From c4140d26a493ad614bf9b6bb1e96ed70d2fb594d Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 27 Nov 2018 11:25:10 -0800 Subject: [PATCH 01/61] Manually added 6 policies to StorageSense --- .../mdm/policy-csp-storage.md | 409 ++++++++++++++++++ 1 file changed, 409 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 7858f38c0e..11fe31821c 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -231,5 +231,414 @@ Footnote: - 4 - Added in Windows 10, version 1803. - 5 - Added in the next major release of Windows 10. + +**Storage/AllowStorageSenseGlobal** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Storage Sense can automatically clean some of the user’s files to free up disk space. By default, Storage Sense is automatically turned on when the machine runs into low disk space and is set to run whenever the machine runs into storage pressure. This cadence can be changed in Storage settings or set with the "Configure Storage Sense cadence" group policy. + +Enabled: +Storage Sense is turned on for the machine, with the default cadence as ‘during low free disk space’. Users cannot disable Storage Sense, but they can adjust the cadence (unless you also configure the "Configure Storage Sense cadence" group policy). + +Disabled: +Storage Sense is turned off the machine. Users cannot enable Storage Sense. + +Not Configured: +By default, Storage Sense is turned off until the user runs into low disk space or the user enables it manually. Users can configure this setting in Storage settings. + + +ADMX Info: +- GP English name: *Allow Storage Sense* +- GP name: *SS_AllowStorageSenseGlobal* +- GP path: *SOFTWARE/Policies/Microsoft/Windows/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + + +**Storage/ConfigStorageSenseGlobalCadence** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Storage Sense can automatically clean some of the user’s files to free up disk space. +If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. + +Enabled: +You must provide the desired Storage Sense cadence. Supported options are: + +1 – Daily +7 – Weekly +30 – Monthly +0 – During Low Free Disk Space + +The default is 0 (during low free disk space). + +Not Configured: +By default, the Storage Sense cadence is set to “during low free disk space”. Users can configure this setting in Storage settings. + + + +ADMX Info: +- GP English name: *Configure Storage Sense cadence* +- GP name: *RemovableDisks_DenyWrite_Access_2* +- GP path: *SOFTWARE/Policies/Microsoft/Windows/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + + +**Storage/AllowStorageSenseTemporaryFilesCleanup** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +When Storage Sense runs, it can delete the user’s temporary files that are not in use. + +If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. + +Enabled: +Storage Sense will delete the user’s temporary files that are not in use. Users cannot disable this setting in Storage settings. + +Disabled: +Storage Sense will not delete the user’s temporary files. Users cannot enable this setting in Storage settings. + +Not Configured: +By default, Storage Sense will delete the user’s temporary files. Users can configure this setting in Storage settings. + + + +ADMX Info: +- GP English name: *Allow Storage Sense Temporary Files cleanup* +- GP name: *SS_AllowStorageSenseTemporaryFilesCleanup* +- GP path: *System/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + + +**Storage/ConfigStorageSenseRecycleBinCleanupThreshold** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +When Storage Sense runs, it can delete files in the user’s Recycle Bin if they have been there for over a certain amount of days. + +If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. + +Enabled: +You must provide the minimum age threshold (in days) of a file in the Recycle Bin before Storage Sense will delete it. Support values are: 0 - 365. +If you set this value to zero, Storage Sense will not delete files in the user’s Recycle Bin. The default is 30 days. + +Disabled or Not Configured: +By default, Storage Sense will delete files in the user’s Recycle Bin that have been there for over 30 days. Users can configure this setting in Storage settings. + + + +ADMX Info: +- GP English name: *Configure Storage Sense Recycle Bin cleanup threshold* +- GP name: *SS_ConfigStorageSenseRecycleBinCleanupThreshold* +- GP path: *System/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + + +**Storage/ConfigStorageSenseDownloadsCleanupThreshold** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +When Storage Sense runs, it can delete files in the user’s Downloads folder if they have been there for over a certain amount of days. + +If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. + +Enabled: +You must provide the minimum age threshold (in days) of a file in the Downloads folder before Storage Sense will delete it. Support values are: 0 - 365. +If you set this value to zero, Storage Sense will not delete files in the user’s Downloads folder. The default is 0, or never deleting files in the Downloads folder. + +Disabled or Not Configured: +By default, Storage Sense will not delete files in the user’s Downloads folder. Users can configure this setting in Storage settings. + + + +ADMX Info: +- GP English name: *Configure Storage Storage Downloads cleanup threshold* +- GP name: *SS_ConfigStorageSenseDownloadsCleanupThreshold* +- GP path: *System/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + + +**Storage/ConfigStorageSenseCloudContentDehydrationThreshold** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +When Storage Sense runs, it can dehydrate cloud-backed content that hasn’t been opened in a certain amount of days. + +If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. + +Enabled: +You must provide the number of days since a cloud-backed file has been opened before Storage Sense will dehydrate it. Support values are: 0 - 365. +If you set this value to zero, Storage Sense will not dehydrate any cloud-backed content. The default value is 0, or never dehydrating cloud-backed content. + +Disabled or Not Configured: +By default, Storage Sense will not dehydrate any cloud-backed content. Users can configure this setting in Storage settings. + + + +ADMX Info: +- GP English name: *Configure Storage Sense Cloud Content dehydration threshold* +- GP name: *SS_ConfigStorageSenseCloudContentDehydrationThreshold* +- GP path: *System/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + + From 489846a772d0a27f5c24f675045cb2ea9020455b Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 28 Nov 2018 15:33:27 -0800 Subject: [PATCH 02/61] Alphabetized new storage policies, fixed table superscripts. updated footnote --- .../mdm/policy-csp-storage.md | 843 +++++++++--------- 1 file changed, 428 insertions(+), 415 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 11fe31821c..8ffeade8a2 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -73,8 +73,6 @@ ms.date: 08/27/2018 Added in Windows 10, version 1709. Allows disk health model updates. - - Value type is integer. @@ -97,6 +95,429 @@ The following list shows the supported values:
+ +**Storage/AllowStorageSenseGlobal** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark6check mark6check mark6check mark6
+ + + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Storage Sense can automatically clean some of the user’s files to free up disk space. By default, Storage Sense is automatically turned on when the machine runs into low disk space and is set to run whenever the machine runs into storage pressure. This cadence can be changed in Storage settings or set with the "Configure Storage Sense cadence" group policy. + +Enabled: +Storage Sense is turned on for the machine, with the default cadence as ‘during low free disk space’. Users cannot disable Storage Sense, but they can adjust the cadence (unless you also configure the "Configure Storage Sense cadence" group policy). + +Disabled: +Storage Sense is turned off the machine. Users cannot enable Storage Sense. + +Not Configured: +By default, Storage Sense is turned off until the user runs into low disk space or the user enables it manually. Users can configure this setting in Storage settings. + + +ADMX Info: +- GP English name: *Allow Storage Sense* +- GP name: *SS_AllowStorageSenseGlobal* +- GP path: *SOFTWARE/Policies/Microsoft/Windows/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + +
+ + +**Storage/AllowStorageSenseTemporaryFilesCleanup** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +When Storage Sense runs, it can delete the user’s temporary files that are not in use. + +If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. + +Enabled: +Storage Sense will delete the user’s temporary files that are not in use. Users cannot disable this setting in Storage settings. + +Disabled: +Storage Sense will not delete the user’s temporary files. Users cannot enable this setting in Storage settings. + +Not Configured: +By default, Storage Sense will delete the user’s temporary files. Users can configure this setting in Storage settings. + + + +ADMX Info: +- GP English name: *Allow Storage Sense Temporary Files cleanup* +- GP name: *SS_AllowStorageSenseTemporaryFilesCleanup* +- GP path: *System/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + +
+ + +**Storage/ConfigStorageSenseCloudContentDehydrationThreshold** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +When Storage Sense runs, it can dehydrate cloud-backed content that hasn’t been opened in a certain amount of days. + +If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. + +Enabled: +You must provide the number of days since a cloud-backed file has been opened before Storage Sense will dehydrate it. Support values are: 0 - 365. +If you set this value to zero, Storage Sense will not dehydrate any cloud-backed content. The default value is 0, or never dehydrating cloud-backed content. + +Disabled or Not Configured: +By default, Storage Sense will not dehydrate any cloud-backed content. Users can configure this setting in Storage settings. + + + +ADMX Info: +- GP English name: *Configure Storage Sense Cloud Content dehydration threshold* +- GP name: *SS_ConfigStorageSenseCloudContentDehydrationThreshold* +- GP path: *System/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + +
+ + + +**Storage/ConfigStorageSenseDownloadsCleanupThreshold** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +When Storage Sense runs, it can delete files in the user’s Downloads folder if they have been there for over a certain amount of days. + +If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. + +Enabled: +You must provide the minimum age threshold (in days) of a file in the Downloads folder before Storage Sense will delete it. Support values are: 0 - 365. +If you set this value to zero, Storage Sense will not delete files in the user’s Downloads folder. The default is 0, or never deleting files in the Downloads folder. + +Disabled or Not Configured: +By default, Storage Sense will not delete files in the user’s Downloads folder. Users can configure this setting in Storage settings. + + + +ADMX Info: +- GP English name: *Configure Storage Storage Downloads cleanup threshold* +- GP name: *SS_ConfigStorageSenseDownloadsCleanupThreshold* +- GP path: *System/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + +
+ + +**Storage/ConfigStorageSenseGlobalCadence** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Storage Sense can automatically clean some of the user’s files to free up disk space. +If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. + +Enabled: +You must provide the desired Storage Sense cadence. Supported options are: + +- 1 – Daily +- 7 – Weekly +- 30 – Monthly +- 0 – During Low Free Disk Space + +The default is 0 (during low free disk space). + +Not Configured: +By default, the Storage Sense cadence is set to “during low free disk space”. Users can configure this setting in Storage settings. + + + +ADMX Info: +- GP English name: *Configure Storage Sense cadence* +- GP name: *RemovableDisks_DenyWrite_Access_2* +- GP path: *SOFTWARE/Policies/Microsoft/Windows/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + +
+ + +**Storage/ConfigStorageSenseRecycleBinCleanupThreshold** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +When Storage Sense runs, it can delete files in the user’s Recycle Bin if they have been there for over a certain amount of days. + +If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. + +Enabled: +You must provide the minimum age threshold (in days) of a file in the Recycle Bin before Storage Sense will delete it. Support values are: 0 - 365. +If you set this value to zero, Storage Sense will not delete files in the user’s Recycle Bin. The default is 30 days. + +Disabled or Not Configured: +By default, Storage Sense will delete files in the user’s Recycle Bin that have been there for over 30 days. Users can configure this setting in Storage settings. + + + +ADMX Info: +- GP English name: *Configure Storage Sense Recycle Bin cleanup threshold* +- GP name: *SS_ConfigStorageSenseRecycleBinCleanupThreshold* +- GP path: *System/StorageSense* +- GP ADMX file name: *StorageSense.admx* + + + + + + + + + + + + + +
+ **Storage/EnhancedStorageDevices** @@ -221,6 +642,9 @@ ADMX Info: + + +
Footnote: @@ -229,416 +653,5 @@ Footnote: - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. -- 5 - Added in the next major release of Windows 10. - - -**Storage/AllowStorageSenseGlobal** - - - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
- - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Storage Sense can automatically clean some of the user’s files to free up disk space. By default, Storage Sense is automatically turned on when the machine runs into low disk space and is set to run whenever the machine runs into storage pressure. This cadence can be changed in Storage settings or set with the "Configure Storage Sense cadence" group policy. - -Enabled: -Storage Sense is turned on for the machine, with the default cadence as ‘during low free disk space’. Users cannot disable Storage Sense, but they can adjust the cadence (unless you also configure the "Configure Storage Sense cadence" group policy). - -Disabled: -Storage Sense is turned off the machine. Users cannot enable Storage Sense. - -Not Configured: -By default, Storage Sense is turned off until the user runs into low disk space or the user enables it manually. Users can configure this setting in Storage settings. - - -ADMX Info: -- GP English name: *Allow Storage Sense* -- GP name: *SS_AllowStorageSenseGlobal* -- GP path: *SOFTWARE/Policies/Microsoft/Windows/StorageSense* -- GP ADMX file name: *StorageSense.admx* - - - - - - - - - - - - - - -**Storage/ConfigStorageSenseGlobalCadence** - - - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
- - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Storage Sense can automatically clean some of the user’s files to free up disk space. -If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. - -Enabled: -You must provide the desired Storage Sense cadence. Supported options are: - -1 – Daily -7 – Weekly -30 – Monthly -0 – During Low Free Disk Space - -The default is 0 (during low free disk space). - -Not Configured: -By default, the Storage Sense cadence is set to “during low free disk space”. Users can configure this setting in Storage settings. - - - -ADMX Info: -- GP English name: *Configure Storage Sense cadence* -- GP name: *RemovableDisks_DenyWrite_Access_2* -- GP path: *SOFTWARE/Policies/Microsoft/Windows/StorageSense* -- GP ADMX file name: *StorageSense.admx* - - - - - - - - - - - - - - -**Storage/AllowStorageSenseTemporaryFilesCleanup** - - - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
- - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -When Storage Sense runs, it can delete the user’s temporary files that are not in use. - -If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. - -Enabled: -Storage Sense will delete the user’s temporary files that are not in use. Users cannot disable this setting in Storage settings. - -Disabled: -Storage Sense will not delete the user’s temporary files. Users cannot enable this setting in Storage settings. - -Not Configured: -By default, Storage Sense will delete the user’s temporary files. Users can configure this setting in Storage settings. - - - -ADMX Info: -- GP English name: *Allow Storage Sense Temporary Files cleanup* -- GP name: *SS_AllowStorageSenseTemporaryFilesCleanup* -- GP path: *System/StorageSense* -- GP ADMX file name: *StorageSense.admx* - - - - - - - - - - - - - - -**Storage/ConfigStorageSenseRecycleBinCleanupThreshold** - - - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
- - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -When Storage Sense runs, it can delete files in the user’s Recycle Bin if they have been there for over a certain amount of days. - -If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. - -Enabled: -You must provide the minimum age threshold (in days) of a file in the Recycle Bin before Storage Sense will delete it. Support values are: 0 - 365. -If you set this value to zero, Storage Sense will not delete files in the user’s Recycle Bin. The default is 30 days. - -Disabled or Not Configured: -By default, Storage Sense will delete files in the user’s Recycle Bin that have been there for over 30 days. Users can configure this setting in Storage settings. - - - -ADMX Info: -- GP English name: *Configure Storage Sense Recycle Bin cleanup threshold* -- GP name: *SS_ConfigStorageSenseRecycleBinCleanupThreshold* -- GP path: *System/StorageSense* -- GP ADMX file name: *StorageSense.admx* - - - - - - - - - - - - - - -**Storage/ConfigStorageSenseDownloadsCleanupThreshold** - - - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
- - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -When Storage Sense runs, it can delete files in the user’s Downloads folder if they have been there for over a certain amount of days. - -If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. - -Enabled: -You must provide the minimum age threshold (in days) of a file in the Downloads folder before Storage Sense will delete it. Support values are: 0 - 365. -If you set this value to zero, Storage Sense will not delete files in the user’s Downloads folder. The default is 0, or never deleting files in the Downloads folder. - -Disabled or Not Configured: -By default, Storage Sense will not delete files in the user’s Downloads folder. Users can configure this setting in Storage settings. - - - -ADMX Info: -- GP English name: *Configure Storage Storage Downloads cleanup threshold* -- GP name: *SS_ConfigStorageSenseDownloadsCleanupThreshold* -- GP path: *System/StorageSense* -- GP ADMX file name: *StorageSense.admx* - - - - - - - - - - - - - - -**Storage/ConfigStorageSenseCloudContentDehydrationThreshold** - - - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5
- - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -When Storage Sense runs, it can dehydrate cloud-backed content that hasn’t been opened in a certain amount of days. - -If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. - -Enabled: -You must provide the number of days since a cloud-backed file has been opened before Storage Sense will dehydrate it. Support values are: 0 - 365. -If you set this value to zero, Storage Sense will not dehydrate any cloud-backed content. The default value is 0, or never dehydrating cloud-backed content. - -Disabled or Not Configured: -By default, Storage Sense will not dehydrate any cloud-backed content. Users can configure this setting in Storage settings. - - - -ADMX Info: -- GP English name: *Configure Storage Sense Cloud Content dehydration threshold* -- GP name: *SS_ConfigStorageSenseCloudContentDehydrationThreshold* -- GP path: *System/StorageSense* -- GP ADMX file name: *StorageSense.admx* - - - - - - - - - - - - - - - - +- 5 - Added in Windows 10, version 1809. +- 6 - Added in the next major release of Windows 10. \ No newline at end of file From 2a5aff589bb3dfc9dc0d7fc12e346c6e49fd8164 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 28 Nov 2018 16:05:43 -0800 Subject: [PATCH 03/61] Editorial changes for consistency --- .../mdm/policy-csp-storage.md | 45 ++++++++----------- 1 file changed, 18 insertions(+), 27 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 8ffeade8a2..1012c99490 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -135,11 +135,9 @@ The following list shows the supported values: Storage Sense can automatically clean some of the user’s files to free up disk space. By default, Storage Sense is automatically turned on when the machine runs into low disk space and is set to run whenever the machine runs into storage pressure. This cadence can be changed in Storage settings or set with the "Configure Storage Sense cadence" group policy. -Enabled: -Storage Sense is turned on for the machine, with the default cadence as ‘during low free disk space’. Users cannot disable Storage Sense, but they can adjust the cadence (unless you also configure the "Configure Storage Sense cadence" group policy). +If you enable this policy setting, Storage Sense is turned on for the machine, with the default cadence as ‘during low free disk space’. Users cannot disable Storage Sense, but they can adjust the cadence (unless you also configure the "Configure Storage Sense cadence" group policy). -Disabled: -Storage Sense is turned off the machine. Users cannot enable Storage Sense. +If you disable this policy setting, Storage Sense is turned off the machine. Users cannot enable Storage Sense. Not Configured: By default, Storage Sense is turned off until the user runs into low disk space or the user enables it manually. Users can configure this setting in Storage settings. @@ -205,14 +203,11 @@ When Storage Sense runs, it can delete the user’s temporary files that are not If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. -Enabled: -Storage Sense will delete the user’s temporary files that are not in use. Users cannot disable this setting in Storage settings. +If you enable this policy setting, Storage Sense will delete the user’s temporary files that are not in use. Users cannot disable this setting in Storage settings. -Disabled: -Storage Sense will not delete the user’s temporary files. Users cannot enable this setting in Storage settings. +If you disable this policy setting, Storage Sense will not delete the user’s temporary files. Users cannot enable this setting in Storage settings. -Not Configured: -By default, Storage Sense will delete the user’s temporary files. Users can configure this setting in Storage settings. +If you do not configure this policy setting, Storage Sense will delete the user’s temporary files by default. Users can configure this setting in Storage settings. @@ -276,12 +271,11 @@ When Storage Sense runs, it can dehydrate cloud-backed content that hasn’t bee If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. -Enabled: -You must provide the number of days since a cloud-backed file has been opened before Storage Sense will dehydrate it. Support values are: 0 - 365. -If you set this value to zero, Storage Sense will not dehydrate any cloud-backed content. The default value is 0, or never dehydrating cloud-backed content. +If you enable this policy setting, you must provide the number of days since a cloud-backed file has been opened before Storage Sense will dehydrate it. Supported values are: 0–365. -Disabled or Not Configured: -By default, Storage Sense will not dehydrate any cloud-backed content. Users can configure this setting in Storage settings. +If you set this value to zero, Storage Sense will not dehydrate any cloud-backed content. The default value is 0, which never dehydrates cloud-backed content. + +If you disable or do not configure this policy setting, then Storage Sense will not dehydrate any cloud-backed content by default. Users can configure this setting in