diff --git a/.github/workflows/Stale.yml b/.github/workflows/Stale.yml new file mode 100644 index 0000000000..101ee8ba9c --- /dev/null +++ b/.github/workflows/Stale.yml @@ -0,0 +1,19 @@ +name: (Scheduled) Mark stale pull requests + +permissions: + issues: write + pull-requests: write + +on: + schedule: + - cron: "0 */6 * * *" + workflow_dispatch: + +jobs: + stale: + uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-Stale.yml@workflows-prod + with: + RunDebug: true + RepoVisibility: ${{ github.repository_visibility }} + secrets: + AccessToken: ${{ secrets.GITHUB_TOKEN }} diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index fc3a796e95..94caccffcb 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -1,115 +1,825 @@ { "redirections": [ { - "source_path": "windows/security//information-protection/kernel-dma-protection-for-thunderbolt.md", + "source_path": "windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md", "redirect_url": "/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md", + "source_path": "windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md", "redirect_url": "/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md", + "source_path": "windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md", "redirect_url": "/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", "redirect_document_id": false }, { - "source_path": "windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md", - "redirect_url": "/windows/security/operating-system-security/device-management/override-mitigation-options-for-app-related-security-policies", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md", - "redirect_url": "/windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md", - "redirect_url": "/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection", - "redirect_document_id": false - }, - { - "source_path": "windows/security//threat-protection/mbsa-removal-and-guidance.md", + "source_path": "windows/security/threat-protection/mbsa-removal-and-guidance.md", "redirect_url": "/windows/security/operating-system-security/device-management/windows-security-configuration-framework/mbsa-removal-and-guidance", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md", + "source_path": "windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md", "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml", + "source_path": "windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml", "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/microsoft-defender-application-guard/install-md-app-guard.md", + "source_path": "windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md", "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md", + "source_path": "windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md", "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview", "redirect_document_id": false }, { - "source_path": "windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md", + "source_path": "windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md", "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md", - "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview", - "redirect_document_id": false - }, - { - "source_path": "windows/security//threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md", + "source_path": "windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md", "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/reqs-md-app-guard", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md", + "source_path": "windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md", "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/test-scenarios-md-app-guard", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md", + "source_path": "windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md", "redirect_url": "/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md", + "source_path": "windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md", "redirect_url": "/windows/security/hardware-security/system-guard-secure-launch-and-smm-protection", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/windows-security-configuration-framework/get-support-for-security-baselines.md", + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/get-support-for-security-baselines.md", "redirect_url": "/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md", + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md", "redirect_url": "/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10", "redirect_document_id": false }, { - "source_path": "windows/security//threat-protection/windows-security-configuration-framework/windows-security-baselines.md", + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md", "redirect_url": "/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/debugging-operational-guide-appid-tagging-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/debugging-operational-guide-appid-tagging-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/deploy-appid-tagging-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/deploy-appid-tagging-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/design-create-appid-tagging-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/design-create-appid-tagging-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/wdac-appid-tagging-guide.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/appcontrol-appid-tagging-guide", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/administer-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/administer-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-architecture-and-components.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-architecture-and-components", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-functions.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-functions", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policies-deployment-guide", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policies-design-guide.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policies-design-guide", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policy-use-scenarios", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-processes-and-interactions.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-processes-and-interactions", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-settings.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-technical-reference.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-technical-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/configure-an-applocker-policy-for-audit-only", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/configure-an-applocker-policy-for-enforce-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/configure-exceptions-for-an-applocker-rule", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-application-identity-service.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/configure-the-application-identity-service", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/configure-the-appLocker-reference-device", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-for-packaged-apps", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-file-hash-condition", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-path-condition", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-publisher-condition", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/create-applocker-default-rules.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/create-applocker-default-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/create-list-of-applications-deployed-to-each-business-group", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/create-your-applocker-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/create-your-applocker-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/create-your-applocker-rules.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/create-your-applocker-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/delete-an-applocker-rule.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/delete-an-applocker-rule", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/deploy-the-applocker-policy-into-production", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/determine-group-policy-structure-and-rule-enforcement", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-your-application-control-objectives.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/dll-rules-in-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/dll-rules-in-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/document-group-policy-structure-and-applocker-rule-enforcement", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/document-your-application-list.