mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-27 16:23:36 +00:00
Merge pull request #3251 from MicrosoftDocs/master
Publish 6/8/2020 10:30 AM PT
This commit is contained in:
Tina Burden
GitHub
@ -29,7 +29,7 @@ The tools in the folder might vary depending on which edition of Windows you are
|
||||
|
||||
|
||||
|
||||
These tools were included in previous versions of Windows and the associated documentation for each tool should help you use these tools in Windows 10. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders.
|
||||
These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows 10. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -56,21 +56,16 @@ The supported operations are Add and Execute.
|
||||
The data type is string.
|
||||
|
||||
Expected value:
|
||||
Set and Execute are functionality equivalent, and each accepts an XML snippet (as a string) describing what data to gather and where to upload it.
|
||||
Set and Execute are functionality equivalent, and each accepts a `Collection` XML snippet (as a string) describing what data to gather and where to upload it. The results are zipped and uploaded to the specified SasUrl. The zipped filename format is "DiagLogs-{ComputerName}-YYYYMMDDTHHMMSSZ.zip".
|
||||
|
||||
The following is an example of the XML. This example instructs the CSP to gather:
|
||||
- All the keys and values under a registry path
|
||||
- All the *.etl files in a folder
|
||||
- The output of two commands
|
||||
- Additional files created by one of the commands
|
||||
- All the Application event log events.
|
||||
|
||||
The results are zipped and uploaded to the specified SasUrl. The filename format is "DiagLogs-{ComputerName}-YYYYMMDDTHHMMSSZ.zip".
|
||||
The following is an example of a `Collection` XML.
|
||||
|
||||
``` xml
|
||||
<Collection>
|
||||
<ID>server generated guid value such as f1e20cb4-9789-4f6b-8f6a-766989764c6d</ID>
|
||||
<SasUrl>server generated url where the HTTP PUT will be accepted</SasUrl>
|
||||
<!--NOTE: The value shown here is an example only, for more information see the ID documentation which follows the example -->
|
||||
<ID>f1e20cb4-9789-4f6b-8f6a-766989764c6d</ID>
|
||||
<!--NOTE: The value shown here is an example only, for more information see the SasUrl documentation which follows the example -->
|
||||
<SasUrl><![CDATA[https://myaccount.blob.core.windows.net/mycontainer?sp=aw&st=2020-07-01T23:02:07Z&se=2020-07-02T23:02:07Z&sv=2019-10-10&sr=c&sig=wx9%2FhwrczAI0nZL7zl%2BhfZVfOBvboTAnrGYfjlO%2FRFA%3D]]></SasUrl>
|
||||
<RegistryKey>HKLM\Software\Policies</RegistryKey>
|
||||
<FoldersFiles>%ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl</FoldersFiles>
|
||||
<Command>%windir%\system32\ipconfig.exe /all</Command>
|
||||
@ -83,15 +78,13 @@ The results are zipped and uploaded to the specified SasUrl. The filename format
|
||||
The XML should include the following elements within the `Collection` element:
|
||||
|
||||
**ID**
|
||||
The ID value is a server-generated GUID string that identifies this data-gathering request. To avoid accidental repetition of data gathering, the CSP ignores subsequent Set or Execute invocations with the same ID value.
|
||||
The ID value uniquely identifies this data-gathering request. To avoid accidental repetition of data gathering, the CSP ignores subsequent Set or Execute invocations with the same ID value. The CSP expects the value to be populated when the request is received, so it must be generated by the IT admin or the management server.
|
||||
|
||||
**SasUrl**
|
||||
The SasUrl value is the target URI to which the CSP uploads the results zip file. It is the responsibility of the management server to provision storage in such a way that the server accepts the HTTP PUT to this URL. For example, the device management service could:
|
||||
- Provision cloud storage, such as an Azure blob storage container or other storage managed by the device management server
|
||||
- Generate a dynamic https SAS token URL representing the storage location (and which is understood by the server to allow a one-time upload or time-limited uploads)
|
||||
- Pass this value to the CSP as the SasUrl value.