Storage settings. @@ -346,12 +340,11 @@ When Storage Sense runs, it can delete files in the user’s Downloads folder if If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. -Enabled: -You must provide the minimum age threshold (in days) of a file in the Downloads folder before Storage Sense will delete it. Support values are: 0 - 365. +If you enable this policy setting, you must provide the minimum age threshold (in days) of a file in the Downloads folder before Storage Sense will delete it. Support values are: 0 - 365. + If you set this value to zero, Storage Sense will not delete files in the user’s Downloads folder. The default is 0, or never deleting files in the Downloads folder. -Disabled or Not Configured: -By default, Storage Sense will not delete files in the user’s Downloads folder. Users can configure this setting in Storage settings. +If you disable or do not configure this policy setting, then Storage Sense will not delete files in the user’s Downloads folder by default. Users can configure this setting in Storage settings. @@ -414,8 +407,9 @@ ADMX Info: Storage Sense can automatically clean some of the user’s files to free up disk space. If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. -Enabled: -You must provide the desired Storage Sense cadence. Supported options are: +If you enable this policy setting, you must provide the desired Storage Sense cadence. + +The following are supported options: - 1 – Daily - 7 – Weekly @@ -424,8 +418,7 @@ You must provide the desired Storage Sense cadence. Supported options are: The default is 0 (during low free disk space). -Not Configured: -By default, the Storage Sense cadence is set to “during low free disk space”. Users can configure this setting in Storage settings. +If you do not configure this policy setting, then the Storage Sense cadence is set to “during low free disk space” by default. Users can configure this setting in Storage settings. @@ -489,12 +482,10 @@ When Storage Sense runs, it can delete files in the user’s Recycle Bin if they If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. -Enabled: -You must provide the minimum age threshold (in days) of a file in the Recycle Bin before Storage Sense will delete it. Support values are: 0 - 365. +If you enable this policy setting, you must provide the minimum age threshold (in days) of a file in the Recycle Bin before Storage Sense will delete it. Support values are: 0 - 365. If you set this value to zero, Storage Sense will not delete files in the user’s Recycle Bin. The default is 30 days. -Disabled or Not Configured: -By default, Storage Sense will delete files in the user’s Recycle Bin that have been there for over 30 days. Users can configure this setting in Storage settings. +If you disable or do not configure this policy setting, Storage Sense will delete files in the user’s Recycle Bin that have been there for over 30 days by default. Users can configure this setting in Storage settings. From d2b70c68eefd4f2d49c2c14d42c6faa0d9c57d12 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 28 Nov 2018 16:10:44 -0800 Subject: [PATCH 04/61] Editorial change --- windows/client-management/mdm/policy-csp-storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 1012c99490..6385b07697 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -414,7 +414,7 @@ The following are supported options: - 1 – Daily - 7 – Weekly - 30 – Monthly -- 0 – During Low Free Disk Space +- 0 – During low free disk space The default is 0 (during low free disk space). From 04b445a170217545a5cca25aa819fc82fe015ba9 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 5 Dec 2018 16:05:44 -0800 Subject: [PATCH 05/61] Started making Angelica's edits --- windows/client-management/mdm/policy-csp-storage.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 6385b07697..34ab29a9c6 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -137,7 +137,7 @@ Storage Sense can automatically clean some of the user’s files to free up disk If you enable this policy setting, Storage Sense is turned on for the machine, with the default cadence as ‘during low free disk space’. Users cannot disable Storage Sense, but they can adjust the cadence (unless you also configure the "Configure Storage Sense cadence" group policy). -If you disable this policy setting, Storage Sense is turned off the machine. Users cannot enable Storage Sense. +If you disable this policy setting, the machine will turn off Storage Sense. Users cannot enable Storage Sense. Not Configured: By default, Storage Sense is turned off until the user runs into low disk space or the user enables it manually. Users can configure this setting in Storage settings. @@ -201,7 +201,7 @@ ADMX Info: When Storage Sense runs, it can delete the user’s temporary files that are not in use. -If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. +If the Storage/AllowStorageSenseGlobal policy is disabled, then this policy does not have any effect. If you enable this policy setting, Storage Sense will delete the user’s temporary files that are not in use. Users cannot disable this setting in Storage settings. From 40e44df8e51541d606c7a6cfe8b775c47233d15a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 10 Dec 2018 14:22:54 -0800 Subject: [PATCH 06/61] add steps to go to asc to onboard servers --- ...ts-windows-defender-advanced-threat-protection.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md index 32cc18106d..5a5b8f85c8 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security author: mjcaparas ms.localizationpriority: medium -ms.date: 11/02/2018 +ms.date: 12/10/2018 --- # Onboard servers to the Windows Defender ATP service @@ -41,14 +41,14 @@ For a practical guidance on what needs to be in place for licensing and infrastr ## Windows Server 2012 R2 and Windows Server 2016 -To onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP, you’ll need to: +To onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP, you’ll need to take the following steps: - For Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients. >[!NOTE] >This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2. -- Turn on server monitoring from Windows Defender Security Center. +- Go to Azure Security Center to onboard servers (recommended) or turn on server monitoring from Windows Defender Security Center. For more information on how to onboard servers in Azure Security Center - If you're already leveraging System Center Operations Manager (SCOM) or Operations Management Suite (OMS), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through [Multi Homing support](https://blogs.technet.microsoft.com/msoms/2016/05/26/oms-log-analytics-agent-multi-homing-support/). Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below. >[!TIP] @@ -64,6 +64,12 @@ The following steps are required to enable this integration: - Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie) - Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting +### Onboard servers through Azure Security Center (recommended) +1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. + +2. Select Windows server 2012, 2012R2 and 2016 as the operating system. + +3. Click **Go to Azure Security Center to onboard servers**. ### Turn on Server monitoring from the Windows Defender Security Center portal From d0558198ac74ca3566bd0f292ffa356a4b915bb8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 14 Dec 2018 13:26:46 -0800 Subject: [PATCH 07/61] update date --- ...ndpoints-sccm-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index 707a5887a8..7780c8b9eb 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: medium -ms.date: 04/24/2018 +ms.date: 12/11/2018 --- # Onboard Windows 10 machines using System Center Configuration Manager From 480067379af03cd7a3c7e26de64c4e69c4f2aec8 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 17 Dec 2018 11:13:04 -0800 Subject: [PATCH 08/61] Edited as per Angelica and Jesse's instructions. --- .../mdm/policy-csp-storage.md | 35 +++++++++++++------ 1 file changed, 25 insertions(+), 10 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 34ab29a9c6..52a90d0d51 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -24,6 +24,21 @@ ms.date: 08/27/2018
