From 2a212f8430688d63d3d85159e1e20bc7ae901a8f Mon Sep 17 00:00:00 2001 From: Benny Shilpa Date: Tue, 17 Nov 2020 15:29:38 +0530 Subject: [PATCH] Update quarantine.md --- .../threat-protection/windows-firewall/quarantine.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/quarantine.md b/windows/security/threat-protection/windows-firewall/quarantine.md index ec93d0c0a9..3c2c94f178 100644 --- a/windows/security/threat-protection/windows-firewall/quarantine.md +++ b/windows/security/threat-protection/windows-firewall/quarantine.md @@ -1,5 +1,5 @@ --- -title: "Quarantine" +title: Quarantine Behavior description: Quarantine behavior is explained in detail. ms.author: v-bshilpa author: Benny-54 @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 11/17/2020 --- -# Quarantine +# Quarantine Behavior One of the security challenges that network admins face is configuring a machine properly after a network change. @@ -197,7 +197,7 @@ Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /s Sample Drop Audit with `filterOrigin` as `Quarantine Default`. -![Quarantine Default](images/quarantine-default-audit.png) +![Quarantine Default](images/quarantine-default1.png) Once the drop’s filter origin has been identified as the Quarantine Default Inbound Block filter, the interface should be further investigated. To find the relevant interface, use the `InterfaceIndex` value from the `netEvent` or event audit in the following PowerShell command to generate more information about the interface: