | Not applicable |
|
||||||
| Microsoft Threat Experts (MTE) | Microsoft Threat Experts is a managed hunting service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don't get missed. <br>[Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts) | Not applicable |
|
| Microsoft Threat Experts (MTE) | Microsoft Threat Experts is a managed hunting service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don't get missed. <br>[Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts) | Not applicable |
|
||||||
|
|||||||
@ -145,7 +145,7 @@ Appendix section in this document for the URLs Whitelisting or on
|
|||||||
Docs](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server).
|
Docs](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server).
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> For a detailed list of URLs that need to be whitelisted, please see [this article](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus).
|
> For a detailed list of URLs that need to be whitelisted, please see [this article](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus).
|
||||||
|
|
||||||
**Manual static proxy configuration:**
|
**Manual static proxy configuration:**
|
||||||
|
|
||||||
|
|||||||
@ -62,7 +62,7 @@ You can contain an attack in your organization by stopping the malicious process
|
|||||||
>
|
>
|
||||||
> - The machine you're taking the action on is running Windows 10, version 1703 or later
|
> - The machine you're taking the action on is running Windows 10, version 1703 or later
|
||||||
> - The file does not belong to trusted third-party publishers or not signed by Microsoft
|
> - The file does not belong to trusted third-party publishers or not signed by Microsoft
|
||||||
> - Windows Defender Antivirus must at least be running on Passive mode. For more information, see [Windows Defender Antivirus compatibility](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
|
> - Windows Defender Antivirus must at least be running on Passive mode. For more information, see [Windows Defender Antivirus compatibility](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||||
|
|
||||||
The **Stop and Quarantine File** action includes stopping running processes, quarantining the files, and deleting persistent data, such as any registry keys.
|
The **Stop and Quarantine File** action includes stopping running processes, quarantining the files, and deleting persistent data, such as any registry keys.
|
||||||
|
|
||||||
@ -136,7 +136,7 @@ You can prevent further propagation of an attack in your organization by banning
|
|||||||
|
|
||||||
>[!IMPORTANT]
|
>[!IMPORTANT]
|
||||||
>
|
>
|
||||||
>- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md).
|
>- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md).
|
||||||
>
|
>
|
||||||
>- The Antimalware client version must be 4.18.1901.x or later.
|
>- The Antimalware client version must be 4.18.1901.x or later.
|
||||||
>- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time.
|
>- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time.
|
||||||
|
|||||||
@ -116,7 +116,7 @@ As part of the investigation or response process, you can remotely initiate an a
|
|||||||
|
|
||||||
>[!IMPORTANT]
|
>[!IMPORTANT]
|
||||||
>- This action is available for machines on Windows 10, version 1709 or later.
|
>- This action is available for machines on Windows 10, version 1709 or later.
|
||||||
>- A Windows Defender Antivirus (Windows Defender AV) scan can run alongside other antivirus solutions, whether Windows Defender AV is the active antivirus solution or not. Windows Defender AV can be in Passive mode. For more information, see [Windows Defender Antivirus compatibility](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
|
>- A Windows Defender Antivirus (Windows Defender AV) scan can run alongside other antivirus solutions, whether Windows Defender AV is the active antivirus solution or not. Windows Defender AV can be in Passive mode. For more information, see [Windows Defender Antivirus compatibility](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||||
|
|
||||||
One you have selected **Run antivirus scan**, select the scan type that you'd like to run (quick or full) and add a comment before confirming the scan.
|
One you have selected **Run antivirus scan**, select the scan type that you'd like to run (quick or full) and add a comment before confirming the scan.
|
||||||
|
|
||||||
|
|||||||
@ -46,9 +46,9 @@ Attack surface reduction rules will only work on devices with the following cond
|
|||||||
|
|
||||||
- Endpoints are running Windows 10 Enterprise, version 1709 (also known as the Fall Creators Update).
|
- Endpoints are running Windows 10 Enterprise, version 1709 (also known as the Fall Creators Update).