Storage/AllowDiskHealthModelUpdates
+
+ Storage/AllowStorageSenseGlobal +
+
+ Storage/AllowStorageSenseTemporaryFilesCleanup +
+
+ Storage/ConfigStorageSenseCloudContentDehydrationThreshold +
+
+ Storage/ConfigStorageSenseGlobalCadence +
+
+ Storage/ConfigStorageSenseRecycleBinCleanupThreshold +
Storage/EnhancedStorageDevices
@@ -133,14 +148,13 @@ The following list shows the supported values: -Storage Sense can automatically clean some of the user’s files to free up disk space. By default, Storage Sense is automatically turned on when the machine runs into low disk space and is set to run whenever the machine runs into storage pressure. This cadence can be changed in Storage settings or set with the "Configure Storage Sense cadence" group policy. +Storage Sense can automatically clean some of the user’s files to free up disk space. By default, Storage Sense is automatically turned on when the machine runs into low disk space and is set to run whenever the machine runs into storage pressure. This cadence can be changed in Storage settings or set with the Storage/ConfigStorageSenseGlobalCadence group policy. -If you enable this policy setting, Storage Sense is turned on for the machine, with the default cadence as ‘during low free disk space’. Users cannot disable Storage Sense, but they can adjust the cadence (unless you also configure the "Configure Storage Sense cadence" group policy). +If you enable this policy setting without setting a cadence, Storage Sense is turned on for the machine with the default cadence of "during low free disk space." Users cannot disable Storage Sense, but they can adjust the cadence (unless you also configure the Storage/ConfigStorageSenseGlobalCadence group policy). If you disable this policy setting, the machine will turn off Storage Sense. Users cannot enable Storage Sense. -Not Configured: -By default, Storage Sense is turned off until the user runs into low disk space or the user enables it manually. Users can configure this setting in Storage settings. +If you do not configure this policy setting, Storage Sense is turned off by default until the user runs into low disk space or the user enables it manually. Users can configure this setting in Storage settings. ADMX Info: @@ -269,7 +283,7 @@ ADMX Info: When Storage Sense runs, it can dehydrate cloud-backed content that hasn’t been opened in a certain amount of days. -If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. +If the Storage/AllowStorageSenseGlobal policy is disabled, then this policy does not have any effect. If you enable this policy setting, you must provide the number of days since a cloud-backed file has been opened before Storage Sense will dehydrate it. Supported values are: 0–365. @@ -338,9 +352,9 @@ ADMX Info: When Storage Sense runs, it can delete files in the user’s Downloads folder if they have been there for over a certain amount of days. -If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. +If the Storage/AllowStorageSenseGlobal policy is disabled, then this policy does not have any effect. -If you enable this policy setting, you must provide the minimum age threshold (in days) of a file in the Downloads folder before Storage Sense will delete it. Support values are: 0 - 365. +If you enable this policy setting, you must provide the minimum age threshold (in days) of a file in the Downloads folder before Storage Sense will delete it. Supported values are: 0–365. If you set this value to zero, Storage Sense will not delete files in the user’s Downloads folder. The default is 0, or never deleting files in the Downloads folder. @@ -405,7 +419,7 @@ ADMX Info: Storage Sense can automatically clean some of the user’s files to free up disk space. -If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. +If the Storage/AllowStorageSenseGlobal policy is disabled, then this policy does not have any effect. If you enable this policy setting, you must provide the desired Storage Sense cadence. @@ -480,9 +494,10 @@ ADMX Info: When Storage Sense runs, it can delete files in the user’s Recycle Bin if they have been there for over a certain amount of days. -If the group policy "Allow Storage Sense" is disabled, then this policy does not have any effect. +If the Storage/AllowStorageSenseGlobal policy is disabled, then this policy does not have any effect. + +If you enable this policy setting, you must provide the minimum age threshold (in days) of a file in the Recycle Bin before Storage Sense will delete it. Supported values are: 0–365. -If you enable this policy setting, you must provide the minimum age threshold (in days) of a file in the Recycle Bin before Storage Sense will delete it. Support values are: 0 - 365. If you set this value to zero, Storage Sense will not delete files in the user’s Recycle Bin. The default is 30 days. If you disable or do not configure this policy setting, Storage Sense will delete files in the user’s Recycle Bin that have been there for over 30 days by default. Users can configure this setting in Storage settings. From 55de32ffd23465a4110d0364f98714efe23b4cc6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 17 Dec 2018 16:07:13 -0800 Subject: [PATCH 09/61] add options in --- ...ows-defender-advanced-threat-protection.md | 24 +++++++++++++------ 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md index 5a5b8f85c8..14151cc1cc 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md @@ -41,7 +41,23 @@ For a practical guidance on what needs to be in place for licensing and infrastr ## Windows Server 2012 R2 and Windows Server 2016 -To onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP, you’ll need to take the following steps: +There are two options to onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP: +- **Option 1**: Onboard through Azure Security Center (recommended) +- **Option 2** Onboard through Windows Defender Security Center + + +### Option 1: Onboard servers through Azure Security Center (recommended) +1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. + +2. Select Windows server 2012, 2012R2 and 2016 as the operating system. + +3. Click **Go to Azure Security Center to onboard servers**. + +4. Follow the onboarding steps in Azure Security Center. + + +### Option 2: Onboard servers through Windows Defender Security Center +You'll need to take the following steps if you opt to onboard servers through Windows Defender Security Center. - For Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients. @@ -64,12 +80,6 @@ The following steps are required to enable this integration: - Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie) - Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting -### Onboard servers through Azure Security Center (recommended) -1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. - -2. Select Windows server 2012, 2012R2 and 2016 as the operating system. - -3. Click **Go to Azure Security Center to onboard servers**. ### Turn on Server monitoring from the Windows Defender Security Center portal From a7b9ec6f3fd1011f90f0d7f7b7b2f28428b05b35 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 17 Dec 2018 16:19:55 -0800 Subject: [PATCH 10/61] remove 2012 --- ...ver-endpoints-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md index 54976ad8b9..d0d4e81ca1 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md @@ -69,7 +69,7 @@ The following steps are required to enable this integration: 1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. -2. Select Windows server 2012, 2012R2 and 2016 as the operating system. +2. Select **Windows server 2012R2 and 2016** as the operating system. 