|
||||
|
||||
Assuming a case where the management server's customer (such as an IT admin) is meant to access the data, the management server would also expose the stored data through its user interface or APIs.
|
||||
The SasUrl value is the target URI to which the CSP uploads the zip file containing the gathered data. It is the responsibility of the management server to provision storage in such a way that the storage server accepts the device's HTTP PUT to this URL. For example, the device management service could:
|
||||
- Provision cloud storage reachable by the target device, such as a Microsoft Azure blob storage container
|
||||
- Generate a Shared Access Signature URL granting the possessor (the target device) time-limited write access to the storage container
|
||||
- Pass this value to the CSP on the target device through the `Collection` XML as the `SasUrl` value.
|
||||
|
||||
**One or more data gathering directives, which may include any of the following:**
|
||||
|
||||
@ -1482,4 +1475,4 @@ To read a log file:
|
||||
5. Set **BlockIndexToRead** to initialize read start point.
|
||||
6. Get **BlockData** for upload log block.
|
||||
7. Increase **BlockIndexToRead**.
|
||||
8. Repeat step 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)**.
|
||||
8. Repeat steps 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)**.
|
||||
|
||||
@ -35,6 +35,9 @@ There are a significant number of policy settings available for Windows 10, both
|
||||
<br>Windows 10 Security Baseline / <a href="https://docs.microsoft.com/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions">Require admin approval mode for administrators</a></td>
|
||||
<td>When modifying user account control (UAC) settings during the OOBE using the device Enrollment Status Page (ESP), additional UAC prompts may result, especially if the device reboots after these policies are applied, enabling them to take effect. To work around this issue, the policies can be targeted to users instead of devices so that they apply later in the process.</td>
|
||||
|
||||
<tr><td width="50%">Device restrictions / Cloud and Storage / <a href="https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#cloud-and-storage">Microsoft Account sign-in assistant</a></td>
|
||||
<td>Setting this policy to "disabled" will disable the Microsoft Sign-in Assistant service (wlidsvc). This service is required by Windows Autopilot to obtain the Windows Autopilot profile.</td>
|
||||
|
||||
</table>
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -14,7 +14,7 @@ ms.author: obezeajo
|
||||
manager: robsize
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 6/3/2020
|
||||
ms.date: 7/7/2020
|
||||
---
|
||||
|
||||
# Manage connections from Windows 10 operating system components to Microsoft services
|
||||
@ -57,18 +57,18 @@ The following table lists management options for each setting, beginning with Wi
|
||||
| Setting | UI | Group Policy | Registry |
|
||||
| - | :-: | :-: | :-: |
|
||||
| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | |  |  |
|
||||
| [2. Cortana and Search](#bkmk-cortana) |  |  |  |
|
||||
| [2. Cortana and Search](#bkmk-cortana) | |  |  |
|
||||
| [3. Date & Time](#bkmk-datetime) |  |  |  |
|
||||
| [4. Device metadata retrieval](#bkmk-devinst) | |  |  |
|
||||
| [5. Find My Device](#find-my-device) |  |  |  |
|
||||
| [6. Font streaming](#font-streaming) | |  |  |
|
||||
| [7. Insider Preview builds](#bkmk-previewbuilds) |  |  |  |
|
||||
| [8. Internet Explorer](#bkmk-ie) |  |  |  |
|
||||
| [8. Internet Explorer](#bkmk-ie) | |  |  |
|
||||
| [9. License Manager](#bkmk-licmgr) | | |  |
|
||||
| [10. Live Tiles](#live-tiles) | |  |  |
|
||||
| [11. Mail synchronization](#bkmk-mailsync) |  | |  |
|
||||
| [12. Microsoft Account](#bkmk-microsoft-account) | | |  |
|
||||
| [13. Microsoft Edge](#bkmk-edge) |  |  |  |
|
||||
| [13. Microsoft Edge](#bkmk-edge) | |  |  |
|
||||
| [14. Network Connection Status Indicator](#bkmk-ncsi) | |  |  |
|
||||
| [15. Offline maps](#bkmk-offlinemaps) |  |  |  |
|
||||
| [16. OneDrive](#bkmk-onedrive) | |  |  |
|
||||
@ -613,6 +613,10 @@ You can turn off NCSI by doing one of the following:
|
||||
|
||||
You can turn off the ability to download and update offline maps.
|
||||
|
||||
- Turn **Off** the feature in the UI by going to **Settings -> Apps -> Offline maps -> Map updates**, toggle the **Automatically update maps** switch to **Off**
|
||||
|
||||
-or-
|
||||
|
||||
- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data**
|
||||
|
||||
-or-
|
||||
@ -929,7 +933,7 @@ To turn off **Location for this device**:
|
||||
|
||||
-or-
|
||||
|
||||
- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**.
|
||||
- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** and set the **Select a setting** box to **Force Deny**.
|
||||
|
||||
-or-
|
||||
|
||||
@ -942,7 +946,7 @@ To turn off **Location**:
|
||||
|
||||
-or-
|
||||
|
||||
- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** and set the **Select a setting** box to **Force Deny**.
|
||||
- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**.
|
||||
|
||||
-or-
|
||||
|
||||
|
||||
@ -169,7 +169,7 @@ When Active Directory is installed on the first domain controller in the domain,
|
||||
## <a href="" id="sec-guest"></a>Guest account
|
||||
|
||||
|
||||
The Guest account is a default local account has limited access to the computer and is disabled by default. The Guest account cannot be deleted or disabled, and the account name cannot be changed. By default, the Guest account password is left blank. A blank password allows the Guest account to be accessed without requiring the user to enter a password.
|
||||
The Guest account is a default local account that has limited access to the computer and is disabled by default. By default, the Guest account password is left blank. A blank password allows the Guest account to be accessed without requiring the user to enter a password.
|
||||
|
||||
The Guest account enables occasional or one-time users, who do not have an individual account on the computer, to sign in to the local server or domain with restricted rights and permissions. The Guest account can be enabled, and the password can be set up if needed, but only by a member of the Administrator group on the domain.
|
||||
|
||||
|
||||
@ -33,6 +33,9 @@ Windows Certificate APIs (CertVerifyCertificateChainPolicy and WinVerifyTrust) a
|
||||
These restrictions are encapsulated in a Pin Rules Certificate Trust List (CTL) that is configured and deployed to Windows 10 computers.
|
||||
Any site certificate triggering a name mismatch causes Windows to write an event to the CAPI2 event log and prevents the user from navigating to the web site using Microsoft Edge or Internet Explorer.
|
||||
|
||||
> [!NOTE]
|
||||
> Enterprise Certificate Pinning feature triggering doesn't cause clients other than Microsoft Edge or Internet Explorer to block the connection.
|
||||
|
||||
## Deployment
|
||||
|
||||
To deploy enterprise certificate pinning, you need to:
|
||||
|
||||
@ -31,6 +31,9 @@ In a mobile-first, cloud-first world, Azure Active Directory enables single sign
|
||||
|
||||
To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain applications even for the right people? For example, it might be OK for you if the right people are accessing certain applications from a trusted network; however, you might not want them to access these applications from a network you don't trust. You can address these questions using conditional access.
|
||||
|
||||
> [!NOTE]
|
||||
> For more details about the way Windows Hello for Business interacts with Azure Multi Factor Authentication and Conditional Access, see [this article](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/why-are-my-users-not-prompted-for-mfa-as-expected/ba-p/1449032).
|
||||
|
||||
Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access.
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -58,6 +58,28 @@ All our updates contain:
|
||||
* serviceability improvements
|
||||
* integration improvements (Cloud, MTP)
|
||||
<br/>
|
||||
<details>
|
||||
<summary> June-2020 (Platform: 4.18.2006.10 | Engine: 1.1.17200.2)</summary>
|
||||
|
||||
 Security intelligence update version: **1.319.20.0**
|
||||
 Released: **June 22, 2020**
|
||||
 Platform: **4.18.2006.10**
|
||||
 Engine: **1.1.17200.2**
|
||||
 Support phase: **Security and Critical Updates**
|
||||
|
||||
### What's new
|
||||
* Possibility to specify the [location of the support logs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data)
|
||||
* Skipping aggressive catchup scan in Passive mode.