|
||||||
|
|
||||||
- Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
|
- Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||||
|
|
||||||
- [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled.
|
- [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled.
|
||||||
|
|
||||||
- Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
|
- Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
|
||||||
|
|
||||||
|
|||||||
@ -42,7 +42,7 @@ See the topic [Review events and errors using Event Viewer](event-error-codes.md
|
|||||||
|
|
||||||
If onboarding machines successfully completes but Microsoft Defender ATP does not start after a reboot and shows error 577, check that Windows Defender is not disabled by a policy.
|
If onboarding machines successfully completes but Microsoft Defender ATP does not start after a reboot and shows error 577, check that Windows Defender is not disabled by a policy.
|
||||||
|
|
||||||
For more information, see [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy).
|
For more information, see [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy).
|
||||||
|
|
||||||
## Known issues with regional formats
|
## Known issues with regional formats
|
||||||
|
|
||||||
|
|||||||
@ -43,9 +43,9 @@ Network protection will only work on devices with the following conditions:
|
|||||||
|
|
||||||
>[!div class="checklist"]
|
>[!div class="checklist"]
|
||||||
> * Endpoints are running Windows 10 Enterprise edition, version 1709 or higher (also known as the Fall Creators Update).
|
> * Endpoints are running Windows 10 Enterprise edition, version 1709 or higher (also known as the Fall Creators Update).
|
||||||
> * Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
|
> * Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||||
> * [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled.
|
> * [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled.
|
||||||
> * [Cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) is enabled.
|
> * [Cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) is enabled.
|
||||||
> * Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**).
|
> * Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**).
|
||||||
|
|
||||||
## Use audit mode
|
## Use audit mode
|
||||||
|
|||||||
@ -71,7 +71,7 @@ Event ID | Error Type | Resolution steps
|
|||||||
5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.
|
5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.
|
||||||
10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically<br> ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.<br>Verify that the script has been run as an administrator.
|
10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically<br> ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.<br>Verify that the script has been run as an administrator.
|
||||||
15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). <br> <br> If the machine is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again.
|
15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). <br> <br> If the machine is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again.
|
||||||
15 | Failed to start SENSE service | If the message of the error is: System error 577 or error 1058 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
|
15 | Failed to start SENSE service | If the message of the error is: System error 577 or error 1058 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
|
||||||
30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
|
30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
|
||||||
35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location<br>```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```.<br>The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
|
35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location<br>```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```.<br>The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
|
||||||
40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
|
40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
|
||||||
@ -131,7 +131,7 @@ If the deployment tools used does not indicate an error in the onboarding proces
|
|||||||
- [Ensure the diagnostic data service is enabled](#ensure-the-diagnostics-service-is-enabled)
|
- [Ensure the diagnostic data service is enabled](#ensure-the-diagnostics-service-is-enabled)
|
||||||
- [Ensure the service is set to start](#ensure-the-service-is-set-to-start)
|
- [Ensure the service is set to start](#ensure-the-service-is-set-to-start)
|
||||||
- [Ensure the machine has an Internet connection](#ensure-the-machine-has-an-internet-connection)
|
- [Ensure the machine has an Internet connection](#ensure-the-machine-has-an-internet-connection)
|
||||||
- [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)
|
- [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy)
|
||||||
|
|
||||||
|
|
||||||
### View agent onboarding errors in the machine event log
|
### View agent onboarding errors in the machine event log
|
||||||
|
|||||||
@ -63,7 +63,7 @@ For more information preview features, see [Preview features](https://docs.micro
|
|||||||
|
|
||||||
## September 2019
|
## September 2019
|
||||||
|
|
||||||
- [Tamper Protection settings using Intune](../windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md#turn-tamper-protection-on-or-off-for-your-organization-using-intune)<br/>You can now turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management Portal (Intune).
|
- [Tamper Protection settings using Intune](../microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md#turn-tamper-protection-on-or-off-for-your-organization-using-intune)<br/>You can now turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management Portal (Intune).
|
||||||
|
|
||||||
- [Live response](live-response.md)<BR> Get instantaneous access to a machine using a remote shell connection. Do in-depth investigative work and take immediate response actions to promptly contain identified threats - real-time.
|
- [Live response](live-response.md)<BR> Get instantaneous access to a machine using a remote shell connection. Do in-depth investigative work and take immediate response actions to promptly contain identified threats - real-time.
|
||||||
|
|
||||||
@ -127,10 +127,10 @@ Threat Analytics is a set of interactive reports published by the Microsoft Defe
|
|||||||
- Block Adobe Reader from creating child processes
|
- Block Adobe Reader from creating child processes
|
||||||
- Block Office communication application from creating child processes.
|
- Block Office communication application from creating child processes.
|
||||||
|
|
||||||
- [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)
|
- [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10)
|
||||||
- Antimalware Scan Interface (AMSI) was extended to cover Office VBA macros as well. [Office VBA + AMSI: Parting the veil on malicious macros](https://cloudblogs.microsoft.com/microsoftsecure/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/).
|
- Antimalware Scan Interface (AMSI) was extended to cover Office VBA macros as well. [Office VBA + AMSI: Parting the veil on malicious macros](https://cloudblogs.microsoft.com/microsoftsecure/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/).
|
||||||
- Windows Defender Antivirus, new in Windows 10 version 1809, can now [run within a sandbox](https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/windows-defender-antivirus-can-now-run-in-a-sandbox/) (preview), increasing its security.
|
- Windows Defender Antivirus, new in Windows 10 version 1809, can now [run within a sandbox](https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/microsoft-defender-antivirus-can-now-run-in-a-sandbox/) (preview), increasing its security.
|
||||||
- [Configure CPU priority settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus) for Windows Defender Antivirus scans.
|
- [Configure CPU priority settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus) for Windows Defender Antivirus scans.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -166,9 +166,9 @@ You can now block untrusted processes from writing to disk sectors using Control
|
|||||||
Using role-based access control (RBAC), you can create roles and groups within your security operations team to grant appropriate access to the portal.
|
Using role-based access control (RBAC), you can create roles and groups within your security operations team to grant appropriate access to the portal.
|
||||||
|
|
||||||
|
|
||||||
- [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)<BR>
|
- [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10)<BR>
|
||||||
Windows Defender Antivirus now shares detection status between M365 services and interoperates with Microsoft Defender ATP. For more information, see [Use next-gen technologies in Windows Defender Antivirus through cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus).
|
Windows Defender Antivirus now shares detection status between M365 services and interoperates with Microsoft Defender ATP. For more information, see [Use next-gen technologies in Windows Defender Antivirus through cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus).
|
||||||
|
|
||||||
Block at first sight can now block non-portable executable files (such as JS, VBS, or macros) as well as executable files. For more information, see [Enable block at first sight](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus).
|
Block at first sight can now block non-portable executable files (such as JS, VBS, or macros) as well as executable files. For more information, see [Enable block at first sight](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus).
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -51,7 +51,7 @@ Microsoft Defender SmartScreen provide an early warning system against websites
|
|||||||
|
|
||||||
- **Management through Group Policy and Microsoft Intune.** Microsoft Defender SmartScreen supports using both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](microsoft-defender-smartscreen-available-settings.md).
|
- **Management through Group Policy and Microsoft Intune.** Microsoft Defender SmartScreen supports using both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](microsoft-defender-smartscreen-available-settings.md).
|
||||||
|
|
||||||
- **Blocking URLs associated with potentially unwanted applications.** In Microsoft Edge (based on Chromium), SmartScreen blocks URLs associated with potentially unwanted applications, or PUAs. For more information on blocking URLs associated with PUAs, see [Detect and block potentially unwanted applications](../windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md).
