mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-22 05:43:41 +00:00
Merge branch 'master' into v-tea-CI-113175
This commit is contained in:
Teresa-Motiv
@ -1806,7 +1806,7 @@ The content below are the latest versions of the DDF files:
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>4</DefaultValue>
|
||||
<Description>This node is used for setting or getting the block size (in Kilobytes) for the download of assoicated log file. The value range is 1~16. Default value is 4.</Description>
|
||||
<Description>This node is used for setting or getting the block size (in Kilobytes) for the download of associated log file. The value range is 1~16. Default value is 4.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
|
||||
@ -957,7 +957,7 @@ The XML below is for Windows 10, version 1803.
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Number of days after last sucessful sync to unenroll</Description>
|
||||
<Description>Number of days after last successful sync to unenroll</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
|
||||
@ -89,7 +89,7 @@ The following diagram shows the EnterpriseAppVManagement configuration service p
|
||||
- SYNC\_ERR\_PUBLISH\_GROUP_PACKAGES (3) - Publish group packages failed during publish.
|
||||
- SYNC\_ERR\_UNPUBLISH_PACKAGES (4) - Unpublish packages failed during publish.
|
||||
- SYNC\_ERR\_NEW_POLICY_WRITE (5) - New policy write failed during publish.
|
||||
- SYNC\_ERR\_MULTIPLE\_DURING_PUBLISH (6) - Multiple non-fatal errors occured during publish.
|
||||
- SYNC\_ERR\_MULTIPLE\_DURING_PUBLISH (6) - Multiple non-fatal errors occurred during publish.
|
||||
|
||||
<p style="margin-left: 20px">Value type is string. Supported operation is Get.</p>
|
||||
|
||||
|
||||
@ -492,6 +492,18 @@ Supported operation is Execute, Add, Delete, and Get.
|
||||
<a href="" id="appinstallation-packagefamilyname-hostedinstall"></a>**AppInstallation/*PackageFamilyName*/HostedInstall**
|
||||
Required. Command to perform an install of an app package from a hosted location (this can be a local drive, a UNC, or https data source).
|
||||
|
||||
The following list shows the supported deployment options:
|
||||
- ForceApplicationShutdown
|
||||
- DevelopmentMode
|
||||
- InstallAllResources
|
||||
- ForceTargetApplicationShutdown
|
||||
- ForceUpdateToAnyVersion
|
||||
- DeferRegistration="1". If the app is in use at the time of installation. This stages the files for an app update and completes the registration of the app update after the app closes. Available in the latest insider flight of 20H1.
|
||||
- StageOnly="1". Stages the files for an app installation or update without installing the app. Available in 1803.
|
||||
- LicenseUri="\\server\license.lic". Deploys an offline license from the Microsoft Store for Business. Available in 1607.
|
||||
- ValidateDependencies="1". This is used at provisioning/staging time. If it is set to 1, deployment will perform the same dependency validation during staging that we would normally do at registration time, failing and rejecting the provision request if the dependencies are not present. Available in the latest insider flight of 20H1.
|
||||
- ExcludeAppFromLayoutModification="1". Sets that the app will be provisioned on all devices and will be able to retain the apps provisioned without pinning them to start layout. Available in 1809.
|
||||
|
||||
Supported operation is Execute, Add, Delete, and Get.
|
||||
|
||||
<a href="" id="appinstallation-packagefamilyname-lasterror"></a>**AppInstallation/*PackageFamilyName*/LastError**
|
||||
|
||||
@ -5,7 +5,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.localizationpriority: medium
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.date: 04/30/2018
|
||||
@ -57,7 +57,7 @@ See [Dialer codes to launch diagnostic applications](https://docs.microsoft.com/
|
||||
|
||||
## PerSimSettings
|
||||
|
||||
Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, select **Add**, and then configure the folowing settings.
|
||||
Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, select **Add**, and then configure the following settings.
|
||||
|
||||
### Critical
|
||||
|
||||
|
||||
@ -81,7 +81,7 @@ SyncSender | Specify a value for SyncSender that is greater than 3 characters bu
|
||||
|
||||
## PerSimSettings
|
||||
|
||||
Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, click **Add**, and then configure the folowing settings.
|
||||
Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, click **Add**, and then configure the following settings.
|
||||
|
||||
### AllowMmsIfDataIsOff
|
||||
|
||||
|
||||
@ -272,7 +272,7 @@ For clients that should have their feature updates approved as soon as they’re
|
||||
Now, whenever Windows 10 feature updates are published to WSUS, they will automatically be approved for the **Ring 3 Broad IT** deployment ring with an installation deadline of 1 week.
|
||||
|
||||
> [!WARNING]
|
||||
> The auto approval rule runs after synchronization occurs. This means that the *next* upgrade for each Windows 10 version will be approved. If you select **Run Rule**, all possible updates that meet the criteria will be approved, potentially including older updates that you don't actualy want--which can be a problem when the download sizes are very large.
|
||||
> The auto approval rule runs after synchronization occurs. This means that the *next* upgrade for each Windows 10 version will be approved. If you select **Run Rule**, all possible updates that meet the criteria will be approved, potentially including older updates that you don't actually want--which can be a problem when the download sizes are very large.
|
||||
|
||||
## Manually approve and deploy feature updates
|
||||
|
||||
|
||||
@ -11,7 +11,8 @@ ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.sitesec: library
|
||||
ms.pagetype: mdt
|
||||
audience: itpro
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
@ -24,7 +25,7 @@ The simplest path to upgrade PCs that are currently running Windows 7, Windows
|
||||
|
||||
## Proof-of-concept environment
|
||||
|
||||
|
||||
For the purposes of this topic, we will use three machines: DC01, MDT01, and PC0001. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard machine, fully patched with the latest security updates, and configured as a member server in the fictional contoso.com domain. PC0001 is a machine with Windows 7 SP1, targeted for the Windows 10 upgrade. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md).
|
||||
|
||||
|
||||
|
||||
|
||||
@ -31,17 +31,16 @@ The Volume Activation Management Tool (VAMT) can be used to perform activations
|
||||
## System Requirements
|
||||
|
||||
The following table lists the system requirements for the VAMT host computer.
|
||||
|
||||
|Item |Minimum system requirement |
|
||||
|-----|---------------------------|
|
||||
|Computer and Processor |1 GHz x86 or x64 processor |
|
||||
|Memory |1 GB RAM for x86 or 2 GB RAM for x64 |
|
||||
|Hard Disk |16 GB available hard disk space for x86 or 20 GB for x64 |
|
||||
|External Drive|Removable media (Optional) |
|
||||
|Display |1024x768 or higher resolution monitor |
|
||||
|Network |Connectivity to remote computers via Windows® Management Instrumentation (TCP/IP) and Microsoft® Activation Web Service on the Internet via HTTPS |
|
||||
|Operating System |Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, or Windows Server 2012. |
|
||||
|Additional Requirements |<ul><li>Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).</li><li>PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server® 2012, PowerShell is included in the installation. For previous versions of Windows and
|
||||
|
||||
| Item | Minimum system requirement |
|
||||
| ---- | ---------------------------|
|
||||
| Computer and Processor | 1 GHz x86 or x64 processor |
|
||||
| Memory | 1 GB RAM for x86 or 2 GB RAM for x64 |
|
||||
| Hard Disk | 16 GB available hard disk space for x86 or 20 GB for x64 |
|
||||
| External Drive | Removable media (Optional) |
|
||||
| Display | 1024x768 or higher resolution monitor |
|
||||
| Network | Connectivity to remote computers via Windows Management Instrumentation (TCP/IP) and Microsoft Activation Web Service on the Internet via HTTPS |
|
||||
| Operating System | Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, or later. |
|
||||
| Additional Requirements | <ul><li>Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).</li><li>PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012, PowerShell is included in the installation. For previous versions of Windows and Windows Server, you must download PowerShell 3.0. To download PowerShell, go to [Download Windows PowerShell 3.0](https://go.microsoft.com/fwlink/p/?LinkId=218356).</li><li>If installing on Windows Server 2008 R2, you must also install .NET Framework 3.51.</li></ul> |
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -215,7 +215,7 @@ See the following examples.