3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent. From 4c761809ca190af054bdf8d638f7a087129009f9 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 17 Dec 2018 16:21:51 -0800 Subject: [PATCH 11/61] update date --- ...ver-endpoints-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md index d0d4e81ca1..006fad4ca9 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security author: mjcaparas ms.localizationpriority: medium -ms.date: 12/14/2018 +ms.date: 12/17/2018 --- # Onboard servers to the Windows Defender ATP service From b0a89df225f8ae70f0ba2b3cbc0d456d06c46310 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 17 Dec 2018 16:38:07 -0800 Subject: [PATCH 12/61] add options back in --- ...ows-defender-advanced-threat-protection.md | 21 +++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md index 006fad4ca9..54ba5609cf 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md @@ -41,7 +41,23 @@ For a practical guidance on what needs to be in place for licensing and infrastr ## Windows Server 2012 R2 and Windows Server 2016 -To onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP, you’ll need to: +There are two options to onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP: +- **Option 1**: Onboard through Azure Security Center (recommended) +- **Option 2** Onboard through Windows Defender Security Center + + +### Option 1: Onboard servers through Azure Security Center (recommended) +1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. + +2. Select **Windows server 2012R2 and 2016** as the operating system. + +3. Click **Go to Azure Security Center to onboard servers**. + +4. Follow the onboarding steps in Azure Security Center. + + +### Option 2: Onboard servers through Windows Defender Security Center +You'll need to take the following steps if you opt to onboard servers through Windows Defender Security Center. - For Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients. @@ -71,7 +87,8 @@ The following steps are required to enable this integration: 2. Select **Windows server 2012R2 and 2016** as the operating system. -3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent. +3. Select **Onboard Servers through Windows Defender ATP**. +4. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent. ### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP From 3174d25d39077507e2190a0c8f5726aba153ada1 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 17 Dec 2018 16:44:51 -0800 Subject: [PATCH 13/61] typo --- ...ints-windows-defender-advanced-threat-protection.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md index 54ba5609cf..bf5a390ced 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md @@ -43,7 +43,7 @@ For a practical guidance on what needs to be in place for licensing and infrastr There are two options to onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP: - **Option 1**: Onboard through Azure Security Center (recommended) -- **Option 2** Onboard through Windows Defender Security Center +- **Option 2**: Onboard through Windows Defender Security Center ### Option 1: Onboard servers through Azure Security Center (recommended) @@ -70,7 +70,7 @@ You'll need to take the following steps if you opt to onboard servers through Wi >[!TIP] > After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md). -### Configure and update System Center Endpoint Protection clients +#### Configure and update System Center Endpoint Protection clients >[!IMPORTANT] >This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2. @@ -81,7 +81,7 @@ The following steps are required to enable this integration: - Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting -### Turn on Server monitoring from the Windows Defender Security Center portal +#### Turn on Server monitoring from the Windows Defender Security Center portal 1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. @@ -91,7 +91,7 @@ The following steps are required to enable this integration: 4. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent. -### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP +#### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP 1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603). @@ -105,7 +105,7 @@ The following steps are required to enable this integration: Once completed, you should see onboarded servers in the portal within an hour. -### Configure server proxy and Internet connectivity settings +#### Configure server proxy and Internet connectivity settings - Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the [OMS Gateway](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway). - If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service: From 266de78a4c6aea338d10780b6b1c0ffa753b824e Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Mon, 7 Jan 2019 17:00:40 -0800 Subject: [PATCH 14/61] adding content --- .../whats-new-in-windows-defender-atp.md | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md diff --git a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md new file mode 100644 index 0000000000..d1384522d6 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md @@ -0,0 +1,45 @@ +--- +title: What's new in Windows Defender ATP +description: Lists the new features and functionality in Windows Defender ATP +keywords: what's new in windows defender atp +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +ms.date: 01/07/2019 +--- + +# What's new in Windows Defender ATP +**Applies to:** +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Here are the new features in the latest release of Windows Defender ATP. + +## Windows Defender ATP 1809 +- [Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics)
+Threat Analytics is a set of interactive reports published by the Windows Defender ATP research team as soon as emerging threats and outbreaks are identified. The reports help security operations teams assess impact on their environment and provides recommended actions to contain, increase organizational resilience, and prevent specific threats. + +- [Custom detection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-custom-detections)
+With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats. This can be done by leveraging the power of Advanced hunting through the creation of custom detection rules. +- [Managed security service provider (MSSP) support](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection)
+Windows Defender ATP adds support for this scenario by providing MSSP integration. The integration will allow MSSPs to take the following actions: Get access to MSSP customer's Windows Defender Security Center portal, fetch email notifications, and fetch alerts through security information and event management (SIEM) tools. +- [Integration with Azure Security Center](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection#integration-with-azure-security-center)
+Windows Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Windows Defender ATP to provide improved threat detection for Windows Servers. +- [Integration with Microsoft Cloud App Security](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration)
+Microsoft Cloud App Security leverages Windows Defender ATP endpoint signals to allow direct visibility into cloud application usage including the use of unsupported cloud services (shadow IT) from all Windows Defender ATP monitored machines. +- [Onboard Windows Server 2019](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection#windows-server-version-1803-and-windows-server-2019)
+Windows Defender ATP now adds support for Windows Server 2019. You'll be able to onboard Windows Server 2019 in the same method available for Windows 10 client machines. +- [Onboard previous versions of Windows](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection)
+Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor +## Windows Defender ATP 1803 +- [Advanced Hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)
+Query data using Advanced hunting in Windows Defender ATP +- [Automated investigation](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)
Use Automated investigations to investigate and remediate threats +- [Conditional access](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection)