|
- **Blocking URLs associated with potentially unwanted applications.** In Microsoft Edge (based on Chromium), SmartScreen blocks URLs associated with potentially unwanted applications, or PUAs. For more information on blocking URLs associated with PUAs, see [Detect and block potentially unwanted applications](../microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md).
|
||||||
|
|
||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
> SmartScreen protects against malicious files from the internet. It does not protect against malicious files on internal locations or network shares, such as shared folders with UNC paths or SMB/CIFS shares.
|
> SmartScreen protects against malicious files from the internet. It does not protect against malicious files on internal locations or network shares, such as shared folders with UNC paths or SMB/CIFS shares.
|
||||||
|
|||||||
@ -65,8 +65,8 @@ The following table summarizes exclusion types, how they're defined, and what ha
|
|||||||
|**Process** |Executable file path <br>Example: `c:\test\process.exe` |The specified process and any files that are opened by that process are skipped by Windows Defender Antivirus. |
|
|**Process** |Executable file path <br>Example: `c:\test\process.exe` |The specified process and any files that are opened by that process are skipped by Windows Defender Antivirus. |
|
||||||
|
|
||||||
To learn more, see:
|
To learn more, see:
|
||||||
- [Configure and validate exclusions based on file extension and folder location](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus)
|
- [Configure and validate exclusions based on file extension and folder location](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus)
|
||||||
- [Configure exclusions for files opened by processes](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus)
|
- [Configure exclusions for files opened by processes](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus)
|
||||||
|
|
||||||
## Related articles
|
## Related articles
|
||||||
|
|
||||||
|
|||||||
@ -58,5 +58,5 @@ MpCmdRun.exe -scan -2
|
|||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md)
|
- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md)
|
||||||
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
|
- [Windows Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)
|
||||||
|
|||||||
@ -38,8 +38,8 @@ The articles in this section provide further information, links, and resources f
|
|||||||
|
|
||||||
Article | Description
|
Article | Description
|
||||||
---|---
|
---|---
|
||||||
[Manage Windows Defender Antivirus with Microsoft Intune and Microsoft Endpoint Configuration Manager](use-intune-config-manager-windows-defender-antivirus.md)|Information about using Intune and Configuration Manager to deploy, manage, report, and configure Windows Defender Antivirus
|
[Manage Windows Defender Antivirus with Microsoft Intune and Microsoft Endpoint Configuration Manager](use-intune-config-manager-microsoft-defender-antivirus.md)|Information about using Intune and Configuration Manager to deploy, manage, report, and configure Windows Defender Antivirus
|
||||||
[Manage Windows Defender Antivirus with Group Policy settings](use-group-policy-windows-defender-antivirus.md)|List of all Group Policy settings located in ADMX templates
|
[Manage Windows Defender Antivirus with Group Policy settings](use-group-policy-microsoft-defender-antivirus.md)|List of all Group Policy settings located in ADMX templates
|
||||||
[Manage Windows Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-windows-defender-antivirus.md)|Instructions for using PowerShell cmdlets to manage Windows Defender Antivirus, plus links to documentation for all cmdlets and allowed parameters
|
[Manage Windows Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-microsoft-defender-antivirus.md)|Instructions for using PowerShell cmdlets to manage Windows Defender Antivirus, plus links to documentation for all cmdlets and allowed parameters
|
||||||
[Manage Windows Defender Antivirus with Windows Management Instrumentation (WMI)](use-wmi-windows-defender-antivirus.md)| Instructions for using WMI to manage Windows Defender Antivirus, plus links to documentation for the WMIv2 APIs (including all classes, methods, and properties)
|
[Manage Windows Defender Antivirus with Windows Management Instrumentation (WMI)](use-wmi-microsoft-defender-antivirus.md)| Instructions for using WMI to manage Windows Defender Antivirus, plus links to documentation for the WMIv2 APIs (including all classes, methods, and properties)
|
||||||
[Manage Windows Defender Antivirus with the mpcmdrun.exe command-line tool](command-line-arguments-windows-defender-antivirus.md)|Instructions on using the dedicated command-line tool to manage and use Windows Defender Antivirus
|
[Manage Windows Defender Antivirus with the mpcmdrun.exe command-line tool](command-line-arguments-microsoft-defender-antivirus.md)|Instructions on using the dedicated command-line tool to manage and use Windows Defender Antivirus
|
||||||
|
|||||||
@ -25,7 +25,7 @@ manager: dansimp
|
|||||||
|
|
||||||
**Use Microsoft Intune to configure scanning options**
|
**Use Microsoft Intune to configure scanning options**
|
||||||
|
|
||||||
See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details.
|
See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#microsoft-defender-antivirus) for more details.
|
||||||
|
|
||||||
<a id="ref1"></a>
|
<a id="ref1"></a>
|
||||||
|
|
||||||
@ -50,7 +50,7 @@ Description | Location and setting | Default setting (if not configured) | Power
|
|||||||
Email scanning See [Email scanning limitations](#ref1)| Scan > Turn on e-mail scanning | Disabled | `-DisableEmailScanning`
|
Email scanning See [Email scanning limitations](#ref1)| Scan > Turn on e-mail scanning | Disabled | `-DisableEmailScanning`
|
||||||
Scan [reparse points](https://msdn.microsoft.com/library/windows/desktop/aa365503.aspx) | Scan > Turn on reparse point scanning | Disabled | Not available
|
Scan [reparse points](https://msdn.microsoft.com/library/windows/desktop/aa365503.aspx) | Scan > Turn on reparse point scanning | Disabled | Not available
|
||||||
Scan mapped network drives | Scan > Run full scan on mapped network drives | Disabled | `-DisableScanningMappedNetworkDrivesForFullScan`
|
Scan mapped network drives | Scan > Run full scan on mapped network drives | Disabled | `-DisableScanningMappedNetworkDrivesForFullScan`
|
||||||
Scan archive files (such as .zip or .rar files). The [extensions exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md) will take precedence over this setting. | Scan > Scan archive files | Enabled | `-DisableArchiveScanning`
|
Scan archive files (such as .zip or .rar files). The [extensions exclusion list](configure-extension-file-exclusions-microsoft-defender-antivirus.md) will take precedence over this setting. | Scan > Scan archive files | Enabled | `-DisableArchiveScanning`
|
||||||
Scan files on the network | Scan > Scan network files | Disabled | `-DisableScanningNetworkFiles`
|
Scan files on the network | Scan > Scan network files | Disabled | `-DisableScanningNetworkFiles`
|
||||||
Scan packed executables | Scan > Scan packed executables | Enabled | Not available
|
Scan packed executables | Scan > Scan packed executables | Enabled | Not available
|
||||||
Scan removable drives during full scans only | Scan > Scan removable drives | Disabled | `-DisableRemovableDriveScanning`
|
Scan removable drives during full scans only | Scan > Scan removable drives | Disabled | `-DisableRemovableDriveScanning`
|
||||||
@ -64,7 +64,7 @@ Specify the level of subfolders within an archive folder to scan | Scan > Specif
|
|||||||
|
|
||||||
## Use PowerShell to configure scanning options
|
## Use PowerShell to configure scanning options
|
||||||
|
|
||||||
See [Manage Windows Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
|
See [Manage Windows Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
|
||||||
|
|
||||||
## Use WMI to configure scanning options
|
## Use WMI to configure scanning options
|
||||||
|
|
||||||
@ -87,7 +87,7 @@ If Windows Defender Antivirus detects a threat inside an email, it will show you
|
|||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
|
- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md)
|
||||||
- [Configure and run on-demand Windows Defender Antivirus scans](run-scan-windows-defender-antivirus.md)
|
- [Configure and run on-demand Windows Defender Antivirus scans](run-scan-microsoft-defender-antivirus.md)
|
||||||
- [Configure scheduled Windows Defender Antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md)
|
- [Configure scheduled Windows Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md)
|
||||||
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
|
- [Windows Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user