mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-26 15:53:40 +00:00
Merge branch 'master' into tmv-secure-score-for-devices
This commit is contained in:
Beth Levin
Binary file not shown.
|
Before Width: | Height: | Size: 21 KiB After Width: | Height: | Size: 33 KiB |
@ -14,7 +14,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date:
|
||||
---
|
||||
|
||||
# Monitor the use of removable storage devices
|
||||
@ -28,7 +28,10 @@ If you configure this policy setting, an audit event is generated each time a us
|
||||
|
||||
Use the following procedures to monitor the use of removable storage devices and to verify that the devices are being monitored.
|
||||
|
||||
>**Note:** Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
|
||||
Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
|
||||
|
||||
> [!NOTE]
|
||||
> When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor.
|
||||
|
||||
**To configure settings to monitor removable storage devices**
|
||||
|
||||
@ -46,7 +49,8 @@ After you configure the settings to monitor removable storage devices, use the f
|
||||
|
||||
1. Sign in to the computer that hosts the resources that you want to monitor. Press the Windows key + R, and then type **cmd** to open a Command Prompt window.
|
||||
|
||||
>**Note:** If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
|
||||
> [!NOTE]
|
||||
> If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
|
||||
|
||||
2. Type **gpupdate /force**, and press ENTER.
|
||||
3. Connect a removable storage device to the targeted computer and attempt to copy a file that is protected with the Removable Storage Audit policy.
|
||||
@ -56,7 +60,8 @@ After you configure the settings to monitor removable storage devices, use the f
|
||||
|
||||
Key information to look for includes the name and account domain of the user who attempted to access the file, the object that the user is attempting to access, resource attributes of the resource, and the type of access that was attempted.
|
||||
|
||||
>**Note:** We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event.
|
||||
> [!NOTE]
|
||||
> We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event.
|
||||
|
||||
### Related resource
|
||||
|
||||
|
||||
@ -77,11 +77,11 @@ The attack surface reduction set of capabilities provide the first line of defen
|
||||
**[Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)**<br>
|
||||
To further reinforce the security perimeter of your network, Microsoft Defender ATP uses next generation protection designed to catch all types of emerging threats.
|
||||
|
||||
- [Behavior monitoring](/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md)
|
||||
- [Cloud-based protection](/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md)
|
||||
- [Machine learning](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md)
|
||||
- [Behavior monitoring](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus)
|
||||
- [Cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus)
|
||||
- [Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus)
|
||||
- [URL Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus)
|
||||
- [Automated sandbox service](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md)
|
||||
- [Automated sandbox service](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus)
|
||||
|
||||
<a name="edr"></a>
|
||||
|
||||
|
||||
@ -70,8 +70,9 @@ You'll start receiving targeted attack notification from Microsoft Threat Expert
|
||||
## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization
|
||||
You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard.
|
||||
|
||||
>[!NOTE]
|
||||
>Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details.
|
||||
> [!NOTE]
|
||||
> - Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details.
|
||||
> - You will need to have the "Manage security settings" permission in the Security Center portal to be able to submit a "Consult a threat expert" inquiry.
|
||||
|
||||
1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or machine is in view before you send an investigation request.
|
||||
|
||||
@ -130,4 +131,3 @@ It is crucial to respond in a timely manner to keep the investigation moving.
|
||||
|
||||
## Related topic
|
||||
- [Microsoft Threat Experts overview](microsoft-threat-experts.md)
|
||||
|
||||
|
||||
@ -46,15 +46,18 @@ Microsoft does not use your data for advertising.
|
||||
## Data protection and encryption
|
||||
The Microsoft Defender ATP service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure.
|
||||
|
||||
|
||||
There are various aspects relevant to data protection that our service takes care of. Encryption is one of the most critical and it includes data encryption at rest, encryption in flight, and key management with Key Vault. For more information on other technologies used by the Microsoft Defender ATP service, see [Azure encryption overview](https://docs.microsoft.com/azure/security/security-azure-encryption-overview).
|
||||
|
||||
In all scenarios, data is encrypted using 256-bit [AES encryption](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) at the minimum.
|
||||
|
||||
|
||||
## Do I have the flexibility to select where to store my data?
|
||||
## Data storage location
|
||||
|
||||
When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States, or dedicated Azure Government data centers (soon to be in preview). Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in pseudonymized form may also be stored in the central storage and processing systems in the United States.
|
||||
Microsoft Defender ATP operates in the Microsoft Azure datacenters in the European Union, the United Kingdom, or in the United States. Customer data collected by the service may be stored in: (a) the geo-location of the tenant as identified during provisioning or, (b) if Microsoft Defender ATP uses another Microsoft online service to process such data, the geolocation as defined by the data storage rules of that other online service.
|
||||
|
||||
Customer data in pseudonymized form may also be stored in the central storage and processing systems in the United States.
|
||||
|
||||
Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside.
|
||||
|
||||
## Is my data isolated from other customer data?
|
||||
Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides.