+Enable conditional access to better protect users, devices, and data + From 592a8e26d9ed6a466b03aa6f9bfa1c1a5f67b2a9 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 8 Jan 2019 01:10:13 +0000 Subject: [PATCH 15/61] adding link to what's new --- windows/security/threat-protection/windows-defender-atp/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 5e93dae32c..6939cb2a2a 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -98,6 +98,7 @@ ## [Get started](get-started.md) +### [What's new in Windows Defender ATP](whats-new-in-windows-defender-atp.md) ### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) ### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) ### [Preview features](preview-windows-defender-advanced-threat-protection.md) From 7570341191aa5be047f472af2f727d58af972a81 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 9 Jan 2019 21:14:32 +0000 Subject: [PATCH 16/61] Updated whats-new-in-windows-defender-atp.md --- .../whats-new-in-windows-defender-atp.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md index d1384522d6..362f3dba61 100644 --- a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md +++ b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md @@ -35,7 +35,10 @@ Microsoft Cloud App Security leverages Windows Defender ATP endpoint signals to - [Onboard Windows Server 2019](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection#windows-server-version-1803-and-windows-server-2019)
Windows Defender ATP now adds support for Windows Server 2019. You'll be able to onboard Windows Server 2019 in the same method available for Windows 10 client machines. - [Onboard previous versions of Windows](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection)
-Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor +Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor. +- [Removeable device control](https://docs.microsoft.com/windows/security/threat-protection/device-control/control-usb-devices-using-intune)
+Windows Defender ATP provides multiple monitoring and control features to help prevent threats from removeable devices. + ## Windows Defender ATP 1803 - [Advanced Hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)
Query data using Advanced hunting in Windows Defender ATP From 86c1081c22ef7ea0ac244d01f01412aa52f1d039 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 9 Jan 2019 23:32:46 +0000 Subject: [PATCH 17/61] Updated whats-new-in-windows-defender-atp.md --- .../windows-defender-atp/whats-new-in-windows-defender-atp.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md index 362f3dba61..a5babe0b40 100644 --- a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md +++ b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md @@ -36,8 +36,8 @@ Microsoft Cloud App Security leverages Windows Defender ATP endpoint signals to Windows Defender ATP now adds support for Windows Server 2019. You'll be able to onboard Windows Server 2019 in the same method available for Windows 10 client machines. - [Onboard previous versions of Windows](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection)
Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor. -- [Removeable device control](https://docs.microsoft.com/windows/security/threat-protection/device-control/control-usb-devices-using-intune)
-Windows Defender ATP provides multiple monitoring and control features to help prevent threats from removeable devices. +- [Removeable device control](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/19/windows-defender-atp-has-protections-for-usb-and-removable-devices/)
+Windows Defender ATP provides multiple monitoring and control features to help prevent threats from removeable devices, including new settings to allow or block specific hardware IDs. ## Windows Defender ATP 1803 - [Advanced Hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)
From e712b8158787ab4b85ae977a30d4e977dd2221c7 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 10 Jan 2019 22:03:57 +0000 Subject: [PATCH 18/61] Updated whats-new-in-windows-defender-atp.md Update --- .../whats-new-in-windows-defender-atp.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md index a5babe0b40..d780a41025 100644 --- a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md +++ b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md @@ -21,6 +21,18 @@ ms.date: 01/07/2019 Here are the new features in the latest release of Windows Defender ATP. ## Windows Defender ATP 1809 +- [Controlled folder access]() +Controlled folder access is now supported on Windows Server 2019. + +- Attack surface reduction rules +Attack surface reduction rules are now supported on Windows Server 2019. There are two new attack surface reduction rules: + - Block Adobe Reader from creating child processes + - Block Office communication application from creating child processes. + +- Windows Defender Antivirus +Windows Defender Antivirus can now run within a sandbox, increasing its security. You can also configure CPU priority settings for Windows Defender Antivirus scans. Windows Defender Antivirus can now scan macros and other scripts at runtime to check for malicious behavior. For more information, see Office VBA + AMSI: Parting the veil on malicious macros. + + - [Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics)
Threat Analytics is a set of interactive reports published by the Windows Defender ATP research team as soon as emerging threats and outbreaks are identified. The reports help security operations teams assess impact on their environment and provides recommended actions to contain, increase organizational resilience, and prevent specific threats. From 90e5db4d00c85be606608e9f640fd81b6dd7a3cf Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 10 Jan 2019 22:29:02 +0000 Subject: [PATCH 19/61] Updated whats-new-in-windows-defender-atp.md --- .../whats-new-in-windows-defender-atp.md | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md index d780a41025..baea741def 100644 --- a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md +++ b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md @@ -21,16 +21,16 @@ ms.date: 01/07/2019 Here are the new features in the latest release of Windows Defender ATP. ## Windows Defender ATP 1809 -- [Controlled folder access]() +- [Controlled folder access](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard) Controlled folder access is now supported on Windows Server 2019. -- Attack surface reduction rules +- [Attack surface reduction rules](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard) Attack surface reduction rules are now supported on Windows Server 2019. There are two new attack surface reduction rules: - Block Adobe Reader from creating child processes - Block Office communication application from creating child processes. -- Windows Defender Antivirus -Windows Defender Antivirus can now run within a sandbox, increasing its security. You can also configure CPU priority settings for Windows Defender Antivirus scans. Windows Defender Antivirus can now scan macros and other scripts at runtime to check for malicious behavior. For more information, see Office VBA + AMSI: Parting the veil on malicious macros. +- [Windows Defender Antivirus](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) +Windows Defender Antivirus can now [run within a sandbox](https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/windows-defender-antivirus-can-now-run-in-a-sandbox/), increasing its security. You can also [configure CPU priority settings](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus) for Windows Defender Antivirus scans. Windows Defender Antivirus can now scan macros and other scripts at runtime to check for malicious behavior. For more information, see [Office VBA + AMSI: Parting the veil on malicious macros](https://cloudblogs.microsoft.com/microsoftsecure/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/). - [Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics)