|
||||
* Allow Defender to update on metered connections
|
||||
* Fixed performance tuning when caching is disabled
|
||||
* Fixed registry query
|
||||
* Fixed scantime randomization in ADMX
|
||||
|
||||
### Known Issues
|
||||
No known issues
|
||||
<br/>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary> May-2020 (Platform: 4.18.2005.4 | Engine: 1.1.17100.2)</summary>
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 104 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 119 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 99 KiB |
@ -86,10 +86,10 @@ The following table lists commands for some of the most common scenarios. Run `m
|
||||
|Configuration |Turn on/off product diagnostics |`mdatp config cloud-diagnostic --value [enabled|disabled]` |
|
||||
|Configuration |Turn on/off automatic sample submission |`mdatp config cloud-automatic-sample-submission [enabled|disabled]` |
|
||||
|Configuration |Turn on/off AV passive mode |`mdatp config passive-mode [enabled|disabled]` |
|
||||
|Configuration |Add/remove an antivirus exclusion for a file extension |`mdatp exclusion extension [add|remove] --name <extension>` |
|
||||
|Configuration |Add/remove an antivirus exclusion for a file |`mdatp exclusion file [add|remove] --path <path-to-file>` |
|
||||
|Configuration |Add/remove an antivirus exclusion for a directory |`mdatp exclusion folder [add|remove] --path <path-to-directory>` |
|
||||
|Configuration |Add/remove an antivirus exclusion for a process |`mdatp exclusion process [add|remove] --path <path-to-process>`<br/>`mdatp exclusion process [add|remove] --name <process-name>` |
|
||||
|Configuration |Add/remove an antivirus exclusion for a file extension |`mdatp exclusion extension [add|remove] --name [extension]` |
|
||||
|Configuration |Add/remove an antivirus exclusion for a file |`mdatp exclusion file [add|remove] --path [path-to-file]` |
|
||||
|Configuration |Add/remove an antivirus exclusion for a directory |`mdatp exclusion folder [add|remove] --path [path-to-directory]` |
|
||||
|Configuration |Add/remove an antivirus exclusion for a process |`mdatp exclusion process [add|remove] --path [path-to-process]`<br/>`mdatp exclusion process [add|remove] --name [process-name]` |
|
||||
|Configuration |List all antivirus exclusions |`mdatp exclusion list` |
|
||||
|Configuration |Turn on PUA protection |`mdatp threat policy set --type potentially_unwanted_application --action block` |
|
||||
|Configuration |Turn off PUA protection |`mdatp threat policy set --type potentially_unwanted_application --action off` |
|
||||
@ -103,12 +103,12 @@ The following table lists commands for some of the most common scenarios. Run `m
|
||||
|Protection |Cancel an ongoing on-demand scan |`mdatp scan cancel` |
|
||||
|Protection |Request a security intelligence update |`mdatp definitions update` |
|
||||
|Protection history |Print the full protection history |`mdatp threat list` |
|
||||
|Protection history |Get threat details |`mdatp threat get --id <threat-id>` |
|
||||
|Protection history |Get threat details |`mdatp threat get --id [threat-id]` |
|
||||
|Quarantine management |List all quarantined files |`mdatp threat quarantine list` |
|
||||
|Quarantine management |Remove all files from the quarantine |`mdatp threat quarantine remove-all` |
|
||||
|Quarantine management |Add a file detected as a threat to the quarantine |`mdatp threat quarantine add --id <threat-id>` |
|
||||
|Quarantine management |Remove a file detected as a threat from the quarantine |`mdatp threat quarantine add --id <threat-id>` |
|
||||
|Quarantine management |Restore a file from the quarantine |`mdatp threat quarantine add --id <threat-id>` |
|
||||
|Quarantine management |Add a file detected as a threat to the quarantine |`mdatp threat quarantine add --id [threat-id]` |
|
||||
|Quarantine management |Remove a file detected as a threat from the quarantine |`mdatp threat quarantine add --id [threat-id]` |
|
||||
|Quarantine management |Restore a file from the quarantine |`mdatp threat quarantine add --id [threat-id]` |
|
||||
|
||||
## Microsoft Defender ATP portal information
|
||||
|
||||
|
||||
@ -0,0 +1,282 @@
|
||||
---
|
||||
title: New configuration profiles for macOS Catalina and newer versions of macOS
|
||||
description: This topic describes the changes that are must be made in order to benefit from the system extensions, which are a replacement for kernel extensions on macOS Catalina and newer versions of macOS.