|
||||
@ -84,12 +87,10 @@ Your data will be kept and will be available to you while the license is under g
|
||||
|
||||
|
||||
## Can Microsoft help us maintain regulatory compliance?
|
||||
Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Microsoft Defender ATP services against their own legal and regulatory requirements. Microsoft Defender ATP is ISO 27001 certified and has a roadmap for obtaining national, regional and industry-specific certifications.
|
||||
|
||||
Microsoft Defender ATP for Government (soon to be in preview) is currently undergoing audit for achieving FedRAMP High accreditation as well as Provisional Authorization (PA) at Impact Levels 4 and 5.
|
||||
Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Microsoft Defender ATP services against their own legal and regulatory requirements. Microsoft Defender ATP has achieved a number of certifications including ISO, SOC, FedRAMP High, and PCI and continues to pursue additional national, regional and industry-specific certifications.
|
||||
|
||||
By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run.
|
||||
|
||||
For more information on the Microsoft Defender ATP ISO certification reports, see [Microsoft Trust Center](https://www.microsoft.com/trustcenter/compliance/iso-iec-27001).
|
||||
For more information on the Microsoft Defender ATP certification reports, see [Microsoft Trust Center](https://servicetrust.microsoft.com/).
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-datastorage-belowfoldlink)
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 53 KiB After Width: | Height: | Size: 46 KiB |
@ -204,19 +204,19 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
4. From a command prompt, verify that you have the file.
|
||||
Extract the contents of the archive:
|
||||
|
||||
```bash
|
||||
ls -l
|
||||
```
|
||||
```bash
|
||||
ls -l
|
||||
```
|
||||
|
||||
`total 8`
|
||||
`-rw-r--r-- 1 test staff 5752 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip`
|
||||
`total 8`
|
||||
`-rw-r--r-- 1 test staff 5752 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip`
|
||||
|
||||
```bash
|
||||
unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
```
|
||||
```bash
|
||||
unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
```
|
||||
|
||||
`Archive: WindowsDefenderATPOnboardingPackage.zip`
|
||||
`inflating: WindowsDefenderATPOnboarding.py`
|
||||
`Archive: WindowsDefenderATPOnboardingPackage.zip`
|
||||
`inflating: WindowsDefenderATPOnboarding.py`
|
||||
|
||||
## Client configuration
|
||||
|
||||
@ -231,7 +231,7 @@ unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
2. Run WindowsDefenderATPOnboarding.py, and note that, in order to run this command, you must have `python` installed on the device:
|
||||
|
||||
```bash
|
||||
python WindowsDefenderATPOnboarding.py
|
||||
sudo python WindowsDefenderATPOnboarding.py
|
||||
```
|
||||
|
||||
3. Verify that the machine is now associated with your organization and reports a valid organization identifier:
|
||||
@ -247,27 +247,28 @@ unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When the product starts for the first time, it downloads the latest antimalware definitions. Depending on your Internet connection, this can take up to a few minutes. During this time the above command returns a value of `0`.
|
||||
> When the product starts for the first time, it downloads the latest antimalware definitions. Depending on your Internet connection, this can take up to a few minutes. During this time the above command returns a value of `0`.<br>
|
||||
> Please note that you may also need to configure a proxy after completing the initial installation. See [Configure Microsoft Defender ATP for Linux for static proxy discovery: Post-installation configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration#post-installation-configuration).
|
||||
|
||||
5. Run a detection test to verify that the machine is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded machine:
|
||||
|
||||
- Ensure that real-time protection is enabled (denoted by a result of `1` from running the following command):
|
||||
|
||||
```bash
|
||||
mdatp --health realTimeProtectionEnabled
|
||||
```
|
||||
```bash
|
||||
mdatp --health realTimeProtectionEnabled
|
||||
```
|
||||
|
||||
- Open a Terminal window. Copy and execute the following command:
|
||||
|
||||
``` bash
|
||||
curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt
|
||||
```
|
||||
``` bash
|
||||
curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt
|
||||
```
|
||||
|
||||
- The file should have been quarantined by Microsoft Defender ATP for Linux. Use the following command to list all the detected threats:
|
||||
|
||||
```bash
|
||||
mdatp --threat --list --pretty
|
||||
```
|
||||
```bash
|
||||
mdatp --threat --list --pretty
|
||||
```
|
||||
|
||||
## Log installation issues
|
||||
|
||||
|
||||
@ -23,24 +23,24 @@ ms.topic: article
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
Live response is a capability that gives your security operations team instantaneous access to a device (also referred to as a machine) using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats –- in real time.
|
||||
Live response is a capability that gives your security operations team instantaneous access to a device (also referred to as a machine) using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats — in real time.
|
||||
|
||||
Live response is designed to enhance investigations by enabling your security operations team to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4qLUW]
|
||||
|
||||
With live response, analysts can do all of the following tasks:
|
||||
- Run basic and advanced commands to do investigative work on a device
|
||||
- Download files such as malware samples and outcomes of PowerShell scripts
|
||||
- Download files in the background (new!)
|
||||
- Upload a PowerShell script or executable to the library and run it on a device from a tenant level
|
||||
- Take or undo remediation actions
|
||||
- Run basic and advanced commands to do investigative work on a device.
|
||||
- Download files such as malware samples and outcomes of PowerShell scripts.