@@ -52,6 +52,17 @@ Onboard supported versions of Windows machines so that they can send sensor data Windows Defender ATP provides multiple monitoring and control features to help prevent threats from removeable devices, including new settings to allow or block specific hardware IDs. ## Windows Defender ATP 1803 +- [Attack surface reduction rules](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard) +New attack surface reduction rules: + - Use advanced protection against ransomware + - Block credential stealing from the Windows local security authority subsystem (lsass.exe) + - Block process creations originating from PSExec and WMI commands + - Block untrusted and unsigned processes that run from USB + - Block executable content from email client and webmail +- [Controlled folder access](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard) +You can now block untrusted processes from writing to disk sectors. +- [Windows Defender Antivirus](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) +Windows Defender Antivirus now shares detection status between M365 services and interoperates with Windows Defender ATP. For more information, see [Use next-gen technologies in Windows Defender Antivirus through cloud-delivered protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus). Block at first sight can now block non-portable executable files (such as JS, VBS, or macros) as well as executable files. For more information, see [Enable block at first sight](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus). - [Advanced Hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)
Query data using Advanced hunting in Windows Defender ATP - [Automated investigation](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)
Use Automated investigations to investigate and remediate threats From 64dfe8b9347efe2d8021e6191c49e03bbd3ca595 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 10 Jan 2019 22:46:15 +0000 Subject: [PATCH 20/61] Updated whats-new-in-windows-defender-atp.md --- .../windows-defender-atp/whats-new-in-windows-defender-atp.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md index baea741def..d17952f806 100644 --- a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md +++ b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md @@ -48,8 +48,8 @@ Microsoft Cloud App Security leverages Windows Defender ATP endpoint signals to Windows Defender ATP now adds support for Windows Server 2019. You'll be able to onboard Windows Server 2019 in the same method available for Windows 10 client machines. - [Onboard previous versions of Windows](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection)
Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor. -- [Removeable device control](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/19/windows-defender-atp-has-protections-for-usb-and-removable-devices/)
-Windows Defender ATP provides multiple monitoring and control features to help prevent threats from removeable devices, including new settings to allow or block specific hardware IDs. +- [Removable device control](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/19/windows-defender-atp-has-protections-for-usb-and-removable-devices/)
+Windows Defender ATP provides multiple monitoring and control features to help prevent threats from removable devices, including new settings to allow or block specific hardware IDs. ## Windows Defender ATP 1803 - [Attack surface reduction rules](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard) From 4451337be7a6e3c7f4c07a9dfa424224a9a0dcce Mon Sep 17 00:00:00 2001 From: adsshepherd <42436023+adsshepherd@users.noreply.github.com> Date: Fri, 11 Jan 2019 09:37:00 +0000 Subject: [PATCH 21/61] Update hello-hybrid-aadj-sso.md Added missing word --- .../hello-for-business/hello-hybrid-aadj-sso.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md index 9145280789..063a6f0ffc 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md @@ -29,7 +29,7 @@ When using a key, the on-premises environment needs an adequate distribution of When using a certificate, the on-premises environment can use Windows Server 2008 R2 and later domain controllers, which removes the Windows Server 2016 domain controller requirement. However, single-sign on using a key requires additional infrastructure to issue a certificate when the user enrolls for Windows Hello for Business. Azure AD joined devices enroll certificates using Microsoft Intune or a compatible Mobile Device Management (MDM). Microsoft Intune and Windows Hello for Business use the Network Device Enrollment Services (NDES) role and support Microsoft Intune connector. To deploy single sign-on for Azure AD joined devices using keys, read and follow [Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business](hello-hybrid-aadj-sso-base.md). -To deploy single sign-on for Azure AD joined devices using, read and follow [Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business](hello-hybrid-aadj-sso-base.md) and then [Using Certificates for AADJ On-premises Single-sign On](hello-hybrid-aadj-sso-cert.md). +To deploy single sign-on for Azure AD joined devices using certificates, read and follow [Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business](hello-hybrid-aadj-sso-base.md) and then [Using Certificates for AADJ On-premises Single-sign On](hello-hybrid-aadj-sso-cert.md). ## Related topics From 697221c4140fb0e3503224999873cffecc4c6cef Mon Sep 17 00:00:00 2001 From: Ricardo Cabral Date: Fri, 11 Jan 2019 17:53:04 +0000 Subject: [PATCH 22/61] Compliance architecture setps In the Update Compliance architecture is defined 4 steps and not five. --- .../deployment/update/update-compliance-monitor.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index 25fac89570..b6828c6943 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -34,12 +34,12 @@ See the following topics in this guide for detailed information about configurin ## Update Compliance architecture -The Update Compliance architecture and data flow is summarized by the following five-step process: +The Update Compliance architecture and data flow is summarized by the following four-step process: -**(1)** User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
-**(2)** Diagnostic data is analyzed by the Update Compliance Data Service.
-**(3)** Diagnostic data is pushed from the Update Compliance Data Service to your Azure Monitor workspace.
-**(4)** Diagnostic data is available in the Update Compliance solution.
+1. User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
+2. Diagnostic data is analyzed by the Update Compliance Data Service.
+3. Diagnostic data is pushed from the Update Compliance Data Service to your Azure Monitor workspace.
+4. Diagnostic data is available in the Update Compliance solution.
>[!NOTE] @@ -51,4 +51,4 @@ The Update Compliance architecture and data flow is summarized by the following ## Related topics [Get started with Update Compliance](update-compliance-get-started.md)
-[Use Update Compliance to monitor Windows Updates](update-compliance-using.md) \ No newline at end of file +[Use Update Compliance to monitor Windows Updates](update-compliance-using.md) From 22378f193521300177699c8bb2e47e3622e65eb2 Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Fri, 11 Jan 2019 20:41:17 +0000 Subject: [PATCH 23/61] Merged PR 13749: added new waas blog post added new waas blog post --- windows/deployment/update/windows-as-a-service.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/deployment/update/windows-as-a-service.md b/windows/deployment/update/windows-as-a-service.md index de4b23511b..00e3d4fd12 100644 --- a/windows/deployment/update/windows-as-a-service.md +++ b/windows/deployment/update/windows-as-a-service.md @@ -6,7 +6,6 @@ ms.topic: landing-page ms.manager: elizapo author: lizap ms.author: elizapo -ms.date: 12/19/2018 ms.localizationpriority: high --- # Windows as a service @@ -24,7 +23,7 @@ Windows 10 is the most secure version of Windows yet. Learn what updates we rele The latest news: