From 1eef3bb47641c1bf714ede773351ad122f3017f5 Mon Sep 17 00:00:00 2001 From: Anca-Ioana Martin <48067601+ancmarti@users.noreply.github.com> Date: Fri, 17 Jan 2020 13:23:24 +0200 Subject: [PATCH 01/24] Documenting known-issue with MSA service --- windows/client-management/mdm/policy-csp-accounts.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index e978cc82da..f097cc7b37 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -232,6 +232,9 @@ Added in Windows 10, version 1703. Allows IT Admins the ability to disable the " > [!NOTE] > If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). +> [!NOTE] +> If the MSA service is disabled, the Subscription Activation feature will not work properly and your users will not be able to “step-up” from Windows 10 Pro to Windows 10 Enterprise, because the MSA ticket for license authentication cannot be generated. The machine will remain on Windows 10 Pro and no error will be displayed in the Activation Settings app. + The following list shows the supported values: From eecb5b2b3a855bea3720228a5b5151616ab761bf Mon Sep 17 00:00:00 2001 From: Jonathan Gregson Date: Sat, 1 Feb 2020 04:34:45 +0000 Subject: [PATCH 02/24] Added exploit protection setting requirements. --- .../windows-defender-application-guard/reqs-wd-app-guard.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md index c8d5d6ec1c..e1712b8679 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md @@ -42,3 +42,4 @@ Your environment needs the following software to run Windows Defender Applicatio |Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803 or higher
Windows 10 Professional for Workstations edition, version 1803 or higher
Windows 10 Professional Education edition version 1803 or higher
Windows 10 Education edition, version 1903 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with WDAG for Professional editions. | |Browser|Microsoft Edge and Internet Explorer| |Management system
(only for managed devices)|[Microsoft Intune](https://docs.microsoft.com/intune/)

**-OR-**

[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/)

**-OR-**

[Group Policy](https://technet.microsoft.com/library/cc753298(v=ws.11).aspx)

**-OR-**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| +|Windows Defender Exploit Protection settings|Control Flow Guard (CFG) must be set to "Use default (On)" or "Off by default". If set to "On by default", Windows Defender Application Guard will not launch.

Randomize memory allocations (Bottom-up ASLR) must be set to "Use default (On)" or "Off by default". If set to "On by default", the `vmmem` process will have high CPU utilization while a Windows Defender Application Guard window is open.| From bc64f15c61559f0bd2f4b5966de7f87b89658334 Mon Sep 17 00:00:00 2001 From: Jonathan Gregson Date: Sat, 1 Feb 2020 21:05:14 -0800 Subject: [PATCH 03/24] Updated exploit protection settings Clarified where the settings can be changed and verified. --- .../windows-defender-application-guard/reqs-wd-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md index e1712b8679..33b3e98451 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md @@ -42,4 +42,4 @@ Your environment needs the following software to run Windows Defender Applicatio |Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803 or higher
Windows 10 Professional for Workstations edition, version 1803 or higher
Windows 10 Professional Education edition version 1803 or higher
Windows 10 Education edition, version 1903 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with WDAG for Professional editions. | |Browser|Microsoft Edge and Internet Explorer| |Management system
(only for managed devices)|[Microsoft Intune](https://docs.microsoft.com/intune/)

**-OR-**

[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/)

**-OR-**

[Group Policy](https://technet.microsoft.com/library/cc753298(v=ws.11).aspx)

**-OR-**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| -|Windows Defender Exploit Protection settings|Control Flow Guard (CFG) must be set to "Use default (On)" or "Off by default". If set to "On by default", Windows Defender Application Guard will not launch.

Randomize memory allocations (Bottom-up ASLR) must be set to "Use default (On)" or "Off by default". If set to "On by default", the `vmmem` process will have high CPU utilization while a Windows Defender Application Guard window is open.| +|Windows Defender Exploit Protection settings|The following settings should be configured or verified in the **Windows Security** app under **App & browser control** > **Exploit Protection** > **System Settings**.

**Control Flow Guard (CFG)** must be set to "Use default (On)" or "Off by default". If set to "On by default", Windows Defender Application Guard will not launch.

**Randomize memory allocations (Bottom-up ASLR)** must be set to "Use default (On)" or "Off by default". If set to "On by default", the `Vmmem` process will have high CPU utilization while a Windows Defender Application Guard window is open.| From c3578a29207033685c76d6f785de7b9909cc6d9e Mon Sep 17 00:00:00 2001 From: Daniel Olim <49715300+daniel-microsoft@users.noreply.github.com> Date: Thu, 6 Feb 2020 15:25:21 +0000 Subject: [PATCH 04/24] Update white-glove.md Need to be clear that it is either LOB or Win32, not both. --- windows/deployment/windows-autopilot/white-glove.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/white-glove.md b/windows/deployment/windows-autopilot/white-glove.md index 9fd9e87869..a0bef4bb0b 100644 --- a/windows/deployment/windows-autopilot/white-glove.md +++ b/windows/deployment/windows-autopilot/white-glove.md @@ -59,7 +59,7 @@ To enable white glove deployment, an additional Autopilot profile setting must b ![allow white glove](images/allow-white-glove-oobe.png) -The Windows Autopilot for white glove deployment pre-provisioning process will apply all device-targeted policies from Intune. That includes certificates, security templates, settings, apps, and more – anything targeting the device. Additionally, any apps (Win32 or LOB) that are configured to install in the device context and targeted to the user that has been pre-assigned to the Autopilot device will also be installed. +The Windows Autopilot for white glove deployment pre-provisioning process will apply all device-targeted policies from Intune. That includes certificates, security templates, settings, apps, and more – anything targeting the device. Additionally, any apps (Win32 or LOB) that are configured to install in the device context and targeted to the user that has been pre-assigned to the Autopilot device will also be installed. Please make sure not to target both win32 and LOB apps to the same device. >[!NOTE] >Other user-targeted policies will not apply until the user signs into the device. To verify these behaviors, be sure to create appropriate apps and policies targeted to devices and users. From e1313224be82bf6bbd7ae8854dddc04b78eac24d Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Mon, 10 Feb 2020 14:20:52 +0500 Subject: [PATCH 05/24] Update apply-hotfix-for-mbam-25-sp1.md --- mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md index 3ed2c2c111..6cea5686e6 100644 --- a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md +++ b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md @@ -19,7 +19,10 @@ author: shortpatti This topic describes the process for applying the hotfixes for Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1 ### Before you begin, download the latest hotfix of Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1 -[Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=58345) +[Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=57157) + +> [!NOTE] +> For more information about the hotfix releases, see [MBAM version chart](https://docs.microsoft.com/archive/blogs/dubaisec/mbam-version-chart). #### Steps to update the MBAM Server for existing MBAM environment 1. Remove MBAM server feature (do this by opening the MBAM Server Configuration Tool, then selecting Remove Features). From 379323220866d8285963519e076f4aa8cb074be7 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 11 Feb 2020 12:41:22 +0500 Subject: [PATCH 06/24] Update mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md index 6cea5686e6..cd77d39b06 100644 --- a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md +++ b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md @@ -22,7 +22,7 @@ This topic describes the process for applying the hotfixes for Microsoft BitLock [Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=57157) > [!NOTE] -> For more information about the hotfix releases, see [MBAM version chart](https://docs.microsoft.com/archive/blogs/dubaisec/mbam-version-chart). +> For more information about the hotfix releases, see the [MBAM version chart](https://docs.microsoft.com/archive/blogs/dubaisec/mbam-version-chart). #### Steps to update the MBAM Server for existing MBAM environment 1. Remove MBAM server feature (do this by opening the MBAM Server Configuration Tool, then selecting Remove Features). From f4be2a3c0a467cd90bc7535ce50aa649c83a2b39 Mon Sep 17 00:00:00 2001 From: Nikita Potapenko Date: Tue, 11 Feb 2020 10:02:05 +0200 Subject: [PATCH 07/24] Fix typo --- .../windows-defender-application-guard/faq-wd-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md index 0684b674b2..1e8839b354 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md @@ -83,7 +83,7 @@ To trust a subdomain, you must precede your domain with two dots, for example: ` ### Are there differences between using Application Guard on Windows Pro vs Windows Enterprise? -When using Windows Pro and Windows Enterprise, you will have access to using Application Guard's Standalone Mode. However, when using Enterprise you will have access to Application Guard's Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard). +When using Windows Pro or Windows Enterprise, you will have access to using Application Guard's Standalone Mode. However, when using Enterprise you will have access to Application Guard's Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard). ### Is there a size limit to the domain lists that I need to configure? From 811e8be792d843b2fc74fbd47e48d735ca242262 Mon Sep 17 00:00:00 2001 From: lomayor Date: Tue, 11 Feb 2020 12:53:18 -0800 Subject: [PATCH 08/24] Videos for TA and AH --- .../microsoft-defender-atp/advanced-hunting-overview.md | 5 ++++- .../microsoft-defender-atp/threat-analytics.md | 5 +++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index 73a0af658e..1b97d7c5d9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -29,8 +29,11 @@ Advanced hunting is a query-based threat-hunting tool that lets you explore up t You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured machines. ## Get started with advanced hunting +Watch this video for a quick overview of advanced hunting and a short tutorial that will get you started fast. -We recommend going through several steps to quickly get up and running with advanced hunting. +>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bGqo] + +You can also go through each of the following steps to ramp up your advanced hunting knowledge. | Learning goal | Description | Resource | |--|--|--| diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md index a1c5557fed..7abe5c6fc7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md @@ -26,6 +26,11 @@ Cyberthreats are emerging more frequently and prevalently. It is critical for or Threat analytics is a set of reports published by Microsoft security researchers as soon as emerging threats and outbreaks are identified. The reports help you assess the impact of threats to your environment and identify actions that can contain them. +Watch this short video to quickly understand how threat analytics can help you track the latest threats and stop them. + +>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bw1f] + + ## View the threat analytics dashboard The threat analytics dashboard is a great jump off point for getting to the reports that are most relevant to your organization. It provides several overviews about the threats covered in the reports: From db8d4d2b16d29345cdf86b5a0da0de508979a7f9 Mon Sep 17 00:00:00 2001 From: lomayor Date: Tue, 11 Feb 2020 13:46:07 -0800 Subject: [PATCH 09/24] breaks --- .../microsoft-defender-atp/advanced-hunting-overview.md | 4 ++-- .../microsoft-defender-atp/threat-analytics.md | 5 ++--- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index 1b97d7c5d9..94c471fbd7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -29,8 +29,8 @@ Advanced hunting is a query-based threat-hunting tool that lets you explore up t You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured machines. ## Get started with advanced hunting -Watch this video for a quick overview of advanced hunting and a short tutorial that will get you started fast. - +Watch this video for a quick overview of advanced hunting and a short tutorial that will get you started fast. + >[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bGqo] You can also go through each of the following steps to ramp up your advanced hunting knowledge. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md index 7abe5c6fc7..d3d5a49d80 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md @@ -26,11 +26,10 @@ Cyberthreats are emerging more frequently and prevalently. It is critical for or Threat analytics is a set of reports published by Microsoft security researchers as soon as emerging threats and outbreaks are identified. The reports help you assess the impact of threats to your environment and identify actions that can contain them. -Watch this short video to quickly understand how threat analytics can help you track the latest threats and stop them. - +Watch this short video to quickly understand how threat analytics can help you track the latest threats and stop them. + >[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bw1f] - ## View the threat analytics dashboard The threat analytics dashboard is a great jump off point for getting to the reports that are most relevant to your organization. It provides several overviews about the threats covered in the reports: From 22fb445694b1fa2aa1c8b1437bbee4a396e803c3 Mon Sep 17 00:00:00 2001 From: lomayor Date: Tue, 11 Feb 2020 15:17:42 -0800 Subject: [PATCH 10/24] breaks --- .../microsoft-defender-atp/advanced-hunting-overview.md | 4 ++-- .../microsoft-defender-atp/threat-analytics.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index 94c471fbd7..587366afe0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -29,8 +29,8 @@ Advanced hunting is a query-based threat-hunting tool that lets you explore up t You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured machines. ## Get started with advanced hunting -Watch this video for a quick overview of advanced hunting and a short tutorial that will get you started fast. - +Watch this video for a quick overview of advanced hunting and a short tutorial that will get you started fast. +
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bGqo] You can also go through each of the following steps to ramp up your advanced hunting knowledge. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md index d3d5a49d80..8709092d9c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md @@ -26,8 +26,8 @@ Cyberthreats are emerging more frequently and prevalently. It is critical for or Threat analytics is a set of reports published by Microsoft security researchers as soon as emerging threats and outbreaks are identified. The reports help you assess the impact of threats to your environment and identify actions that can contain them. -Watch this short video to quickly understand how threat analytics can help you track the latest threats and stop them. - +Watch this short video to quickly understand how threat analytics can help you track the latest threats and stop them. +
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bw1f] ## View the threat analytics dashboard From 89b4c225751d3cdafd7efe4a871345d4105184b7 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 11 Feb 2020 15:27:16 -0800 Subject: [PATCH 11/24] Update prevent-changes-to-security-settings-with-tamper-protection.md --- ...t-changes-to-security-settings-with-tamper-protection.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index b5d731b602..3dd89a2653 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -91,7 +91,7 @@ You must have appropriate [permissions](../microsoft-defender-atp/assign-portal- - Your organization must have [Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) (this is included in [Microsoft 365 E5](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview)). - Your organization uses [Intune to manage devices](https://docs.microsoft.com/intune/fundamentals/what-is-device-management). ([Intune licenses](https://docs.microsoft.com/intune/fundamentals/licenses) are required; this is included in Microsoft 365 E5.) - - Your Windows machines must be running Windows OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019) or later. (See [Windows 10 release information](https://docs.microsoft.com/windows/release-information/) for more details about releases.) + - Your Windows machines must be running Windows 10 OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019) or later. (See [Windows 10 release information](https://docs.microsoft.com/windows/release-information/) for more details about releases.) - You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above). - Your machines must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). ([Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md).) @@ -119,7 +119,7 @@ Here's what you see in the Windows Security app: ### Are you using Windows OS 1709, 1803, or 1809? -If you are using Windows OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), or [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019), you won't see **Tamper Protection** in the Windows Security app. In this case, you can use PowerShell to determine whether tamper protection is enabled. +If you are using Windows 10 OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), or [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019), you won't see **Tamper Protection** in the Windows Security app. In this case, you can use PowerShell to determine whether tamper protection is enabled. #### Use PowerShell to determine whether tamper protection is turned on @@ -155,7 +155,7 @@ To learn more about Threat & Vulnerability Management, see [Threat & Vulnerabili ### To which Windows OS versions is configuring tamper protection is applicable? -Windows OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019), or later together with [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp). +Windows 10 OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019), or later together with [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp). ### Is configuring tamper protection in Intune supported on servers? From 1b1b898839bf8a53c0810d6a0b5b12be15f43e0c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 11 Feb 2020 16:17:43 -0800 Subject: [PATCH 12/24] Update reqs-wd-app-guard.md --- .../windows-defender-application-guard/reqs-wd-app-guard.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md index 33b3e98451..5c81b7eb36 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 11/09/2017 +ms.date: 02/11/2020 ms.reviewer: manager: dansimp ms.custom: asr @@ -42,4 +42,4 @@ Your environment needs the following software to run Windows Defender Applicatio |Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803 or higher
Windows 10 Professional for Workstations edition, version 1803 or higher
Windows 10 Professional Education edition version 1803 or higher
Windows 10 Education edition, version 1903 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with WDAG for Professional editions. | |Browser|Microsoft Edge and Internet Explorer| |Management system
(only for managed devices)|[Microsoft Intune](https://docs.microsoft.com/intune/)

**-OR-**

[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/)

**-OR-**

[Group Policy](https://technet.microsoft.com/library/cc753298(v=ws.11).aspx)

**-OR-**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| -|Windows Defender Exploit Protection settings|The following settings should be configured or verified in the **Windows Security** app under **App & browser control** > **Exploit Protection** > **System Settings**.

**Control Flow Guard (CFG)** must be set to "Use default (On)" or "Off by default". If set to "On by default", Windows Defender Application Guard will not launch.

**Randomize memory allocations (Bottom-up ASLR)** must be set to "Use default (On)" or "Off by default". If set to "On by default", the `Vmmem` process will have high CPU utilization while a Windows Defender Application Guard window is open.| +|Windows Defender Exploit Protection settings|The following settings should be configured or verified in the **Windows Security** app under **App & browser control** > **Exploit protection** > **Exploit protection settings** > **System Settings**.

**Control flow guard (CFG)** must be set to **Use default (On)** or **Off by default**. If set to **On by default**, [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard) will not launch.

**Randomize memory allocations (Bottom-up ASLR)** must be set to **Use default (On)** or **Off by default**. If set to "On by default", the `Vmmem` process will have high CPU utilization while a Windows Defender Application Guard window is open.| From b7fb5242b49de26d6e77b9502ee4e0ceccdf5b13 Mon Sep 17 00:00:00 2001 From: Thomas Date: Tue, 11 Feb 2020 17:21:42 -0800 Subject: [PATCH 13/24] Update usmt-identify-users.md Trying to resolve issue where the note is not rendering properly --- windows/deployment/usmt/usmt-identify-users.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md index ba68d36951..6f39e5eebe 100644 --- a/windows/deployment/usmt/usmt-identify-users.md +++ b/windows/deployment/usmt/usmt-identify-users.md @@ -46,7 +46,7 @@ USMT provides several options to migrate multiple users on a single computer. Th - [Specifying users.](#bkmk-8) You can specify which users to migrate with the **/all**, **/ui**, **/uel**, and **/ue** options with both the ScanState and LoadState command-line tools. - >[!IMPORTANT]   + >[!IMPORTANT] >The **/uel** option excludes users based on the **LastModified** date of the Ntuser.dat file. The **/uel** option is not valid in offline migrations. - [Moving users to another domain.](#bkmk-8) You can move user accounts to another domain using the **/md** option with the LoadState command-line tool. From 05e01cf792e134f30312403e571380a3ce4793a1 Mon Sep 17 00:00:00 2001 From: lomayor Date: Tue, 11 Feb 2020 17:54:48 -0800 Subject: [PATCH 14/24] break --- .../microsoft-defender-atp/advanced-hunting-overview.md | 2 +- .../microsoft-defender-atp/threat-analytics.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index 587366afe0..e1afb98f0b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -30,7 +30,7 @@ You can use the same threat-hunting queries to build custom detection rules. The ## Get started with advanced hunting Watch this video for a quick overview of advanced hunting and a short tutorial that will get you started fast. -
+

>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bGqo] You can also go through each of the following steps to ramp up your advanced hunting knowledge. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md index 8709092d9c..680d1d2df2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md @@ -27,7 +27,7 @@ Cyberthreats are emerging more frequently and prevalently. It is critical for or Threat analytics is a set of reports published by Microsoft security researchers as soon as emerging threats and outbreaks are identified. The reports help you assess the impact of threats to your environment and identify actions that can contain them. Watch this short video to quickly understand how threat analytics can help you track the latest threats and stop them. -
+

>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bw1f] ## View the threat analytics dashboard From 921ea7c83aaaf7a83b2dbf533ea003d329d85e22 Mon Sep 17 00:00:00 2001 From: lomayor Date: Tue, 11 Feb 2020 18:57:42 -0800 Subject: [PATCH 15/24] breaks --- .../microsoft-defender-atp/advanced-hunting-overview.md | 3 ++- .../microsoft-defender-atp/threat-analytics.md | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index e1afb98f0b..5e5df96421 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -31,7 +31,8 @@ You can use the same threat-hunting queries to build custom detection rules. The ## Get started with advanced hunting Watch this video for a quick overview of advanced hunting and a short tutorial that will get you started fast.

->[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bGqo] + +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bGqo] You can also go through each of the following steps to ramp up your advanced hunting knowledge. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md index 680d1d2df2..2ade5dcf42 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md @@ -28,7 +28,8 @@ Threat analytics is a set of reports published by Microsoft security researchers Watch this short video to quickly understand how threat analytics can help you track the latest threats and stop them.

->[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bw1f] + +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bw1f] ## View the threat analytics dashboard From f26e378cfc3e6e792914b599a1e6ec6de01a9f83 Mon Sep 17 00:00:00 2001 From: Manuel Hauch Date: Wed, 12 Feb 2020 10:23:24 +0100 Subject: [PATCH 16/24] Remove Windows Server 2016 There is no Windows Server 2016, version 1803. It only exists Windows Server 2016 and Windows Server, Version 1803. Since 2016 doesn't come with Exploit Protection remove it to reduce confusion. --- .../microsoft-defender-atp/exploit-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md index c0073ce75e..c3858eade6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md @@ -24,7 +24,7 @@ ms.custom: asr - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Exploit protection automatically applies a number of exploit mitigation techniques to operating system processes and apps. Exploit protection is supported beginning with Windows 10, version 1709 and Windows Server 2016, version 1803. +Exploit protection automatically applies a number of exploit mitigation techniques to operating system processes and apps. Exploit protection is supported beginning with Windows 10, version 1709 and Windows Server, version 1803. > [!TIP] > You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. From 6cb823e00216a746e5af3ea7cfa5f4e84d2b4c6d Mon Sep 17 00:00:00 2001 From: Manuel Hauch Date: Wed, 12 Feb 2020 10:25:34 +0100 Subject: [PATCH 17/24] Update exploit-protection.md Again remove 2016 for clarification. --- .../microsoft-defender-atp/exploit-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md index c0073ce75e..d09f11e9d2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md @@ -93,7 +93,7 @@ Win32K | 260 | Untrusted Font ## Mitigation comparison -The mitigations available in EMET are included natively in Windows 10 (starting with version 1709) and Windows Server 2016 (starting with version 1803), under [Exploit protection](exploit-protection.md). +The mitigations available in EMET are included natively in Windows 10 (starting with version 1709) and Windows Server (starting with version 1803), under [Exploit protection](exploit-protection.md). The table in this section indicates the availability and support of native mitigations between EMET and exploit protection. From a557c146d1c48ba3fbd9d50e95a51cbcf443d28e Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Wed, 12 Feb 2020 20:39:54 +0530 Subject: [PATCH 18/24] i updated the sentences for the enabling of PUA as per the user request #5970 @BR77BE i updated content by removing and added sentences --- ...potentially-unwanted-apps-windows-defender-antivirus.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index fc883cd71d..7639442d84 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -45,11 +45,12 @@ The next major version of Microsoft Edge, which is Chromium-based, blocks potent #### Enable PUA protection in Chromium-based Microsoft Edge -Although potentially unwanted application protection in Microsoft Edge (Chromium-based) is turned off by default, it can easily be turned on from within the browser. +Although potentially unwanted application protection in Microsoft Edge (Chromium-based) version 80.0.361.50 is turned off by default, it can easily be turned on from within the browser. -1. From the tool bar, select **Settings and more** > **Settings**. +1. From the three dots, select **Settings**. 2. Select **Privacy and services**. -3. Under the **Services** section, you can toggle **Potentially unwanted app blocking** on or off. +3. Under the **Services** section, you can toggle **Block potentially unwanted apps**. +4. Slide **ON**. > [!TIP] > If you are running Microsoft Edge (Chromium-based), you can safely explore the URL-blocking feature of PUA protection by testing it out on one of our Windows Defender SmartScreen [demo pages](https://demo.smartscreen.msft.net/). From b972cc41447245110410a979e0f3f13ec91dc82b Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Wed, 12 Feb 2020 18:34:33 +0200 Subject: [PATCH 19/24] Update troubleshoot-onboarding-error-messages.md Typo in document --- .../troubleshoot-onboarding-error-messages.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md index e49cc30afe..56a0d71130 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md @@ -73,7 +73,7 @@ You'll need to whitelist the `securitycenter.windows.com` and all sub-domains un ## Portal communication issues -If you encounter issues with accessing the portal, missing data, or restricted access to portions of the portal, you'll need to verify that the following URLs are whitelisted and open for communciation. +If you encounter issues with accessing the portal, missing data, or restricted access to portions of the portal, you'll need to verify that the following URLs are whitelisted and open for communication. - `*.blob.core.windows.net crl.microsoft.com` @@ -89,4 +89,4 @@ crl.microsoft.com` ## Related topics -- [Validate licensing provisioning and complete setup for Microsoft Defender ATP](licensing.md) \ No newline at end of file +- [Validate licensing provisioning and complete setup for Microsoft Defender ATP](licensing.md) From fe247eb5e61ad81db495d85cb7dec03a548433ce Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 12 Feb 2020 09:06:35 -0800 Subject: [PATCH 20/24] Update detect-block-potentially-unwanted-apps-windows-defender-antivirus.md --- ...tentially-unwanted-apps-windows-defender-antivirus.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index 7639442d84..3fb436099a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -13,7 +13,7 @@ author: denisebmsft ms.author: deniseb ms.custom: nextgen audience: ITPro -ms.date: 01/06/2020 +ms.date: 02/12/2020 ms.reviewer: manager: dansimp --- @@ -45,12 +45,11 @@ The next major version of Microsoft Edge, which is Chromium-based, blocks potent #### Enable PUA protection in Chromium-based Microsoft Edge -Although potentially unwanted application protection in Microsoft Edge (Chromium-based) version 80.0.361.50 is turned off by default, it can easily be turned on from within the browser. +Although potentially unwanted application protection in Microsoft Edge (Chromium-based, version 80.0.361.50) is turned off by default, it can easily be turned on from within the browser. -1. From the three dots, select **Settings**. +1. Select the ellipses, and then choose **Settings**. 2. Select **Privacy and services**. -3. Under the **Services** section, you can toggle **Block potentially unwanted apps**. -4. Slide **ON**. +3. Under the **Services** section, turn on **Block potentially unwanted apps**. > [!TIP] > If you are running Microsoft Edge (Chromium-based), you can safely explore the URL-blocking feature of PUA protection by testing it out on one of our Windows Defender SmartScreen [demo pages](https://demo.smartscreen.msft.net/). From d444b5ea81aff753af679c39190d7caf071a7d3f Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Wed, 12 Feb 2020 10:01:43 -0800 Subject: [PATCH 21/24] pencil edit --- windows/deployment/usmt/usmt-identify-users.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md index 9de4030607..95fd442bb7 100644 --- a/windows/deployment/usmt/usmt-identify-users.md +++ b/windows/deployment/usmt/usmt-identify-users.md @@ -11,6 +11,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.localizationpriority: medium --- # Identify Users From 61ba7451d698681a0d306da36c2b2b59c52b86b2 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Wed, 12 Feb 2020 10:10:15 -0800 Subject: [PATCH 22/24] pencil edit --- windows/deployment/usmt/usmt-identify-users.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md index 95fd442bb7..dbd1036415 100644 --- a/windows/deployment/usmt/usmt-identify-users.md +++ b/windows/deployment/usmt/usmt-identify-users.md @@ -47,8 +47,8 @@ USMT provides several options to migrate multiple users on a single computer. Th - [Specifying users.](#bkmk-8) You can specify which users to migrate with the **/all**, **/ui**, **/uel**, and **/ue** options with both the ScanState and LoadState command-line tools. - >[!IMPORTANT]   - >The **/uel** option excludes users based on the **LastModified** date of the Ntuser.dat file. The **/uel** option is not valid in offline migrations. + >[!IMPORTANT]   + >The **/uel** option excludes users based on the **LastModified** date of the Ntuser.dat file. The **/uel** option is not valid in offline migrations. - [Moving users to another domain.](#bkmk-8) You can move user accounts to another domain using the **/md** option with the LoadState command-line tool. From fa1b8000c82aa0dace3b08a0b59f29ceea13a4fd Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Wed, 12 Feb 2020 10:19:30 -0800 Subject: [PATCH 23/24] pencil edit --- windows/deployment/usmt/usmt-identify-users.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md index dbd1036415..95fd442bb7 100644 --- a/windows/deployment/usmt/usmt-identify-users.md +++ b/windows/deployment/usmt/usmt-identify-users.md @@ -47,8 +47,8 @@ USMT provides several options to migrate multiple users on a single computer. Th - [Specifying users.](#bkmk-8) You can specify which users to migrate with the **/all**, **/ui**, **/uel**, and **/ue** options with both the ScanState and LoadState command-line tools. - >[!IMPORTANT]   - >The **/uel** option excludes users based on the **LastModified** date of the Ntuser.dat file. The **/uel** option is not valid in offline migrations. + >[!IMPORTANT]   + >The **/uel** option excludes users based on the **LastModified** date of the Ntuser.dat file. The **/uel** option is not valid in offline migrations. - [Moving users to another domain.](#bkmk-8) You can move user accounts to another domain using the **/md** option with the LoadState command-line tool. From ae8c76618128a69a1a4414eb97379ca7fd63d053 Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Wed, 12 Feb 2020 10:46:33 -0800 Subject: [PATCH 24/24] remove extra spaces extra spaces to the right of the note in line 50 are causing the note to not render properly. --- windows/deployment/usmt/usmt-identify-users.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md index 95fd442bb7..b58c711dbf 100644 --- a/windows/deployment/usmt/usmt-identify-users.md +++ b/windows/deployment/usmt/usmt-identify-users.md @@ -47,7 +47,7 @@ USMT provides several options to migrate multiple users on a single computer. Th - [Specifying users.](#bkmk-8) You can specify which users to migrate with the **/all**, **/ui**, **/uel**, and **/ue** options with both the ScanState and LoadState command-line tools. - >[!IMPORTANT]   + >[!IMPORTANT] >The **/uel** option excludes users based on the **LastModified** date of the Ntuser.dat file. The **/uel** option is not valid in offline migrations. - [Moving users to another domain.](#bkmk-8) You can move user accounts to another domain using the **/md** option with the LoadState command-line tool.