|
||||
- Click **Next**.
|
||||
|
||||
>[!NOTE]
|
||||
>The Autopilot for existing devices task sequence will result in an Azure Active Directory Domain (AAD) joined device. The User State Migration Toolkit (USMT) does not support AAD joined or hybrid AAD joined devices.
|
||||
>Because the Autopilot for existing devices task sequence completes while in Windows PE, User State Migration Toolkit (USMT) data migration is not supported as there is no way to restore the user state into the new OS. Also, the User State Migration Toolkit (USMT) does not support Azure AD-joined devices.
|
||||
|
||||
7. On the Include Updates page, choose one of the three available options. This selection is optional.
|
||||
8. On the Install applications page, add applications if desired. This is optional.
|
||||
|
||||
@ -121,8 +121,11 @@ Specific scenarios will then have additional requirements. Generally, there are
|
||||
See [Windows Autopilot Scenarios](windows-autopilot-scenarios.md) for additional details.
|
||||
|
||||
For a walkthrough for some of these and related steps, see this video:
|
||||
<br> <br>
|
||||
<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/KYVptkpsOqs" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe>
|
||||
|
||||
</br>
|
||||
|
||||
<iframe width="560" height="315" src="https://www.youtube.com/embed/KYVptkpsOqs" frameborder="0" allow="accelerometer; autoplay; encrypted-media" gyroscope; picture-in-picture" allowfullscreen></iframe>
|
||||
|
||||
|
||||
There are no additional hardware requirements to use Windows 10 Autopilot, beyond the [requirements to run Windows 10](https://www.microsoft.com/windows/windows-10-specifications).
|
||||
|
||||
|
||||
@ -334,7 +334,7 @@ A strong password is assigned to the KRBTGT and trust accounts automatically. Li
|
||||
|
||||
Resetting the password requires you either to be a member of the Domain Admins group, or to have been delegated with the appropriate authority. In addition, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority.
|
||||
|
||||
After you reset the KRBTGT password, ensure that event ID 6 in the (Kerberos) Key-Distribution-Center event source is written to the System event log.
|
||||
After you reset the KRBTGT password, ensure that event ID 9 in the (Kerberos) Key-Distribution-Center event source is written to the System event log.
|
||||
|
||||
### Security considerations
|
||||
|
||||
@ -480,7 +480,7 @@ Each default local account in Active Directory has a number of account settings
|
||||
<td><p>Use DES encryption types for this account</p></td>
|
||||
<td><p>Provides support for the Data Encryption Standard (DES). DES supports multiple levels of encryption, including Microsoft Point-to-Point Encryption (MPPE) Standard (40-bit and 56-bit), MPPE standard (56-bit), MPPE Strong (128-bit), Internet Protocol security (IPSec) DES (40-bit), IPSec 56-bit DES, and IPSec Triple DES (3DES).</p>
|
||||
<div class="alert">
|
||||
<strong>Note</strong><br/><p>DES is not enabled by default in Windows Server operating systems starting with Windows Server 2008 R2, nor in Windows client operating systems starting with Windows 7. For these operating systems, computers will not use DES-CBC-MD5 or DES-CBC-CRC cipher suites by default. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see <a href="http://blogs.technet.com/b/askds/archive/2010/10/19/hunting-down-des-in-order-to-securely-deploy-kerberos.aspx" data-raw-source="[Hunting down DES in order to securely deploy Kerberos](http://blogs.technet.com/b/askds/archive/2010/10/19/hunting-down-des-in-order-to-securely-deploy-kerberos.aspx)">Hunting down DES in order to securely deploy Kerberos</a>.</p>
|
||||
<strong>Note</strong><br/><p>DES is not enabled by default in Windows Server operating systems starting with Windows Server 2008 R2, nor in Windows client operating systems starting with Windows 7. For these operating systems, computers will not use DES-CBC-MD5 or DES-CBC-CRC cipher suites by default. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see <a href="https://blogs.technet.com/b/askds/archive/2010/10/19/hunting-down-des-in-order-to-securely-deploy-kerberos.aspx" data-raw-source="[Hunting down DES in order to securely deploy Kerberos](https://blogs.technet.com/b/askds/archive/2010/10/19/hunting-down-des-in-order-to-securely-deploy-kerberos.aspx)">Hunting down DES in order to securely deploy Kerberos</a>.</p>
|
||||
</div>
|
||||
<div>
|
||||
|
||||
|
||||
@ -78,9 +78,6 @@ Applications may cause performance issues when they attempt to hook the isolated
|
||||
|
||||
Services or protocols that rely on Kerberos, such as file shares, remote desktop, or BranchCache, continue to work and are not affected by Windows Defender Credential Guard.
|
||||
|
||||
See this video: [Credentials Protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474)
|
||||
|
||||
|
||||
## Security considerations
|
||||
|
||||
All computers that meet baseline protections for hardware, firmware, and software can use Windows Defender Credential Guard.
|
||||
|
||||
@ -30,8 +30,8 @@ Microsoft is committed to its vision of a <u>world without passwords.</u> We rec
|
||||
## Can I use Windows Hello for Business key trust and RDP?
|
||||
RDP currently does not support key based authentication and does not support self signed certificates. RDP with Windows Hello for Business is currently only supported with certificate based deployments.
|
||||
|
||||
## Can I deploy Windows Hello for Business using System Center Configuration Manager?
|
||||
Windows Hello for Business deployments using System Center Configuration Manager need to move to the hybrid deployment model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager will no longer be supported after November 2018.
|
||||
## Can I deploy Windows Hello for Business using Microsoft Endpoint Configuration Manager?
|
||||
Windows Hello for Business deployments using Configuration Manager need to move to the hybrid deployment model that uses Active Directory Federation Services. Deployments using Configuration Manager will no longer be supported after November 2018.
|
||||
|
||||
## How many users can enroll for Windows Hello for Business on a single Windows 10 computer?
|
||||
The maximum number of supported enrollments on a single Windows 10 computer is 10. That enables 10 users to each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available.
|
||||
|
||||
@ -162,7 +162,7 @@ Primarily for large enterprise organizations with more complex authentication re
|
||||
For more than a decade, many organizations have used the domain join to their on-premises Active Directory to enable:
|
||||
- IT departments to manage work-owned devices from a central location.
|
||||
- Users to sign in to their devices with their Active Directory work or school accounts.
|
||||
Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use System Center Configuration Manager (SCCM) or group policy (GP) to manage them.
|
||||
Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use Microsoft Endpoint Configuration Manager or group policy (GP) to manage them.
|
||||
|
||||
If your environment has an on-premises AD footprint and you also want benefit from the capabilities provided by Azure Active Directory, you can implement hybrid Azure AD joined devices. These are devices that are both, joined to your on-premises Active Directory and your Azure Active Directory.
|
||||
|
||||
|
||||
@ -55,6 +55,9 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e
|
||||
7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**.
|
||||
8. Close the console.
|
||||
|
||||
>[!NOTE]
|
||||
>Don't confuse the **Request hash** algorithm with the hash argorithm of the certificate.
|
||||
|
||||
#### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template
|
||||
|
||||
Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers--the domain controller certificate template. Later releases provided a new certificate template--the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the **KDC Authentication** extension.
|
||||
|
||||
@ -47,7 +47,7 @@ Microsoft information protection technologies include:
|
||||
## How WIP protects sensitivity labels with endpoint data loss prevention
|
||||
|
||||
You can create and manage [sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) in the Microsoft 365 compliance center.
|
||||
When you create a sensitivity label, you can specify that endpoint data loss prevention applies to content with that label.
|
||||
When you [create a sensitivity label](https://docs.microsoft.com/microsoft-365/compliance/create-sensitivity-labels), you can specify that endpoint data loss prevention applies to content with that label.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -101,11 +101,13 @@ Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](htt
|
||||
* **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log
|
||||
* **Disable (Default)** - The Controlled folder access feature will not work. All apps can make changes to files in protected folders.
|
||||
* **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization.
|
||||
* **Block disk modification only** - Attempts by untrusted apps to write to disk sectors will be logged in Windows Event log. These logs can be found in **Applications and Services Logs** > Microsoft > Windows > Windows Defender > Operational > ID 1123.
|
||||
* **Audit disk modification only** - Only attempts to write to protected disk sectors will be recorded in the Windows event log (under **Applications and Services Logs** > **Microsoft** > **Windows** > **Windows Defender** > **Operational** > **ID 1124**). Attempts to modify or delete files in protected folders will not be recorded.
|
||||
|
||||
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> To fully enable controlled folder access, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu.
|
||||
> To fully enable controlled folder access, you must set the Group Policy option to **Enabled** and select **Block** in the options drop-down menu.
|
||||
|
||||
## PowerShell
|
||||
|
||||
|
||||
@ -127,8 +127,8 @@ If you are looking for a pre-made simulation, you can use our ["Do It Yourself"
|
||||
|
||||
You can also use [Advanced hunting](advanced-hunting-query-language.md) to query data and [Threat analytics](threat-analytics.md) to view reports about emerging threats.
|
||||
|
||||
>[!NOTE]
|
||||
>The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections.
|
||||
> [!NOTE]
|
||||
> The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections.
|
||||
|
||||
1. Connect to your machine and run an attack simulation by selecting **Connect**.
|
||||
|
||||
@ -179,4 +179,3 @@ Your feedback helps us get better in protecting your environment from advanced a
|
||||
Let us know what you think, by selecting **Provide feedback**.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -119,11 +119,11 @@ The following commands are available for user roles that's been granted the abil
|
||||
Command | Description
|
||||
:---|:---
|
||||
analyze | Analyses the entity with various incrimination engines to reach a verdict.
|
||||
getfile | Gets a file from the machine. <br> NOTE: This command has a prerequisite command. You can use the `-auto` command in conjuction with `getfile` to automatically run the prerequisite command.
|
||||
getfile | Gets a file from the machine. <br> NOTE: This command has a prerequisite command. You can use the `-auto` command in conjunction with `getfile` to automatically run the prerequisite command.
|
||||
run | Runs a PowerShell script from the library on the machine.
|
||||
library | Lists files that were uploaded to the live response library.
|
||||
putfile | Puts a file from the library to the machine. Files are saved in a working folder and are deleted when the machine restarts by default.
|
||||
remediate | Remediates an entity on the machine. The remediation action will vary depending on the entity type:<br>- File: delete<br>- Process: stop, delete image file<br>- Service: stop, delete image file<br>- Registry entry: delete<br>- Scheduled task: remove<br>- Startup folder item: delete file <br> NOTE: This command has a prerequisite command. You can use the `-auto` command in conjuction with `remediate` to automatically run the prerequisite command.
|
||||
remediate | Remediates an entity on the machine. The remediation action will vary depending on the entity type:<br>- File: delete<br>- Process: stop, delete image file<br>- Service: stop, delete image file<br>- Registry entry: delete<br>- Scheduled task: remove<br>- Startup folder item: delete file <br> NOTE: This command has a prerequisite command. You can use the `-auto` command in conjunction with `remediate` to automatically run the prerequisite command.
|
||||
undo | Restores an entity that was remediated.
|
||||
|
||||
|
||||
|
||||
@ -80,6 +80,18 @@ Specify whether the antivirus engine runs in passive mode. Passive mode has the
|
||||
| **Possible values** | false (default) <br/> true |
|
||||
| **Comments** | Available in Microsoft Defender ATP version 100.67.60 or higher. |
|
||||
|
||||
#### Exclusion merge policy
|
||||
|
||||
Specify the merge policy for exclusions. This can be a combination of administrator-defined and user-defined exclusions (`merge`) or only administrator-defined exclusions (`admin_only`). This setting can be used to restrict local users from defining their own exclusions.
|
||||
|
||||
|||
|
||||
|:---|:---|
|
||||
| **Domain** | `com.microsoft.wdav` |
|
||||
| **Key** | exclusionsMergePolicy |
|
||||
| **Data type** | String |
|
||||
| **Possible values** | merge (default) <br/> admin_only |
|
||||
| **Comments** | Available in Microsoft Defender ATP version 100.83.73 or higher. |
|
||||
|
||||
#### Scan exclusions
|
||||
|
||||
Specify entities excluded from being scanned. Exclusions can be specified by full paths, extensions, or file names.
|
||||
@ -160,6 +172,18 @@ Specify threats by name that are not blocked by Microsoft Defender ATP for Mac.
|
||||
| **Key** | allowedThreats |
|
||||
| **Data type** | Array of strings |
|
||||
|
||||
#### Disallowed threat actions
|
||||
|
||||
Restricts the actions that the local user of a device can take when threats are detected. The actions included in this list are not displayed in the user interface.
|
||||
|
||||
|||
|
||||
|:---|:---|
|
||||
| **Domain** | `com.microsoft.wdav` |
|
||||
| **Key** | disallowedThreatActions |
|
||||
| **Data type** | Array of strings |
|
||||
| **Possible values** | allow (restricts users from allowing threats) <br/> restore (restricts users from restoring threats from the quarantine) |
|
||||
| **Comments** | Available in Microsoft Defender ATP version 100.83.73 or higher. |
|
||||
|
||||
#### Threat type settings
|
||||
|
||||
Specify how certain threat types are handled by Microsoft Defender ATP for Mac.
|
||||
@ -197,6 +221,18 @@ Specify what action to take when a threat of the type specified in the preceding
|
||||
| **Data type** | String |
|
||||
| **Possible values** | audit (default) <br/> block <br/> off |
|
||||
|
||||
#### Threat type settings merge policy
|
||||
|
||||
Specify the merge policy for threat type settings. This can be a combination of administrator-defined and user-defined settings (`merge`) or only administrator-defined settings (`admin_only`). This setting can be used to restrict local users from defining their own settings for different threat types.
|
||||
|
||||
|||
|
||||
|:---|:---|
|
||||
| **Domain** | `com.microsoft.wdav` |
|
||||
| **Key** | threatTypeSettingsMergePolicy |
|
||||
| **Data type** | String |
|
||||
| **Possible values** | merge (default) <br/> admin_only |
|
||||
| **Comments** | Available in Microsoft Defender ATP version 100.83.73 or higher. |
|
||||
|
||||
### Cloud-delivered protection preferences
|
||||
|
||||
Configure the cloud-driven protection features of Microsoft Defender ATP for Mac.
|
||||
@ -483,10 +519,17 @@ The following configuration profile contains entries for all settings described
|
||||
<string>pdf</string>
|
||||
</dict>
|
||||
</array>
|
||||
<key>exclusionsMergePolicy</key>
|
||||
<string>merge</string>
|
||||
<key>allowedThreats</key>
|
||||
<array>
|
||||
<string>EICAR-Test-File (not a virus)</string>
|
||||
</array>
|
||||
<key>disallowedThreatActions</key>
|
||||
<array>
|
||||
<string>allow</string>
|
||||
<string>restore</string>
|
||||
</array>
|
||||
<key>threatTypeSettings</key>
|
||||
<array>
|
||||
<dict>
|
||||
@ -502,6 +545,8 @@ The following configuration profile contains entries for all settings described
|
||||
<string>audit</string>
|
||||
</dict>
|
||||
</array>
|
||||
<key>threatTypeSettingsMergePolicy</key>
|
||||
<string>merge</string>
|
||||
</dict>
|
||||
<key>cloudService</key>
|
||||
<dict>
|
||||
@ -594,10 +639,17 @@ The following configuration profile contains entries for all settings described
|
||||
<string>pdf</string>
|
||||
</dict>
|
||||
</array>
|
||||
<key>exclusionsMergePolicy</key>
|
||||
<string>merge</string>
|
||||
<key>allowedThreats</key>
|
||||
<array>
|
||||
<string>EICAR-Test-File (not a virus)</string>
|
||||
</array>
|
||||
<key>disallowedThreatActions</key>
|
||||
<array>
|
||||
<string>allow</string>
|
||||
<string>restore</string>
|
||||
</array>
|
||||
<key>threatTypeSettings</key>
|
||||
<array>
|
||||
<dict>
|
||||
@ -613,6 +665,8 @@ The following configuration profile contains entries for all settings described
|
||||
<string>audit</string>
|
||||
</dict>
|
||||
</array>
|
||||
<key>threatTypeSettingsMergePolicy</key>
|
||||
<string>merge</string>
|
||||
</dict>
|
||||
<key>cloudService</key>
|
||||
<dict>
|
||||
|
||||
@ -19,6 +19,12 @@ ms.topic: conceptual
|
||||
|
||||
# What's new in Microsoft Defender Advanced Threat Protection for Mac
|
||||
|
||||
## 100.83.73
|
||||
|
||||
- Added more controls for IT administrators around [management of exclusions](mac-preferences.md#exclusion-merge-policy), [management of threat type settings](mac-preferences.md#threat-type-settings-merge-policy), and [disallowed threat actions](mac-preferences.md#disallowed-threat-actions)
|
||||
- When Full Disk Access is not enabled on the device, a warning is now displayed in the status menu
|
||||
- Performance improvements & bug fixes
|
||||
|
||||
## 100.82.60
|
||||
|
||||
- Addressed an issue where the product fails to start following a definition update.
|
||||
|
||||
@ -35,7 +35,7 @@ You can use the following operations to customize the list of automated investig
|
||||
|
||||
|
||||
**Triggering alert**</br>
|
||||
The alert the initiated the automated investigation.
|
||||
The alert that initiated the automated investigation.
|
||||
|
||||
**Status**</br>
|
||||
An automated investigation can be in one of the following status:
|
||||
|
||||
@ -41,7 +41,10 @@ The Security Compliance Toolkit consists of:
|
||||
- Windows Server 2012 R2
|
||||
|
||||
- Microsoft Office security baseline
|
||||
- Office365 ProPlus (Sept 2019)
|
||||
- Office 365 ProPlus (Sept 2019)
|
||||
|
||||
- Microsoft Edge security baseline
|
||||
- Version 79
|
||||
|
||||
- Tools
|
||||
- Policy Analyzer tool
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 04/19/2017
|
||||
# Network security: Configure encryption types allowed for Kerberos
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2
|
||||
|
||||
Describes the best practices, location, values and security considerations for the **Network security: Configure encryption types allowed for Kerberos** security policy setting.
|
||||
|
||||
@ -35,11 +35,11 @@ The following table lists and explains the allowed encryption types.
|
||||
|
||||
| Encryption type | Description and version support |
|
||||
| - | - |
|
||||
| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10 and Windows Server 2008 R2 operating systems do not support DES by default. |
|
||||
| DES_CBC_MD5| Data Encryption Standard with Cipher Block Chaining using the Message-Digest algorithm 5 checksum function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10 and Windows Server 2008 R2 operating systems do not support DES by default. |
|
||||
| RC4_HMAC_MD5| Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2.|
|
||||
| AES128_HMAC_SHA1| Advanced Encryption Standard in 128 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).<br/>Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2. |
|
||||
| AES256_HMAC_SHA1| Advanced Encryption Standard in 256 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).<br/>Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2. |
|
||||
| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10, Windows Server 2008 R2 and later operating systems do not support DES by default. |
|
||||
| DES_CBC_MD5| Data Encryption Standard with Cipher Block Chaining using the Message-Digest algorithm 5 checksum function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10, Windows Server 2008 R2 and later operating systems do not support DES by default. |
|
||||
| RC4_HMAC_MD5| Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 10, Windows Server 2008 R2, Windows Server 2012 and Windows Server 2012 R2.|
|
||||
| AES128_HMAC_SHA1| Advanced Encryption Standard in 128 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).<br/>Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10, Windows Server 2008 R2, Windows Server 2012 and Windows Server 2012 R2. |
|
||||
| AES256_HMAC_SHA1| Advanced Encryption Standard in 256 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).<br/>Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10, Windows Server 2008 R2, Windows Server 2012 and Windows Server 2012 R2. |
|
||||
| Future encryption types| Reserved by Microsoft for additional encryption types that might be implemented.|
|
||||
|
||||
### Possible values
|
||||
|
||||
@ -29,7 +29,7 @@ See [Configure device restriction settings in Microsoft Intune](https://docs.mic
|
||||
|
||||
<a id="ref1"></a>
|
||||
|
||||
## Use Configuration Manager to configure scanning options:
|
||||
## Use Microsoft Endpoint Configuration Manager to configure scanning options:
|
||||
|
||||
See [How to create and deploy antimalware policies: Scan settings](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#scan-settings) for details on configuring Microsoft Endpoint Configuration Manager (current branch).
|
||||
|
||||
|
||||
@ -266,7 +266,7 @@ This section lists the exclusions that are delivered automatically when you inst
|
||||
|
||||
- %windir%\Ntds\ntds.pat
|
||||
|
||||
- The AD DS transaction log files. The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files`
|
||||
- The AD DS transaction log files. The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files Path`
|
||||
|
||||
- %windir%\Ntds\EDB*.log
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Defender Antivirus VDI deployment guide
|
||||
description: Learn how to deploy Windows Defender Antivirus in a VDI environment for the best balance between protection and performance.
|
||||
title: Windows Defender Antivirus Virtual Desktop Infrastructure deployment guide
|
||||
description: Learn how to deploy Windows Defender Antivirus in a virtual desktop environment for the best balance between protection and performance.
|
||||
keywords: vdi, hyper-v, vm, virtual machine, windows defender, antivirus, av, virtual desktop, rds, remote desktop
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
@ -12,7 +12,7 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 09/03/2018
|
||||
ms.date: 01/31/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -25,13 +25,13 @@ manager: dansimp
|
||||
|
||||
In addition to standard on-premises or hardware configurations, you can also use Windows Defender Antivirus in a remote desktop (RDS) or virtual desktop infrastructure (VDI) environment.
|
||||
|
||||
See the [Microsoft Desktop virtualization site](https://www.microsoft.com/server-cloud/products/virtual-desktop-infrastructure/) for more details on Microsoft Remote Desktop Services and VDI support.
|
||||
See [Windows Virtual Desktop Documentation](https://docs.microsoft.com/azure/virtual-desktop) for more details on Microsoft Remote Desktop Services and VDI support.
|
||||
|
||||
For Azure-based virtual machines, you can also review the [Install Endpoint Protection in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-install-endpoint-protection) topic.
|
||||
|
||||
With the ability to easily deploy updates to VMs running in VDIs, we've shortened this guide to focus on how you can get updates on your machines quickly and easily. You no longer need to create and seal golden images on a periodic basis, as updates are expanded into their component bits on the host server and then downloaded directly to the VM when it's turned on.
|
||||
|
||||
This guide will show you how to configure your VMs for optimal protection and performance, including how to:
|
||||
This guide describes how to configure your VMs for optimal protection and performance, including how to:
|
||||
|
||||
- [Set up a dedicated VDI file share for security intelligence updates](#set-up-a-dedicated-vdi-file-share)
|
||||
- [Randomize scheduled scans](#randomize-scheduled-scans)
|
||||
@ -41,64 +41,93 @@ This guide will show you how to configure your VMs for optimal protection and pe
|
||||
- [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline)
|
||||
- [Apply exclusions](#exclusions)
|
||||
|
||||
You can also download the whitepaper [Windows Defender Antivirus on Virtual Desktop Infrastructure](https://demo.wd.microsoft.com/Content/wdav-testing-vdi-ssu.pdf) which looks at the new shared security intelligence update feature, alongside performance testing and guidance on how you can test antivirus performance on your own VDI.
|
||||
You can also download the whitepaper [Windows Defender Antivirus on Virtual Desktop Infrastructure](https://demo.wd.microsoft.com/Content/wdav-testing-vdi-ssu.pdf), which looks at the new shared security intelligence update feature, alongside performance testing and guidance on how you can test antivirus performance on your own VDI.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> While the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> There are performance and feature improvements to the way in which Windows Defender AV operates on virtual machines in Windows 10 Insider Preview, build 18323 (and later). We'll identify in this guide if you need to be using an Insider Preview build; if it isn't specified, then the minimum required version for the best protection and performance is Windows 10 1607.
|
||||
|
||||
|
||||
> Although the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows.<br/>There are performance and feature improvements to the way in which Windows Defender AV operates on virtual machines in Windows 10 Insider Preview, build 18323 (and later). We'll identify in this guide if you need to be using an Insider Preview build; if it isn't specified, then the minimum required version for the best protection and performance is Windows 10 1607.
|
||||
|
||||
### Set up a dedicated VDI file share
|
||||
|
||||
In Windows 10, version 1903, we introduced the shared security intelligence feature. This offloads the unpackaging of downloaded security intelligence updates onto a host machine - thus saving previous CPU, disk, and memory resources on individual machines.
|
||||
In Windows 10, version 1903, we introduced the shared security intelligence feature. This offloads the unpackaging of downloaded security intelligence updates onto a host machine - thus saving previous CPU, disk, and memory resources on individual machines. You can set this feature with [Intune](https://docs.microsoft.com/intune/fundamentals/what-is-intune), Group Policy, or PowerShell.
|
||||
|
||||
You can set this feature with Intune, Group Policy, or PowerShell.
|
||||
> [!TIP]
|
||||
> If you don't already have Intune, [try it for free](https://docs.microsoft.com/intune/fundamentals/free-trial-sign-up)!
|
||||
|
||||
Open the Intune management portal either by searching for Intune on https://portal.azure.com or going to https://devicemanagement.microsoft.com and logging in.
|
||||
Open the Intune Management Portal either by searching for Intune on [https://portal.azure.com](https://portal.azure.com) or going to [https://devicemanagement.microsoft.com](https://devicemanagement.microsoft.com) and logging in.
|
||||
|
||||
1. To create a group with only the devices or users you specify:
|
||||
1. Go to **Groups**. Click **New group**. Use the following values:
|
||||
1. Group type: **Security**
|
||||
2. Group name: **VDI test VMs**
|
||||
3. Group description: *Optional*
|
||||
4. Membership type: **Assigned**
|
||||
|
||||
1. Add the devices or users you want to be a part of this test and then click **Create** to save the group. It’s a good idea to create a couple of groups, one with VMs running the latest Insider Preview build and with the shared security intelligence update feature enabled, and another with VMs that are running Windows 10 1809 or earlier versions. This will help when you create dashboards to test the performance changes.
|
||||
#### To create a group with only the devices or users you specify
|
||||
|
||||
1. To create a group that will include any machine in your tenant that is a VM, even when they are newly created:
|
||||
1. Go to **Groups** > **New group**.
|
||||
|
||||
2. Specify the following values:
|
||||
- Group type: **Security**
|
||||
- Group name: **VDI test VMs**
|
||||
- Group description: *Optional*
|
||||
- Membership type: **Assigned**
|
||||
|
||||
3. Add the devices or users you want to be a part of this test and then click **Create** to save the group.
|
||||
|
||||
It’s a good idea to create a couple of groups, one with VMs running the latest Insider Preview build and with the shared security intelligence update feature enabled, and another with VMs that are running Windows 10 1809 or earlier versions. This will help when you create dashboards to test the performance changes.
|
||||
|
||||
#### To create a group that will include any machine in your tenant that is a VM, even when they are newly created
|
||||
|
||||
1. Go to **Groups** > **New group**.
|
||||
|
||||
2. Specify the following values:
|
||||
- Group type: **Security**
|
||||
- Group name: **VDI test VMs**
|
||||
- Group description: *Optional*
|
||||
- Membership type: **Dynamic Device**
|
||||
|
||||
3. Click **Simple rule**, and select **deviceModel**, **Equals**, and enter **Virtual Machine**.
|
||||
|
||||
4. Click **Add query** and then **Create** to save the group.
|
||||
|
||||
5. Go to **Device configuration**, then **Profiles**. You can modify an existing custom profile or create a new one.
|
||||
|
||||
#### Create a new device configuration profile
|
||||
|
||||
In this example, we create a new device configuration profile by clicking **Create profile**.
|
||||
|
||||
1. Go to **Groups**. Click **New group**. Use the following values:
|
||||
1. Group type: **Security**
|
||||
2. Group name: **VDI test VMs**
|
||||
3. Group description: *Optional*
|
||||
4. Membership type: **Dynamic Device**
|
||||
1. Click **Simple rule**, and select **deviceModel**, **Equals**, and enter **Virtual Machine**. Click **Add query** and then **Create** to save the group.
|
||||
1. Go to **Device configuration**, then **Profiles**. You can modify an existing custom profile or create a new one. In this demo I’m going to create a new one by clicking **Create profile**.
|
||||
1. Name it, choose **Windows 10 and later** as the Platform and – most importantly – select **Custom** as the profile type.
|
||||
1. The **Custom OMA-URI Settings** blade is opened automatically. Click **Add** then enter the following values:
|
||||
1. Name: **VDI shared sig location**
|
||||
1. Description: *Optional*
|
||||
1. OMA-URI: **./Vendor/MSFT/Defender/SharedSignatureRoot**
|
||||
1. Data type: **String**
|
||||
1. Value: **\\<sharedlocation\>\wdav-update\** (see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be)
|
||||
1. Click **Ok** to close the details blade, then **OK** again to close the **Custom OMA-URI Settings** blade. Click **Create** to save the new profile. The profile details page now appears.
|
||||
1. Click **Assignments**. The **Include** tab is automatically selected. In the drop-down menu, select **Selected Groups**, then click **Select groups to include**. Click the **VDI test VMs** group and then **Select**.
|
||||
1. Click **Evaluate** to see how many users/devices will be impacted. If the number makes sense, click **Save**. If the number doesn’t make sense, go back to the groups blade and confirm the group contains the right users or devices.
|
||||
1. The profile will now be deployed to the impacted devices. Note that this may take some time.
|
||||
|
||||
2. The **Custom OMA-URI Settings** blade is opened automatically. Click **Add** then enter the following values:
|
||||
- Name: **VDI shared sig location**
|
||||
- Description: *Optional*
|
||||
- OMA-URI: **./Vendor/MSFT/Defender/SharedSignatureRoot**
|
||||
- Data type: **String**
|
||||
- `\\<sharedlocation\>\wdav-update\` (see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be)
|
||||
|
||||
3. Click **Ok** to close the details blade, then **OK** again to close the **Custom OMA-URI Settings** blade.
|
||||
|
||||
4. Click **Create** to save the new profile. The profile details page now appears.
|
||||
|
||||
5. Click **Assignments**. The **Include** tab is automatically selected. In the drop-down menu, select **Selected Groups**, then click **Select groups to include**. Click the **VDI test VMs** group and then **Select**.
|
||||
|
||||
6. Click **Evaluate** to see how many users/devices will be impacted. If the number makes sense, click **Save**. If the number doesn’t make sense, go back to the groups blade and confirm the group contains the right users or devices.
|
||||
|
||||
The profile will now be deployed to the impacted devices. This may take some time.
|
||||
|
||||
#### Use Group Policy to enable the shared security intelligence feature:
|
||||
1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click Edit.
|
||||
1. In the **Group Policy Management Editor** go to **Computer configuration**.
|
||||
1. Click **Administrative templates**.
|
||||
1. Expand the tree to **Windows components > Windows Defender Antivirus > Security Intelligence Updates**
|
||||
1. Double-click Define security intelligence location for VDI clients and set the option to Enabled. A field automatically appears, enter *\\<sharedlocation\>\wdav-update *(see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be). Click **OK**.
|
||||
1. Deploy the GPO to the VMs you want to test.
|
||||
|
||||
#### Use PowerShell to enable the shared security intelligence feature:
|
||||
1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure, and then click **Edit**.
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration**.
|
||||
|
||||
3. Click **Administrative templates**.
|
||||
|
||||
4. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Security Intelligence Updates**.
|
||||
|
||||
5. Double-click **Define security intelligence location for VDI clients**, and then set the option to **Enabled**. A field automatically appears.
|
||||
|
||||
6. Enter `\\<sharedlocation\>\wdav-update` (see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be).
|
||||
|
||||
7. Click **OK**.
|
||||
|
||||
8. Deploy the GPO to the VMs you want to test.
|
||||
|
||||
#### Use PowerShell to enable the shared security intelligence feature
|
||||
|
||||
Use the following cmdlet to enable the feature. You’ll need to then push this as you normally would push PowerShell-based configuration policies onto the VMs:
|
||||
|
||||
```PowerShell
|
||||
@ -108,6 +137,7 @@ Set-MpPreference -SharedSignaturesPath \\<shared location>\wdav-update
|
||||
See the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what the \<shared location\> will be.
|
||||
|
||||
### Download and unpackage the latest updates
|
||||
|
||||
Now you can get started on downloading and installing new updates. We’ve created a sample PowerShell script for you below. This script is the easiest way to download new updates and get them ready for your VMs. You should then set the script to run at a certain time on the management machine by using a scheduled task (or, if you’re familiar with using PowerShell scripts in Azure, Intune, or SCCM, you could also use those).
|
||||
|
||||
```PowerShell
|
||||
@ -126,27 +156,39 @@ cmd /c "cd $vdmpath & c: & mpam-fe.exe /x"
|
||||
|
||||
You can set a scheduled task to run once a day so that whenever the package is downloaded and unpacked then the VMs will receive the new update.
|
||||
We suggest starting with once a day – but you should experiment with increasing or decreasing the frequency to understand the impact.
|
||||
Note that security intelligence packages are typically published once every three to four hours, so setting a frequency shorter than four hours isn’t advised as it will increase the network overhead on your management machine for no benefit.
|
||||
|
||||
Security intelligence packages are typically published once every three to four hours. Setting a frequency shorter than four hours isn’t advised because it will increase the network overhead on your management machine for no benefit.
|
||||
|
||||
#### Set a scheduled task to run the powershell script
|
||||
|
||||
1. On the management machine, open the Start menu and type **Task Scheduler**. Open it and select **Create task…** on the side panel.
|
||||
1. Enter the name as **Security intelligence unpacker**. Go to the **Trigger** tab. Click **New…** Select **Daily** and click **OK**.
|
||||
1. Go to the **Actions** tab. Click **New…** Enter **PowerShell** in the **Program/Script** field. Enter
|
||||
|
||||
*-ExecutionPolicy Bypass c:\wdav-update\vdmdlunpack.ps1*
|
||||
2. Enter the name as **Security intelligence unpacker**. Go to the **Trigger** tab. Click **New…** Select **Daily** and click **OK**.
|
||||
|
||||
in the **Add arguments** field. Click **OK**. You can choose to configure additional settings if you wish. Click OK to save the scheduled task.
|
||||
3. Go to the **Actions** tab. Click **New…** Enter **PowerShell** in the **Program/Script** field. Enter `-ExecutionPolicy Bypass c:\wdav-update\vdmdlunpack.ps1` in the **Add arguments** field. Click **OK**.
|
||||
|
||||
4. You can choose to configure additional settings if you wish.
|
||||
|
||||
5. Click **OK** to save the scheduled task.
|
||||
|
||||
|
||||
You can initiate the update manually by right-clicking on the task and clicking **Run**.
|
||||
|
||||
#### Download and unpackage manually
|
||||
|
||||
If you would prefer to do everything manually, this what you would need to do to replicate the script’s behavior:
|
||||
1. Create a new folder on the system root called *wdav_update* to store intelligence updates, for example, create the folder *c:\wdav_update*
|
||||
1. Create a subfolder under *wdav_update* with a GUID name, such as *{00000000-0000-0000-0000-000000000000}*; for example *c:\wdav_update\{00000000-0000-0000-0000-000000000000}* (note, in the script we set it so the last 12 digits of the GUID are the year, month, day, and time when the file was downloaded so that a new folder is created each time. You can change this so that the file is downloaded to the same folder each time)
|
||||
1. Download a security intelligence package from https://www.microsoft.com/wdsi/definitions into the GUID folder. The file should be named *mpam-fe.exe*.
|
||||
1. Open a cmd prompt window and navigate to the GUID folder you created. Use the **/X** extraction command to extract the files, for example **mpam-fe.exe /X**.
|
||||
Note: The VMs will pick up the updated package whenever a new GUID folder is created with an extracted update package or whenever an existing folder is updated with a new extracted package.
|
||||
|
||||
1. Create a new folder on the system root called `wdav_update` to store intelligence updates, for example, create the folder `c:\wdav_update`.
|
||||
|
||||
2. Create a subfolder under *wdav_update* with a GUID name, such as `{00000000-0000-0000-0000-000000000000}`; for example `c:\wdav_update\{00000000-0000-0000-0000-000000000000}`.
|
||||
|
||||
Note: In the script we set it so the last 12 digits of the GUID are the year, month, day, and time when the file was downloaded so that a new folder is created each time. You can change this so that the file is downloaded to the same folder each time.
|
||||
|
||||
3. Download a security intelligence package from [https://www.microsoft.com/wdsi/definitions](https://www.microsoft.com/wdsi/definitions) into the GUID folder. The file should be named `mpam-fe.exe`.
|
||||
|
||||
4. Open a cmd prompt window and navigate to the GUID folder you created. Use the **/X** extraction command to extract the files, for example `mpam-fe.exe /X`.
|
||||
|
||||
Note: The VMs will pick up the updated package whenever a new GUID folder is created with an extracted update package or whenever an existing folder is updated with a new extracted package.
|
||||
|
||||
### Randomize scheduled scans
|
||||
|
||||
@ -161,17 +203,23 @@ See [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) for
|
||||
You can specify the type of scan that should be performed during a scheduled scan.
|
||||
Quick scans are the preferred approach as they are designed to look in all places where malware needs to reside to be active.
|
||||
|
||||
1. Expand the tree to **Windows components > Windows Defender > Scan** and configure the following setting:
|
||||
1. Expand the tree to **Windows components > Windows Defender > Scan**.
|
||||
|
||||
- Double-click **Specify the scan type to use for a scheduled scan** and set the option to **Enabled** and **Quick scan**. Click **OK**.
|
||||
2. Double-click **Specify the scan type to use for a scheduled scan** and set the option to **Enabled** and **Quick scan**.
|
||||
|
||||
3. Click **OK**.
|
||||
|
||||
### Prevent notifications
|
||||
|
||||
Sometimes, Windows Defender Antivirus notifications may be sent to or persist across multiple sessions. In order to minimize this problem, you can use the lock down the Windows Defender Antivirus user interface.
|
||||
|
||||
1. Expand the tree to **Windows components > Windows Defender > Client Interface** and configure the following settings:
|
||||
1. Expand the tree to **Windows components > Windows Defender > Client Interface**.
|
||||
|
||||
- Double-click **Suppress all notifications** and set the option to **Enabled**. Click **OK**. This prevents notifications from Windows Defender AV appearing in the action center on Windows 10 when scans or remediation is performed.
|
||||
2. Double-click **Suppress all notifications** and set the option to **Enabled**.
|
||||
|
||||
3. Click **OK**.
|
||||
|
||||
This prevents notifications from Windows Defender AV appearing in the action center on Windows 10 when scans or remediation is performed.
|
||||
|
||||
### Disable scans after an update
|
||||
|
||||
@ -180,25 +228,36 @@ This setting will prevent a scan from occurring after receiving an update. You c
|
||||
> [!IMPORTANT]
|
||||
> Running scans after an update will help ensure your VMs are protected with the latest Security intelligence updates. Disabling this option will reduce the protection level of your VMs and should only be used when first creating or deploying the base image.
|
||||
|
||||
1. Expand the tree to **Windows components > Windows Defender > Signature Updates** and configure the following setting:
|
||||
1. Expand the tree to **Windows components > Windows Defender > Signature Updates**.
|
||||
|
||||
- Double-click **Turn on scan after signature update** and set the option to **Disabled**. Click **OK**. This prevents a scan from running immediately after an update.
|
||||
2. Double-click **Turn on scan after signature update** and set the option to **Disabled**.
|
||||
|
||||
3. Click **OK**.
|
||||
|
||||
This prevents a scan from running immediately after an update.
|
||||
|
||||
### Scan VMs that have been offline
|
||||
|
||||
1. Expand the tree to **Windows components > Windows Defender > Scan** and configure the following setting:
|
||||
1. Expand the tree to **Windows components > Windows Defender > Scan**.
|
||||
|
||||
1. Double-click the **Turn on catch-up quick scan** setting and set the option to **Enabled**. Click **OK**. This forces a scan if the VM has missed two or more consecutive scheduled scans.
|
||||
2. Double-click the **Turn on catch-up quick scan** setting and set the option to **Enabled**.
|
||||
|
||||
3. Click **OK**.
|
||||
|
||||
This forces a scan if the VM has missed two or more consecutive scheduled scans.
|
||||
|
||||
|
||||
### Enable headless UI mode
|
||||
- Double-click **Enable headless UI mode** and set the option to **Enabled**. Click **OK**. This hides the entire Windows Defender AV user interface from users.
|
||||
|
||||
1. Double-click **Enable headless UI mode** and set the option to **Enabled**.
|
||||
|
||||
2. Click **OK**.
|
||||
|
||||
This hides the entire Windows Defender AV user interface from users.
|
||||
|
||||
### Exclusions
|
||||
On Windows Server 2016, Windows Defender Antivirus will automatically deliver the right exclusions for servers running a VDI environment. However, if you are running an older Windows server version, you can refer to the exclusions that are applied on this page:
|
||||
- [Configure Windows Defender Antivirus exclusions on Windows Server](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus)
|
||||
|
||||
On Windows Server 2016, Windows Defender Antivirus will automatically deliver the right exclusions for servers running a VDI environment. However, if you are running an older Windows server version, see [Configure Windows Defender Antivirus exclusions on Windows Server](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus).
|
||||
|
||||
|
||||
## Additional resources
|
||||
|
||||
@ -121,7 +121,7 @@ Here's what you see in the Windows Security app:
|
||||
|
||||
If you are using Windows OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), or [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019), you won't see **Tamper Protection** in the Windows Security app. In this case, you can use PowerShell to determine whether tamper protection is enabled.
|
||||
|
||||
#### Use PowerShell to determine whether tamper protection is turned
|
||||
#### Use PowerShell to determine whether tamper protection is turned on
|
||||
|
||||
1. Open the Windows PowerShell app.
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Why you should use Windows Defender Antivirus together with Microsoft Defender Advanced Threat Protection
|
||||
description: For best results, use Windows Defender Antivirus together with your other Microsoft offerings.
|
||||
keywords: windows defender, antivirus
|
||||
keywords: windows defender, antivirus, third party av
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
|
||||
@ -32,7 +32,8 @@ Refer to the below video for an overview and brief demo.
|
||||
|
||||
## Policy Authorization Process
|
||||
|
||||
The general steps for expanding the S mode base policy on your devices are to generate a supplemental policy, sign that policy, and then upload the signed policy to Intune and assign it to user or device groups.
|
||||
The general steps for expanding the S mode base policy on your Intune-managed devices are to generate a supplemental policy, sign that policy, and then upload the signed policy to Intune and assign it to user or device groups. Because you need access to WDAC PowerShell cmdlets to generate your supplemental policy, you should create and manage your policies on a non-S mode device. Once the policy has been uploaded to Intune, we recommend assigning it to a single test S-mode device to verify expected functioning before deploying the policy more broadly.
|
||||
|
||||
1. Generate a supplemental policy with WDAC tooling
|
||||
|
||||
This policy will expand the S mode base policy to authorize additional applications. Anything authorized by either the S mode base policy or your supplemental policy will be allowed to run. Your supplemental policies can specify filepath rules, trusted publishers, and more.
|
||||
@ -60,7 +61,7 @@ The general steps for expanding the S mode base policy on your devices are to ge
|
||||
- Since you'll be signing your policy, you must authorize the signing certificate you will use to sign the policy and optionally one or more additional signers that can be used to sign updates to the policy in the future. For more information, refer to Section 2, Sign policy. Use Add-SignerRule to add the signing certificate to the WDAC policy:
|
||||
|
||||
```powershell
|
||||
Add-SignerRule -FilePath <policypath> -CertificatePath <certpath> -User -Update`
|
||||
Add-SignerRule -FilePath <policypath> -CertificatePath <certpath> -User -Update
|
||||
```
|
||||
- Convert to .bin using [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy?view=win10-ps)
|
||||
|
||||
@ -70,7 +71,7 @@ The general steps for expanding the S mode base policy on your devices are to ge
|
||||
|
||||
2. Sign policy
|
||||
|
||||
Supplemental S mode policies must be digitally signed. To sign your policy, you can choose to use the Device Guard Signing Service or your organization's custom Public Key Infrastructure (PKI). Refer to [Use the Device Guard Signing Portal in the Microsoft Store for Business](use-device-guard-signing-portal-in-microsoft-store-for-business.md) for guidance on using DGSS and [Create a code signing cert for WDAC](create-code-signing-cert-for-windows-defender-application-control.md) for guidance on signing using an internal CA.
|
||||
Supplemental S mode policies must be digitally signed. To sign your policy, you can choose to use the Device Guard Signing Service (DGSS) or your organization's custom Public Key Infrastructure (PKI). Refer to [Use the Device Guard Signing Portal in the Microsoft Store for Business](use-device-guard-signing-portal-in-microsoft-store-for-business.md) for guidance on using DGSS and [Create a code signing cert for WDAC](create-code-signing-cert-for-windows-defender-application-control.md) for guidance on signing using an internal CA.
|
||||
|
||||
Rename your policy to "{PolicyID}.p7b" after you've signed it. PolicyID can be found by inspecting the Supplemental Policy XML.
|
||||
|
||||
@ -91,7 +92,7 @@ Your supplemental policy can be used to significantly relax the S mode base poli
|
||||
|
||||
Instead of authorizing signers external to your organization, Intune has added new functionality to make it easier to authorize existing applications (without requiring repackaging or access to the source code) through the use of signed catalogs. This works for apps which may be unsigned or even signed apps when you don’t want to trust all apps that may share the same signing certificate.
|
||||
|
||||
The basic process is to generate a catalog file for each app using Package Inspector, then sign the catalog files using the DGSS or a custom PKI. After that, IT Pros can use the standard Intune app deployment process outlined above. Refer to [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md) for more in-depth guidance on generating catalogs.
|
||||
The basic process is to generate a catalog file for each app using Package Inspector, then sign the catalog files using the DGSS or a custom PKI. Use the Add-SignerRule PowerShell cmdlet as shown above to authorize the catalog signing certificate in the supplemental policy. After that, IT Pros can use the standard Intune app deployment process outlined above. Refer to [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md) for more in-depth guidance on generating catalogs.
|
||||
|
||||
> [!Note]
|
||||
> Every time an app updates, you will need to deploy an updated catalog. Because of this, IT Pros should try to avoid using catalog files for applications that auto-update and direct users not to update applications on their own.
|
||||
@ -180,8 +181,11 @@ Below is a sample policy that allows kernel debuggers, PowerShell ISE, and Regis
|
||||
</SiPolicy>
|
||||
```
|
||||
## Policy removal
|
||||
In order to revert users to an unmodified S mode policy, an IT Pro can remove a user or users from the targeted Intune group which received the policy, which will trigger a removal of both the policy and the authorization token from the device.
|
||||
|
||||
IT Pros also have the choice of deleting a supplemental policy through Intune.
|
||||
> [!Note]
|
||||
> This feature currently has a known a policy deletion bug, with a fix expected in the 2D update in late February 2020. Devices of users who are unenrolled will still have their WDAC policies removed. In the mentime, IT Pros are recommended to update their policy with the below 'empty' policy which makes no changes to S mode.
|
||||
> This feature currently has a known bug which occurs when an S mode supplemental policy is deleted through Intune, in which the policy is not immediately removed from the devices to which it was deployed. A fix is expected in the 2D update in late February 2020. In the meantime, IT Pros are recommended to update their policy with the below 'empty' policy which makes no changes to S mode.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
@ -233,3 +237,6 @@ Below is a sample policy that allows kernel debuggers, PowerShell ISE, and Regis
|
||||
</Settings>
|
||||
</SiPolicy>
|
||||
```
|
||||
|
||||
## Errata
|
||||
If an S-mode device with a policy authorization token and supplemental policy is rolled back from the 1909 update to the 1903 build, it will not revert to locked-down S mode until the next policy refresh. To achieve an immediate change to a locked-down S mode state, IT Pros should delete any tokens in %SystemRoot%\System32\CI\Tokens\Active.
|
||||
|
||||
@ -160,9 +160,8 @@ Pick the correct version of each .dll for the Windows release you plan to suppor
|
||||
<Deny ID="ID_DENY_MS_BUILD" FriendlyName="Microsoft.Build.dll" FileName="Microsoft.Build.dll" MinimumFileVersion="65535.65535.65535.65535" />
|
||||
<Deny ID="ID_DENY_MS_BUILD_FMWK" FriendlyName="Microsoft.Build.Framework.dll" FileName="Microsoft.Build.Framework.dll" MinimumFileVersion="65535.65535.65535.65535" />
|
||||
|
||||
<!-- msxml3.dll pick correct version based on release you are supporting -->
|
||||
<!-- msxml6.dll pick correct version based on release you are supporting -->
|
||||
<!-- jscript9.dll pick correct version based on release you are supporting -->
|
||||
<!-- pick the correct version of msxml3.dll, msxml6.dll, and jscript9.dll based on the release you are supporting -->
|
||||
<!-- the versions of these files in the 1903 release have this issue fixed, so they don’t need to be blocked -->
|
||||
<!-- RS1 Windows 1607
|
||||
<Deny ID="ID_DENY_MSXML3" FriendlyName="msxml3.dll" FileName="msxml3.dll" MinimumFileVersion ="8.110.14393.2550"/>
|
||||
<Deny ID="ID_DENY_MSXML6" FriendlyName="msxml6.dll" FileName="msxml6.dll" MinimumFileVersion ="6.30.14393.2550"/>
|
||||
@ -893,7 +892,7 @@ Pick the correct version of each .dll for the Windows release you plan to suppor
|
||||
<FileRuleRef RuleID="ID_DENY_WMIC"/>
|
||||
<FileRuleRef RuleID="ID_DENY_MWFC" />
|
||||
<FileRuleRef RuleID="ID_DENY_WFC" />
|
||||
<!-- Uncomment the relevant line(s) below if you have uncommented them in the rule definitions above.
|
||||
<!-- uncomment the relevant line(s) below if you have uncommented them in the rule definitions above
|
||||
<FileRuleRef RuleID="ID_DENY_MSXML3" />
|
||||
<FileRuleRef RuleID="ID_DENY_MSXML6" />
|
||||
<FileRuleRef RuleID="ID_DENY_JSCRIPT9" />
|
||||
|
||||
@ -67,7 +67,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru
|
||||
| **15 Enabled:Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.|
|
||||
| **16 Enabled:Update Policy No Reboot** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. |
|
||||
| **17 Enabled:Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. |
|
||||
| **18 Disabled:Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for the path specified in the FilePathRule parameter of the New-CIPolicyRule cmdlet. |
|
||||
| **18 Disabled:Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. |
|
||||
| **19 Enabled:Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. |
|
||||
|
||||
## Windows Defender Application Control file rule levels
|
||||
@ -83,11 +83,6 @@ Each file rule level has its benefit and disadvantage. Use Table 2 to select the
|
||||
| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. |
|
||||
| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. |
|
||||
| **FilePath** | Beginning with Windows 10 version 1903, this specifies rules that allow execution of binaries contained under specific file path locations. Additional information about FilePath level rules can be found below. |
|
||||
> [!NOTE]
|
||||
> Due to an existing bug, you can not combine Path-based ALLOW rules with any DENY rules in a single policy. Instead, either separate DENY rules into a separate Base policy or move the Path-based ALLOW rules into a supplemental policy as described in [Deploy multiple WDAC policies.](deploy-multiple-windows-defender-application-control-policies.md)
|
||||
|
||||
| Rule level | Description |
|
||||
|----------- | ----------- |
|
||||
| **SignedVersion** | This combines the publisher rule with a version number. This option allows anything from the specified publisher, with a version at or above the specified version number, to run. |
|
||||
| **Publisher** | This is a combination of the PcaCertificate level (typically one certificate below the root) and the common name (CN) of the leaf certificate. This rule level allows organizations to trust a certificate from a major CA (such as Symantec), but only if the leaf certificate is from a specific company (such as Intel, for device drivers). |
|
||||
| **FilePublisher** | This is a combination of the “FileName” attribute of the signed file, plus “Publisher” (PCA certificate with CN of leaf), plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. |
|
||||
@ -101,6 +96,9 @@ Each file rule level has its benefit and disadvantage. Use Table 2 to select the
|
||||
> [!NOTE]
|
||||
> When you create WDAC policies with [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy), you can specify a primary file rule level by including the **-Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **-Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate.
|
||||
|
||||
> [!NOTE]
|
||||
> WDAC only supports signer rules for RSA certificate signing keys with a maximum of 4096 bits.
|
||||
|
||||
## Example of file rule levels in use
|
||||
|
||||
For example, consider some IT professionals in a department that runs many servers. They decide they want their servers to run only software signed by the providers of their software and drivers, that is, the companies that provide their hardware, operating system, antivirus, and other important software. They know that their servers also run an internally written application that is unsigned but is rarely updated. They want to allow this application to run.
|
||||
|
||||
Reference in New Issue
Block a user