|
||||
- Download files in the background (new!).
|
||||
- Upload a PowerShell script or executable to the library and run it on a device from a tenant level.
|
||||
- Take or undo remediation actions.
|
||||
|
||||
## Before you begin
|
||||
|
||||
Before you can initiate a session on a device, make sure you fulfill the following requirements:
|
||||
|
||||
- **Verify that you're running a supported version of Windows 10** <br/>
|
||||
- **Verify that you're running a supported version of Windows 10**. <br/>
|
||||
Devices must be running one of the following versions of Windows 10:
|
||||
- [1909](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1909) or later
|
||||
- [1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903)
|
||||
@ -48,29 +48,29 @@ Devices must be running one of the following versions of Windows 10:
|
||||
- [1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
|
||||
- **Make sure to install appropriate security updates**<br/>
|
||||
- **Make sure to install appropriate security updates**.<br/>
|
||||
- 1903: [KB4515384](https://support.microsoft.com/help/4515384/windows-10-update-kb4515384)
|
||||
- 1809 (RS5): [KB4537818](https://support.microsoft.com/help/4537818/windows-10-update-kb4537818)
|
||||
- 1803 (RS4): [KB4537795](https://support.microsoft.com/help/4537795/windows-10-update-kb4537795)
|
||||
- 1709 (RS3): [KB4537816](https://support.microsoft.com/help/4537816/windows-10-update-kb4537816)
|
||||
|
||||
- **Enable live response from the settings page**<br>
|
||||
- **Enable live response from the settings page**.<br>
|
||||
You'll need to enable the live response capability in the [Advanced features settings](advanced-features.md) page.
|
||||
|
||||
>[!NOTE]
|
||||
>Only users with manage security or global admin roles can edit these settings.
|
||||
|
||||
- **Ensure that the machine has an Automation Remediation level assigned to it**<br>
|
||||
You'll need to enable, at least, the minimum Remdiation Level for a given Machine Group. Otherwise you won't be able to establish a Live Response session to a member of that group.
|
||||
- **Ensure that the machine has an Automation Remediation level assigned to it**.<br>
|
||||
You'll need to enable, at least, the minimum Remediation Level for a given Machine Group. Otherwise you won't be able to establish a Live Response session to a member of that group.
|
||||
|
||||
- **Enable live response unsigned script execution** (optional) <br>
|
||||
- **Enable live response unsigned script execution** (optional). <br>
|
||||
|
||||
>[!WARNING]
|
||||
>Allowing the use of unsigned scripts may increase your exposure to threats.
|
||||
|
||||
Running unsigned scripts is not recommended as it can increase your exposure to threats. If you must use them however, you'll need to enable the setting in the [Advanced features settings](advanced-features.md) page.
|
||||
|
||||
- **Ensure that you have the appropriate permissions**<br>
|
||||
- **Ensure that you have the appropriate permissions**.<br>
|
||||
Only users who have been provisioned with the appropriate permissions can initiate a session. For more information on role assignments, see [Create and manage roles](user-roles.md).
|
||||
|
||||
> [!IMPORTANT]
|
||||
@ -133,7 +133,7 @@ drivers | Shows all drivers installed on the device. |
|
||||
|`trace` | Sets the terminal's logging mode to debug. |
|
||||
|
||||
### Advanced commands
|
||||
The following commands are available for user roles that are granted the ability to run **advanced** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md).
|
||||
The following commands are available for user roles that are granted the ability to run **advanced** live response commands. For more information on role assignments see [Create and manage roles](user-roles.md).
|
||||
|
||||
| Command | Description |
|
||||
|---|---|
|
||||
@ -157,15 +157,18 @@ The advanced commands offer a more robust set of actions that allow you to take
|
||||
For scenarios when you'd like get a file from a device you're investigating, you can use the `getfile` command. This allows you to save the file from the device for further investigation.
|
||||
|
||||
>[!NOTE]
|
||||
>There is a file size limit of 750mb.
|
||||
>The following file size limits apply:
|
||||
>- `getfile` limit: 3 GB
|
||||
>- `fileinfo` limit: 10 GB
|
||||
>- `library` limit: 250 MB
|
||||
|
||||
### Download a file in the background
|
||||
|
||||
To enable your security operations team to continue investigating an impacted device, files can now be downloaded in the background.
|
||||
|
||||
- To download a file in the background, in the live response command console, type `download <file_path> &`
|
||||
- To download a file in the background, in the live response command console, type `download <file_path> &`.
|
||||
- If you are waiting for a file to be downloaded, you can move it to the background by using Ctrl + Z.
|
||||
- To bring a file download to the foreground, in the live response command console, type `fg <command_id>`
|
||||
- To bring a file download to the foreground, in the live response command console, type `fg <command_id>`.
|
||||
|
||||
Here are some examples:
|
||||
|
||||
@ -173,7 +176,7 @@ Here are some examples:
|
||||
|Command |What it does |
|
||||
|---------|---------|
|
||||
|`"C:\windows\some_file.exe" &` |Starts downloading a file named *some_file.exe* in the background. |
|
||||
|`fg 1234` |Returns a download with command ID *1234* to the foreground |
|
||||
|`fg 1234` |Returns a download with command ID *1234* to the foreground. |
|
||||
|
||||
|
||||
### Put a file in the library
|
||||
@ -277,11 +280,14 @@ Each command is tracked with full details such as:
|
||||
|
||||
## Limitations
|
||||
|
||||
- Live response sessions are limited to 10 live response sessions at a time
|
||||
- Large scale command execution is not supported
|
||||
- A user can only initiate one session at a time
|
||||
- A device can only be in one session at a time
|
||||
- There is a file size limit of 750mb when downloading files from a device
|
||||
- Live response sessions are limited to 10 live response sessions at a time.
|
||||
- Large scale command execution is not supported.
|
||||
- A user can only initiate one session at a time.
|
||||
- A device can only be in one session at a time.
|
||||
- The following file size limits apply:
|
||||
- `getfile` limit: 3 GB
|
||||
- `fileinfo` limit: 10 GB
|
||||
- `library` limit: 250 MB
|
||||
|
||||
## Related article
|
||||
- [Live response command examples](live-response-command-examples.md)
|
||||
|
||||
@ -97,7 +97,7 @@ The package contains the following folders:
|
||||
|:---|:---------|
|
||||
|Autoruns | Contains a set of files that each represent the content of the registry of a known auto start entry point (ASEP) to help identify attacker’s persistency on the machine. </br></br> NOTE: If the registry key is not found, the file will contain the following message: “ERROR: The system was unable to find the specified registry key or value.” |
|
||||
|Installed programs | This .CSV file contains the list of installed programs that can help identify what is currently installed on the machine. For more information, see [Win32_Product class](https://go.microsoft.com/fwlink/?linkid=841509). |
|
||||
|Network connections | This folder contains a set of data points related to the connectivity information which can help in identifying connectivity to suspicious URLs, attacker’s command and control (C&C) infrastructure, any lateral movement, or remote connections.</br></br> - ActiveNetConnections.txt – Displays protocol statistics and current TCP/IP network connections. Provides the ability to look for suspicious connectivity made by a process. </br></br> - Arp.txt – Displays the current address resolution protocol (ARP) cache tables for all interfaces. </br></br> ARP cache can reveal additional hosts on a network that have been compromised or suspicious systems on the network that night have been used to run an internal attack.</br></br> - DnsCache.txt - Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. This can help in identifying suspicious connections. </br></br> - IpConfig.txt – Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections. </br></br> - FirewassExecutionLog.txt and pfirewall.log |
|
||||
|Network connections | This folder contains a set of data points related to the connectivity information which can help in identifying connectivity to suspicious URLs, attacker’s command and control (C&C) infrastructure, any lateral movement, or remote connections.</br></br> - ActiveNetConnections.txt – Displays protocol statistics and current TCP/IP network connections. Provides the ability to look for suspicious connectivity made by a process. </br></br> - Arp.txt – Displays the current address resolution protocol (ARP) cache tables for all interfaces. </br></br> ARP cache can reveal additional hosts on a network that have been compromised or suspicious systems on the network that night have been used to run an internal attack.</br></br> - DnsCache.txt - Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. This can help in identifying suspicious connections. </br></br> - IpConfig.txt – Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections. </br></br> - FirewallExecutionLog.txt and pfirewall.log |
|
||||
| Prefetch files| Windows Prefetch files are designed to speed up the application startup process. It can be used to track all the files recently used in the system and find traces for applications that might have been deleted but can still be found in the prefetch file list. </br></br> - Prefetch folder – Contains a copy of the prefetch files from `%SystemRoot%\Prefetch`. NOTE: It is suggested to download a prefetch file viewer to view the prefetch files. </br></br> - PrefetchFilesList.txt – Contains the list of all the copied files which can be used to track if there were any copy failures to the prefetch folder. |
|
||||
| Processes| Contains a .CSV file listing the running processes which provides the ability to identify current processes running on the machine. This can be useful when identifying a suspicious process and its state. |
|
||||
| Scheduled tasks| Contains a .CSV file listing the scheduled tasks which can be used to identify routines performed automatically on a chosen machine to look for suspicious code which was set to run automatically. |
|
||||
|
||||
@ -42,7 +42,7 @@ MpCmdRun.exe -scan -2
|
||||
| Command | Description |
|
||||
|:----|:----|
|
||||
| `-?` **or** `-h` | Displays all available options for this tool |
|
||||
| `-Scan [-ScanType [0\|1\|2\|3]] [-File <path> [-DisableRemediation] [-BootSectorScan] [-CpuThrottling]] [-Timeout <days>] [-Cancel]` | Scans for malicious software. Values for **ScanType** are: **0** Default, according to your configuration, **-1** Quick scan, **-2** Full scan, **-3** File and directory custom scan. |
|
||||
| `-Scan [-ScanType [0\|1\|2\|3]] [-File <path> [-DisableRemediation] [-BootSectorScan] [-CpuThrottling]] [-Timeout <days>] [-Cancel]` | Scans for malicious software. Values for **ScanType** are: **0** Default, according to your configuration, **-1** Quick scan, **-2** Full scan, **-3** File and directory custom scan. CpuThrottling will honor the configured CPU throttling from policy |
|
||||
| `-Trace [-Grouping #] [-Level #]` | Starts diagnostic tracing |
|
||||
| `-GetFiles` | Collects support information |
|
||||
| `-GetFilesDiagTrack` | Same as `-GetFiles`, but outputs to temporary DiagTrack folder |
|
||||
|
||||
@ -47,7 +47,7 @@ To configure the Group Policy settings described in the following table:
|
||||
|
||||
Description | Location and setting | Default setting (if not configured) | PowerShell `Set-MpPreference` parameter or WMI property for `MSFT_MpPreference` class
|
||||
---|---|---|---
|
||||
See [Email scanning limitations](#ref1)) below | Scan > Turn on e-mail scanning | Disabled | `-DisableEmailScanning`
|
||||
Email scanning See [Email scanning limitations](#ref1)| Scan > Turn on e-mail scanning | Disabled | `-DisableEmailScanning`
|
||||
Scan [reparse points](https://msdn.microsoft.com/library/windows/desktop/aa365503.aspx) | Scan > Turn on reparse point scanning | Disabled | Not available
|
||||
Scan mapped network drives | Scan > Run full scan on mapped network drives | Disabled | `-DisableScanningMappedNetworkDrivesForFullScan`
|
||||
Scan archive files (such as .zip or .rar files). The [extensions exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md) will take precedence over this setting. | Scan > Scan archive files | Enabled | `-DisableArchiveScanning`
|
||||
@ -72,29 +72,19 @@ For using WMI classes, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.
|
||||
|
||||
## Email scanning limitations
|
||||
|
||||
We recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware.
|
||||
|
||||
Always-on protection scans emails as they arrive and as they are manipulated, just like normal files in the operating system. This provides the strongest form of protection and is the recommended setting for scanning emails.
|
||||
|
||||
You can also use this Group Policy to enable scanning of older email files used by Outlook 2003 and older during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated:
|
||||
Email scanning enables scanning of email files used by Outlook and other mail clients during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated:
|
||||
|
||||
- DBX
|
||||
- MBX
|
||||
- MIME
|
||||
|
||||
PST files used by Outlook 2003 or older (where the archive type is set to non-unicode) can also be scanned, but Windows Defender cannot remediate threats detected inside PST files. This is another reason why we recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware.
|
||||
PST files used by Outlook 2003 or older (where the archive type is set to non-unicode) will also be scanned, but Windows Defender cannot remediate threats detected inside PST files.
|
||||
|
||||
If Windows Defender Antivirus detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat:
|
||||
If Windows Defender Antivirus detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat manually:
|
||||
|
||||
- Email subject
|
||||
- Attachment name
|
||||
|
||||
>[!WARNING]
|
||||
>There are some risks associated with scanning some Microsoft Outlook files and email messages. You can read about tips and risks associated with scanning Outlook files and email messages in the following articles:
|
||||
>
|
||||
> - [Scanning Outlook files in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-1)
|
||||
> - [Scanning email messages in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-2)
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
|
||||
|
||||
@ -22,8 +22,8 @@ ms.custom: nextgen
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>[!NOTE]
|
||||
>The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates.
|
||||
> [!NOTE]
|
||||
> The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates.
|
||||
|
||||
Windows Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/).
|
||||
|
||||
@ -34,88 +34,92 @@ See [Use Microsoft cloud-delivered protection](utilize-microsoft-cloud-protectio
|
||||
|
||||
There are specific network-connectivity requirements to ensure your endpoints can connect to the cloud-delivered protection service. See [Configure and validate network connections](configure-network-connections-windows-defender-antivirus.md) for more details.
|
||||
|
||||
>[!NOTE]
|
||||
>In Windows 10, there is no difference between the **Basic** and **Advanced** options described in this topic. This is a legacy distinction and choosing either setting will result in the same level of cloud-delivered protection. There is no difference in the type or amount of information that is shared. See the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=521839) for more information on what we collect.
|
||||
> [!NOTE]
|
||||
> In Windows 10, there is no difference between the **Basic** and **Advanced** reporting options described in this topic. This is a legacy distinction and choosing either setting will result in the same level of cloud-delivered protection. There is no difference in the type or amount of information that is shared. See the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=521839) for more information on what we collect.
|
||||
|
||||
**Use Intune to enable cloud-delivered protection**
|
||||
## Use Intune to enable cloud-delivered protection
|
||||
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com).
|
||||
2. Select **All services > Intune**.
|
||||
3. In the **Intune** pane, select **Device configuration > Profiles**, and then select the **Device restrictions** profile type you want to configure. If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure).
|
||||
4. Select **Properties**, select **Settings: Configure**, and then select **Windows Defender Antivirus**.
|
||||
5. On the **Cloud-delivered protection** switch, select **Enable**.
|
||||
6. In the **Prompt users before sample submission** dropdown, select **Send all data without prompting**.
|
||||
6. In the **Prompt users before sample submission** dropdown, select **Send all data without prompting**.
|
||||
7. In the **Submit samples consent** dropdown, select one of the following:
|
||||
|
||||
- **Send safe samples automatically**
|
||||
- **Send all samples automatically**
|
||||
|
||||
>[!NOTE]
|
||||
>**Send safe samples automatically** option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation.
|
||||
> The **Send safe samples automatically** option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation.
|
||||
|
||||
> [!WARNING]
|
||||
> Setting to **Always Prompt** will lower the protection state of the device. Setting to **Never send** means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function.
|
||||
> Setting to **Always Prompt** will lower the protection state of the device. Setting to **Never send** means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature of Microsoft Defender ATP won't work.
|
||||
|
||||
8. Click **OK** to exit the **Windows Defender Antivirus** settings pane, click **OK** to exit the **Device restrictions** pane, and then click **Save** to save the changes to your **Device restrictions** profile.
|
||||
|
||||
For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/intune/device-profiles)
|
||||
|
||||
**Use Configuration Manager to enable cloud-delivered protection:**
|
||||
## Use Configuration Manager to enable cloud-delivered protection
|
||||
|
||||
See [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) for details on configuring Microsoft Endpoint Configuration Manager (current branch).
|
||||
|
||||
**Use Group Policy to enable cloud-delivered protection:**
|
||||
## Use Group Policy to enable cloud-delivered protection
|
||||
|
||||
1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration**.
|
||||
|
||||
3. Click **Administrative templates**.
|
||||
3. Select **Administrative templates**.
|
||||
|
||||
4. Expand the tree to **Windows components > Windows Defender Antivirus > MAPS**
|
||||
|
||||
5. Double-click **Join Microsoft MAPS** and ensure the option is enabled and set to **Basic MAPS** or **Advanced MAPS**. Click **OK**.
|
||||
5. Double-click **Join Microsoft MAPS**. Ensure the option is enabled and set to **Basic MAPS** or **Advanced MAPS**. Select **OK**.
|
||||
|
||||
6. Double-click **Send file samples when further analysis is required** and ensure the option is set to **Enabled** and the additional options are either of the following:
|
||||
6. Double-click **Send file samples when further analysis is required**. Ensure that the option is set to **Enabled** and that the other options are either of the following:
|
||||
|
||||
1. **Send safe samples** (1)
|
||||
2. **Send all samples** (3)
|
||||
|
||||
>[!NOTE]
|
||||
>**Send safe samples automatically** option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation.
|
||||
> The **Send safe samples** (1) option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation.
|
||||
|
||||
> [!WARNING]
|
||||
> Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function.
|
||||
> Setting the option to **Always Prompt** (0) will lower the protection state of the device. Setting it to **Never send** (2) means that the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature of Microsoft Defender ATP won't work.
|
||||
|
||||
7. Click **OK**.
|
||||
|
||||
**Use PowerShell cmdlets to enable cloud-delivered protection:**
|
||||
## Use PowerShell cmdlets to enable cloud-delivered protection
|
||||
|
||||
Use the following cmdlets to enable cloud-delivered protection:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -MAPSReporting Advanced
|
||||
Set-MpPreference -SubmitSamplesConsent AlwaysPrompt
|
||||
Set-MpPreference -SubmitSamplesConsent SendAllSamples
|
||||
```
|
||||
|
||||
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. [Policy CSP - Defender](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) also has more information specifically on [-SubmitSamplesConsent](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent).
|
||||
|
||||
>[!NOTE]
|
||||
>You can also set -SubmitSamplesConsent to `None`. Setting it to `Never` will lower the protection state of the device, and setting it to 2 means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function.
|
||||
> You can also set **-SubmitSamplesConsent** to `SendSafeSamples` (the default setting), `NeverSend`, or `AlwaysPrompt`. The `SendSafeSamples` setting means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation.
|
||||
|
||||
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus.
|
||||
>[!WARNING]
|
||||
> Setting **-SubmitSamplesConsent** to `NeverSend` or `AlwaysPrompt` will lower the protection level of the device. In addition, setting it to `NeverSend` means that the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature of Microsoft Defender ATP won't work.
|
||||
|
||||
**Use Windows Management Instruction (WMI) to enable cloud-delivered protection:**
|
||||
## Use Windows Management Instruction (WMI) to enable cloud-delivered protection
|
||||
|
||||
Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn439474(v=vs.85).aspx) class for the following properties:
|
||||
|
||||
```WMI
|
||||
MAPSReporting
|
||||
MAPSReporting
|
||||
SubmitSamplesConsent
|
||||
```
|
||||
|
||||
See the following for more information and allowed parameters:
|
||||
|
||||
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx)
|
||||
|
||||
**Enable cloud-delivered protection on individual clients with the Windows Security app**
|
||||
## Enable cloud-delivered protection on individual clients with the Windows Security app
|
||||
|
||||
> [!NOTE]
|
||||
> If the **Configure local setting override for reporting Microsoft MAPS** Group Policy setting is set to **Disabled**, then the **Cloud-based protection** setting in Windows Settings will be greyed-out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings.
|
||||
|
||||
@ -12,7 +12,6 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 03/04/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -25,48 +24,181 @@ manager: dansimp
|
||||
|
||||
There are two types of updates related to keeping Windows Defender Antivirus up to date:
|
||||
|
||||
1. Protection updates
|
||||
2. Product updates
|
||||
- Security intelligence updates
|
||||
- Product updates
|
||||
|
||||
You can also apply [Windows security baselines](https://technet.microsoft.com/itpro/windows/keep-secure/windows-security-baselines) to quickly bring your endpoints up to a uniform level of protection.
|
||||
> [!IMPORTANT]
|
||||
> Keeping Windows Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques.
|
||||
> This also applies to devices where Windows Defender Antivirus is running in [passive mode](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility).
|
||||
|
||||
## Protection updates
|
||||
## Security intelligence updates
|
||||
|
||||
Windows Defender Antivirus uses both [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloaded protection updates to provide protection. These protection updates are also known as Security intelligence updates.
|
||||
Windows Defender Antivirus uses [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloads security intelligence updates to provide protection.
|
||||
|
||||
The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the protection updates generally occur once a day (although this can be configured). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection.
|
||||
The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the security intelligence updates occur on a scheduled cadence (configurable via policy). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection.
|
||||
|
||||
Engine updates are included with the Security intelligence updates and are released on a monthly cadence.
|
||||
Engine updates are included with the security intelligence updates and are released on a monthly cadence.
|
||||
|
||||
## Product updates
|
||||
|
||||
Windows Defender Antivirus requires [monthly updates](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases.
|
||||
Windows Defender Antivirus requires [monthly updates (KB4052623)](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases.
|
||||
|
||||
You can manage the distribution of updates through Windows Server Update Service (WSUS), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network.
|
||||
You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network.
|
||||
For more information, see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus).
|
||||
|
||||
## Released platform and engine versions
|
||||
> [!NOTE]
|
||||
> We release these monthly updates in phases. This results in multiple packages showing up in your WSUS server.
|
||||
|
||||
Only the main version is listed in the following table as reference information:
|
||||
## Monthly platform and engine versions
|
||||
|
||||
Month | Platform/Client | Engine
|
||||
---|---|---
|
||||
Apr-2020 | 4.18.2004.x | 1.1.17000.x
|
||||
Mar-2020 | 4.18.2003.x | 1.1.16900.x
|
||||
Feb-2020 | - | 1.1.16800.x
|
||||
Jan-2020 | 4.18.2001.x | 1.1.16700.x
|
||||
Dec-2019 | - | - |
|
||||
Nov-2019 | 4.18.1911.x | 1.1.16600.x
|
||||
Oct-2019 | 4.18.1910.x | 1.1.16500.x
|
||||
Sep-2019 | 4.18.1909.x | 1.1.16400.x
|
||||
Aug-2019 | 4.18.1908.x | 1.1.16300.x
|
||||
Jul-2019 | 4.18.1907.x | 1.1.16200.x
|
||||
Jun-2019 | 4.18.1906.x | 1.1.16100.x
|
||||
May-2019 | 4.18.1905.x | 1.1.16000.x
|
||||
Apr-2019 | 4.18.1904.x | 1.1.15900.x
|
||||
Mar-2019 | 4.18.1903.x | 1.1.15800.x
|
||||
Feb-2019 | 4.18.1902.x | 1.1.15700.x
|
||||
Jan-2019 | 4.18.1901.x | 1.1.15600.x
|
||||
Dec-18 | 4.18.1812.X | 1.1.15500.x
|
||||
For information how to update or how to install the platform update, please see [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform).
|
||||
|
||||
All our updates contain:
|
||||
* performance improvements
|
||||
* serviceability improvements
|
||||
* integration improvements (Cloud, MTP)
|
||||
<br/>
|
||||
|
||||
<details>
|
||||
<summary> April-2020 (Platform: 4.18.2004.6 | Engine: 1.1.17000.2)</summary>
|
||||
|
||||
 Security intelligence update version: **TBD**
|
||||
 Released: **April 30, 2020**
|
||||
 Platform: **4.18.2004.6**
|
||||
 Engine: **1.1.17000.2**
|
||||
 Support phase: **Security and Critical Updates**
|
||||
|
||||
### What's new
|
||||
* WDfilter improvements
|
||||
* Add more actionable event data to ASR detection events
|
||||
* Fixed version information in diagnostic data and WMI
|
||||
* Fixed incorrect platform version in UI after platform update
|
||||
* Dynamic URL intel for Fileless threat protection
|
||||
* UEFI scan capability
|
||||
* Extend logging for updates
|
||||
|
||||
### Known Issues
|
||||
No known issues
|
||||
<br/>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary> March-2020 (Platform: 4.18.2003.8 | Engine: 1.1.16900.2)</summary>
|
||||
|
||||
 Security intelligence update version: **1.313.8.0**
|
||||
 Released: **March 24, 2020**
|
||||
 Platform: **4.18.2003.8**
|
||||
 Engine: **1.1.16900.4**
|
||||
 Support phase: **Technical upgrade Support (Only)**
|
||||
|
||||
### What's new
|
||||
|
||||
* CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus)
|
||||
* Improve diagnostic capability
|
||||
* reduce Security intelligence timeout (5min)
|
||||
* Extend AMSI engine internal log capability
|
||||
* Improve notification for process blocking
|
||||
|
||||
### Known Issues
|
||||
[**Fixed**] Windows Defender Antivirus is skipping files when running a scan.
|
||||
|
||||
<br/>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
|
||||
<summary> February-2020 (Platform: - | Engine: 1.1.16800.2)</summary>
|
||||
|
||||
|
||||
Security intelligence update version: **1.311.4.0**
|
||||
Released: **February 25, 2020**
|
||||
Platform/Client: **-**
|
||||
Engine: **1.1.16800.2**
|
||||
Support phase: **N/A**
|
||||
|
||||
### What's new
|
||||
|
||||
|
||||
### Known Issues
|
||||
No known issues
|
||||
<br/>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary> January-2020 (Platform: 4.18.2001.10 | Engine: 1.1.16700.2)</summary>
|
||||
|
||||
|
||||
Security intelligence update version: **1.309.32.0**
|
||||
Released: **January 30, 2020**
|
||||
Platform/Client: **4.18.2001.10**
|
||||
Engine: **1.1.16700.2**
|
||||
Support phase: **Technical upgrade Support (Only)**
|
||||
|
||||
### What's new
|
||||
|
||||
* Fixed BSOD on WS2016 with Exchange
|
||||
* Support platform updates when TMP is redirected to network path
|
||||
* Platform and engine versions are added to [WDSI](https://www.microsoft.com/wdsi/defenderupdates)
|
||||
* extend Emergency signature update to [passive mode](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility)
|
||||
* Fix 4.18.1911.10 hang
|
||||
|
||||
### Known Issues
|
||||
[**Fixed**] devices utilizing [modern standby mode](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby) may experience a hang with the Windows Defender filter driver that results in a gap of protection. Affected machines appear to the customer as having not updated to the latest antimalware platform.
|
||||
<br/>
|
||||
> [!IMPORTANT]
|
||||
> This updates is needed by RS1 devices running lower version of the platform to support SHA2. <br/>This update has reboot flag for systems that are experiencing the hang issue.<br/> the This update is re-released in April 2020 and will not be superseded by newer updates to keep future availability.
|
||||
<br/>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary> November-2019 (Platform: 4.18.1911.2 | Engine: 1.1.16600.7)</summary>
|
||||
|
||||
Security intelligence update version: **1.307.13.0**
|
||||
Released: **December 7, 2019**
|
||||
Platform: **4.18.1911.2**
|
||||
Engine: **1.1.17000.7**
|
||||
Support phase: **No support**
|
||||
|
||||
### What's new
|
||||
|
||||
* Fixed MpCmdRun tracing level
|
||||
* Fixed WDFilter version info
|
||||
* Improve notifications (PUA)
|
||||
* add MRT logs to support files
|
||||
|
||||
### Known Issues
|
||||
No known issues
|
||||
<br/>
|
||||
</details>
|
||||
|
||||
## Windows Defender Antivirus platform support
|
||||
As stated above, platform and engine updates are provided on a monthly cadence.
|
||||
Customers must stay current with the latest platform update to be fully supported. Our support structure is now dynamic, evolving into two phases depending on the availability of the latest platform version:
|
||||
|
||||
|
||||
* **Security and Critical Updates servicing phase** - When running the latest platform version, you will be eligible to receive both Security and Critical updates to the anti-malware platform.
|
||||
|
||||
|
||||
* **Technical Support (Only) phase** - After a new platform version is released, support for older versions (N-2) will reduce to technical support only. Platform versions older than N-2 will no longer be supported.*
|
||||
|
||||
\* Technical support will continue to be provided for upgrades from the Windows 10 release version (see [Platform version included with Windows 10 releases](#platform-version-included-with-windows-10-releases)) to the latest platform version.
|
||||
|
||||
During the technical support (only) phase, commercially reasonable support incidents will be provided through Microsoft Customer Service & Support and Microsoft’s managed support offerings (such as Premier Support). If a support incident requires escalation to development for further guidance, requires a non-security update, or requires a security update, customers will be asked to upgrade to the latest platform version or an intermediate update (*).
|
||||
|
||||
### Platform version included with Windows 10 releases
|
||||
The below table provides the Windows Defender Antivirus platform and engine versions that are shipped with the latest Windows 10 releases:
|
||||
|
||||
|Windows 10 release |Platform version |Engine version |Support phase |
|
||||
|-|-|-|-|
|
||||
|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade Support (Only) |
|
||||
|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade Support (Only) |
|
||||
|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade Support (Only) |
|
||||
|1803 (RS4) |4.13.17134.1 |1.1.14600.4 | Technical upgrade Support (Only) |
|
||||
|1709 (RS3) |4.12.16299.15 |1.1.14104.0 | Technical upgrade Support (Only) |
|
||||
|1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) |
|
||||
|1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) |
|
||||
|
||||
Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet).
|
||||
|
||||
|
||||
## In this section
|
||||
|
||||
Reference in New Issue
Block a user