|
||||
keywords: microsoft, defender, atp, mac, kernel, system, extensions, catalina
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: security
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dansimp
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# New configuration profiles for macOS Catalina and newer versions of macOS
|
||||
|
||||
In alignment with macOS evolution, we are preparing a Microsoft Defender ATP for Mac update that leverages system extensions instead of kernel extensions. This update will only be applicable to macOS Catalina (10.15.4) and newer versions of macOS.
|
||||
|
||||
If you have deployed Microsoft Defender ATP for Mac in a managed environment (through JAMF, Intune, or another MDM solution), you must deploy new configuration profiles. Failure to do these steps will result in users getting approval prompts to run these new components.
|
||||
|
||||
## JAMF
|
||||
|
||||
### System Extensions Policy
|
||||
|
||||
To approve the system extensions, create the following payload:
|
||||
|
||||
1. In **Computers > Configuration Profiles** select **Options > System Extensions**.
|
||||
2. Select **Allowed System Extensions** from the **System Extension Types** drop-down list.
|
||||
3. Use **UBF8T346G9** for Team Id.
|
||||
4. Add the following bundle identifiers to the **Allowed System Extensions** list:
|
||||
|
||||
- **com.microsoft.wdav.epsext**
|
||||
- **com.microsoft.wdav.netext**
|
||||
|
||||
|
||||
|
||||
### Privacy Preferences Policy Control
|
||||
|
||||
Add the following JAMF payload to grant Full Disk Access to the Microsoft Defender ATP Endpoint Security Extension. This policy is a pre-requisite for running the extension on your device.
|
||||
|
||||
1. Select **Options** > **Privacy Preferences Policy Control**.
|
||||
2. Use `com.microsoft.wdav.epsext` as the **Identifier** and `Bundle ID` as **Bundle type**.
|
||||
3. Set Code Requirement to `identifier "com.microsoft.wdav.epsext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`
|
||||
4. Set **App or service** to **SystemPolicyAllFiles** and access to **Allow**.
|
||||
|
||||
|
||||
|
||||
### Web Content Filtering Policy
|
||||
|
||||
A web content filtering policy is needed to run the network extension. Add the following web content filtering policy:
|
||||
|
||||
>[!NOTE]
|
||||
>Note: JAMF doesn’t have built-in support for content filtering policies, which are a pre-requisite for enabling the network extensions that Microsoft Defender ATP for Mac installs on the device. Furthermore, JAMF sometimes changes the content of the policies being deployed.
|
||||
>As such, the following steps provide a workaround that involve signing the web content filtering configuration profile.
|
||||
|
||||
1. Save the following content to your device as `com.apple.webcontent-filter.mobileconfig`
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1">
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>DA2CC794-488B-4AFF-89F7-6686A7E7B8AB</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft Corporation</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>DA2CC794-488B-4AFF-89F7-6686A7E7B8AB</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Microsoft Defender ATP Content Filter</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<true/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>2BA070D9-2233-4827-AFC1-1F44C8C8E527</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.webcontent-filter</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft Corporation</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>CEBF7A71-D9A1-48BD-8CCF-BD9D18EC155A</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Approved Content Filter</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>FilterType</key>
|
||||
<string>Plugin</string>
|
||||
<key>UserDefinedName</key>
|
||||
<string>Microsoft Defender ATP Content Filter</string>
|
||||
<key>PluginBundleID</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>FilterSockets</key>
|
||||
<true/>
|
||||
<key>FilterDataProviderBundleIdentifier</key>
|
||||
<string>com.microsoft.wdav.netext</string>
|
||||
<key>FilterDataProviderDesignatedRequirement</key>
|
||||
<string>identifier "com.microsoft.wdav.netext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9</string>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
2. Verify that the above file was copied correctly. From the Terminal, run the following command and verify that it outputs `OK`:
|
||||
|
||||
```bash
|
||||
$ plutil -lint com.apple.webcontent-filter.mobileconfig
|
||||
com.apple.webcontent-filter.mobileconfig: OK
|
||||
```
|
||||
|
||||
3. Follow the instructions on [this page](https://www.jamf.com/jamf-nation/articles/649/creating-a-signing-certificate-using-jamf-pro-s-built-in-certificate-authority) to create a signing certificate using JAMF’s built-in certificate authority
|
||||
|
||||
4. After the certificate is created and installed to your device, run the following command from the Terminal:
|
||||
|
||||
```bash
|
||||
$ security cms -S -N "<certificate name>" -i com.apple.webcontent-filter.mobileconfig -o com.apple.webcontent-filter.signed.mobileconfig
|
||||
```
|
||||
|
||||
5. From the JAMF portal, navigate to **Configuration Profiles** and click the **Upload** button. Select `com.apple.webcontent-filter.signed.mobileconfig` when prompted for the file.
|
||||
|
||||
## Intune
|
||||
|
||||
### Create the Custom Configuration Profile
|
||||
|
||||
Save the following content to a file named **sysext.xml**:
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1">
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>7E53AC50-B88D-4132-99B6-29F7974EAA3C</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft Corporation</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>7E53AC50-B88D-4132-99B6-29F7974EAA3C</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Microsoft Defender ATP System Extensions</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<true/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>2BA070D9-2233-4827-AFC1-1F44C8C8E527</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.webcontent-filter</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft Corporation</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>CEBF7A71-D9A1-48BD-8CCF-BD9D18EC155A</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Approved Content Filter</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>FilterType</key>
|
||||
<string>Plugin</string>
|
||||
<key>UserDefinedName</key>
|
||||
<string>Microsoft Defender ATP Content Filter</string>
|
||||
<key>PluginBundleID</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>FilterSockets</key>
|
||||
<true/>
|
||||
<key>FilterDataProviderBundleIdentifier</key>
|
||||
<string>com.microsoft.wdav.netext</string>
|
||||
<key>FilterDataProviderDesignatedRequirement</key>
|
||||
<string>identifier "com.microsoft.wdav.netext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>56105E89-C7C8-4A95-AEE6-E11B8BEA0366</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.TCC.configuration-profile-policy</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft Corporation</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>56105E89-C7C8-4A95-AEE6-E11B8BEA0366</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Privacy Preferences Policy Control</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>Services</key>
|
||||
<dict>
|
||||
<key>SystemPolicyAllFiles</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>Identifier</key>
|
||||
<string>com.microsoft.wdav.epsext</string>
|
||||
<key>CodeRequirement</key>
|
||||
<string>identifier "com.microsoft.wdav.epsext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9</string>
|
||||
<key>IdentifierType</key>
|
||||
<string>bundleID</string>
|
||||
<key>StaticCode</key>
|
||||
<integer>0</integer>
|
||||
<key>Allowed</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>E6F96207-631F-462C-994A-37A6AD7BDED8</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.system-extension-policy</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft Corporation</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>E6F96207-631F-462C-994A-37A6AD7BDED8</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>System Extensions</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>AllowUserOverrides</key>
|
||||
<true/>
|
||||
<key>AllowedSystemExtensions</key>
|
||||
<dict>
|
||||
<key>UBF8T346G9</key>
|
||||
<array>
|
||||
<string>com.microsoft.wdav.epsext</string>
|
||||
<string>com.microsoft.wdav.netext</string>
|
||||
</array>
|
||||
</dict>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
### Deploy the Custom Configuration Profile
|
||||
|
||||
To configure the system extensions in Intune:
|
||||
|
||||
1. In Intune, open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create profile**.
|
||||
2. Choose a name for the profile. Change **Platform=macOS** and **Profile type=Custom**. Select **Configure**.
|
||||
3. Open the configuration profile and upload sysext.xml. This file was created in the preceding step.
|
||||
4. Select **OK**.
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user