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/document-your-application-list", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/document-your-applocker-rules.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/document-your-applocker-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/edit-an-applocker-policy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/edit-an-applocker-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/edit-applocker-rules.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/edit-applocker-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/enable-the-dll-rule-collection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/enforce-applocker-rules.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/enforce-applocker-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/executable-rules-in-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/executable-rules-in-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/export-an-applocker-policy-from-a-gpo", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/export-an-applocker-policy-to-an-xml-file", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/how-applocker-works-techref.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/how-applocker-works-techref", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/import-an-applocker-policy-from-another-computer", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/import-an-applocker-policy-into-a-gpo", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/maintain-applocker-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/maintain-applocker-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/manage-packaged-apps-with-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/merge-applocker-policies-by-using-set-applockerpolicy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/merge-applocker-policies-manually.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/merge-applocker-policies-manually", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/monitor-application-usage-with-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/optimize-applocker-performance.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/optimize-applocker-performance", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/plan-for-applocker-policy-management", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/refresh-an-applocker-policy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/refresh-an-applocker-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/requirements-for-deploying-applocker-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-to-use-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/requirements-to-use-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/rule-collection-extensions.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/rule-collection-extensions", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/run-the-automatically-generate-rules-wizard", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/script-rules-in-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/script-rules-in-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/security-considerations-for-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/security-considerations-for-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/select-types-of-rules-to-create.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/select-types-of-rules-to-create", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/test-and-update-an-applocker-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/tools-to-use-with-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/tools-to-use-with-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/working-with-applocker-rules#enforcement-modes", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understand-applocker-policy-design-decisions", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understand-the-applocker-policy-deployment-process", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-allow-and-deny-actions-on-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-default-rules.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-default-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-behavior", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-collections", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-condition-types", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-exceptions", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-file-hash-rule-condition-in-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-path-rule-condition-in-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-publisher-rule-condition-in-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/wdac", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/use-the-applocker-windows-powershell-cmdlets", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/using-event-viewer-with-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/wdac", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/what-is-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/windows-installer-rules-in-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/working-with-applocker-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/applocker/working-with-applocker-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/audit-wdac-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/audit-appcontrol-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/create-code-signing-cert-for-wdac.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/create-code-signing-cert-for-appcontrol", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-catalog-files-to-support-wdac.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-catalog-files-to-support-appcontrol", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-group-policy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-using-intune.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-intune", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-script", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/disable-wdac-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/disable-appcontrol-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/enforce-wdac-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/enforce-appcontrol-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/LOB-win32-apps-on-s.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/wdac-allow-lob-win32-apps", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/merge-wdac-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/merge-appcontrol-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/use-code-signing-for-better-control-and-protection.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/use-code-signing-for-better-control-and-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/use-signed-policies-to-protect-wdac-against-tampering.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/use-signed-policies-to-protect-appcontrol-against-tampering", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/wdac-deployment-guide.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/allow-com-object-registration-in-wdac-policy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/allow-com-object-registration-in-appcontrol-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/common-wdac-use-cases.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/common-appcontrol-use-cases", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/configure-authorized-apps-deployed-with-a-managed-installer.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/configure-authorized-apps-deployed-with-a-managed-installer", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/create-wdac-deny-policy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-deny-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/create-wdac-policy-for-fully-managed-devices.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-for-fully-managed-devices", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/create-wdac-policy-for-lightly-managed-devices.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-for-lightly-managed-devices", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/create-wdac-policy-using-reference-computer.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-using-reference-computer", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/deploy-multiple-appcontrol-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/example-wdac-base-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/example-appcontrol-base-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/manage-packaged-apps-with-wdac.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/manage-packaged-apps-with-appcontrol", + "redirect_document_id": false + }, { "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-block-rules.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/plan-appcontrol-management", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/script-enforcement.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/script-enforcement", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/select-types-of-rules-to-create.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/understand-wdac-policy-design-decisions.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/understand-appcontrol-policy-design-decisions", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/understanding-wdac-policy-settings.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/understanding-appcontrol-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/use-wdac-policy-to-control-specific-plug-ins-add-ins-and-modules.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/use-appcontrol-policy-to-control-specific-plug-ins-add-ins-and-modules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/use-wdac-with-intelligent-security-graph.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/use-appcontrol-with-intelligent-security-graph", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-and-dotnet", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/wdac-design-guide.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-design-guide", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-create-base-policy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard-create-base-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-create-supplemental-policy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard-create-supplemental-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-editing-policy.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard-editing-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-merging-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard-merging-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard-parsing-event-logs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/feature-availability.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/feature-availability", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/index.yml", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/index", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/operations/citool-commands.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/operations/citool-commands", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/operations/configure-wdac-managed-installer.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/operations/configure-appcontrol-managed-installer", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/operations/event-tag-explanations", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/operations/inbox-wdac-policies.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/operations/inbox-appcontrol-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/operations/known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/operations/querying-application-control-events-centrally-using-advanced-hunting.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/operations/querying-application-control-events-centrally-using-advanced-hunting", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/operations/appcontrol-debugging-and-troubleshooting", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/operations/wdac-operational-guide.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/operations/appcontrol-operational-guide", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/wdac.md", + "redirect_url": "/windows/security/application-security/application-control/app-control-for-business/appcontrol", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md", + "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview", + "redirect_document_id": false + }, { "source_path": "windows/security/apps.md", "redirect_url": "/windows/security/application-security", "redirect_document_id": false }, + { + "source_path": "windows/security/cloud-security/index.md", + "redirect_url": "/windows/security/cloud-services", + "redirect_document_id": false + }, { "source_path": "windows/security/cloud.md", "redirect_url": "/windows/security", @@ -260,36 +970,221 @@ "redirect_url": "/windows/security/operating-system-security/data-protection/configure-s-mime", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/credential-guard/credential-guard-considerations.md", + "redirect_url": "/windows/security/identity-protection/credential-guard/considerations-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md", + "redirect_url": "/windows/security/identity-protection/credential-guard/how-it-works", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/credential-guard/credential-guard-known-issues.md", + "redirect_url": "/windows/security/identity-protection/credential-guard/considerations-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/credential-guard/credential-guard-manage.md", + "redirect_url": "/windows/security/identity-protection/credential-guard/configure", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md", "redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-protection-limits", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md", + "redirect_url": "/windows/security/identity-protection/credential-guard/how-it-works", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/credential-guard/credential-guard-requirements.md", + "redirect_url": "/windows/security/identity-protection/credential-guard/index", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/credential-guard/credential-guard-scripts.md", "redirect_url": "/windows/security", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/credential-guard/credential-guard.md", + "redirect_url": "/windows/security/identity-protection/credential-guard", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/credential-guard/dg-readiness-tool.md", "redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/cloud.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/cloud-only", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-mfa.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-mfa.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/requirements.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/multifactor-unlock", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/cloud", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md", + "redirect_url": "/windows-server/administration/performance-tuning/role/active-directory-server/capacity-planning-for-active-directory-domain-services", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-and-password-changes.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-mfa", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-guide.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/rdp-sign-in", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-event-300.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-faq", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-faq.yml", + "redirect_url": "/windows/security/identity-protection/hello-for-business/faq", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-faq", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/dual-enrollment", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/pin-reset", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/rdp-sign-in", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works-authentication", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md", "redirect_url": "/azure/active-directory/devices/device-registration-how-it-works", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works-provisioning", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso", @@ -310,11 +1205,31 @@ "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-adfs", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust", @@ -335,6 +1250,16 @@ "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works#provisioning", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust", @@ -360,6 +1285,21 @@ "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust", @@ -390,16 +1330,76 @@ "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-identity-verification.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-mfa", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/policy-settings", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-overview.md", "redirect_url": "/windows/security/identity-protection/hello-for-business", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-planning-guide.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/prepare-users", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-videos.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md", "redirect_url": "/azure/active-directory/authentication/howto-authentication-passwordless-security-key", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/passwordless-strategy.md", + "redirect_url": "/windows/security/identity-protection/passwordless-strategy/", + "redirect_document_id": false + }, { "source_path": "windows/security/identity-protection/hello-for-business/reset-security-key.md", "redirect_url": "/azure/active-directory/authentication/howto-authentication-passwordless-security-key", @@ -427,12 +1427,12 @@ }, { "source_path": "windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md", - "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5", + "redirect_url": "https:/support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5", "redirect_document_id": false }, { "source_path": "windows/security/identity-protection/password-support-policy.md", - "redirect_url": "https://support.microsoft.com/help/4490115", + "redirect_url": "https:/support.microsoft.com/help/4490115", "redirect_document_id": false }, { @@ -850,11 +1850,41 @@ "redirect_url": "/windows/security/hardware-security/tpm/trusted-platform-module-top-node", "redirect_document_id": false }, + { + "source_path": "windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/app-behavior-with-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/collect-wip-audit-event-logs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", + "redirect_document_id": false + }, { "source_path": "windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", "redirect_document_id": false }, + { + "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", + "redirect_document_id": false + }, { "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md", "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", @@ -865,16 +1895,86 @@ "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", "redirect_document_id": false }, + { + "source_path": "windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", + "redirect_document_id": false + }, { "source_path": "windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune.md", "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", "redirect_document_id": false }, + { + "source_path": "windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/how-to-disable-wip.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/how-to-disable-wip", + "redirect_document_id": false + }, { "source_path": "windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md", "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", "redirect_document_id": false }, + { + "source_path": "windows/security/information-protection/windows-information-protection/limitations-with-wip.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/limitations-with-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/mandatory-settings-for-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/overview-create-wip-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/testing-scenarios-for-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/using-owa-with-wip.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/using-owa-with-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/wip-app-enterprise-context", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/wip-learning.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/wip-learning", + "redirect_document_id": false + }, { "source_path": "windows/security/introduction/index.md", "redirect_url": "/windows/security/introduction", @@ -895,21 +1995,61 @@ "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/faq", "redirect_document_id": false }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-basic-deployment.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-countermeasures.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/countermeasures", + "redirect_document_id": false + }, { "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml", "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/faq", "redirect_document_id": false }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-deployment-comparison.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/configure#bitlocker-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker#device-encryption", + "redirect_document_id": false + }, { "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-frequently-asked-questions.yml", "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/faq", "redirect_document_id": false }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-group-policy-settings.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/configure#$bitlocker-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/install-server", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/network-unlock", + "redirect_document_id": false + }, { "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-key-management-faq.yml", "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/faq", "redirect_document_id": false }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-management-for-enterprises.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/configure", + "redirect_document_id": false + }, { "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-network-unlock-faq.yml", "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/faq", @@ -920,6 +2060,11 @@ "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/faq", "redirect_document_id": false }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-recovery-guide-plan.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview", + "redirect_document_id": false + }, { "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-security-faq.yml", "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/faq", @@ -935,16 +2080,636 @@ "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/faq", "redirect_document_id": false }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/operations-guide", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/recovery-process#bitlocker-recovery-password-viewer", + "redirect_document_id": false + }, { "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml", "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/faq", "redirect_document_id": false }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/plan", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/csv-san", + "redirect_document_id": false + }, { "source_path": "windows/security/operating-system-security/data-protection/index.md", "redirect_url": "/windows/security/operating-system-security/#data-protection", "redirect_document_id": false }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/configure-pde-in-intune.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/faq-pde.yml", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/faq", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/includes/pde-description.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-arso.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-hibernation.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-memory-dumps.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-password-connected-standby.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-wer.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-enable-pde.md", + "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717262(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717263(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770289(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717260(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721530(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/boundary-zone-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770729(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/boundary-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725978(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771822(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731463(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717237(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947845(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947794(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947848(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947836(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947800(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947783(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947791(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947799(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947827(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947819(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717261(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717238(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717284(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717277(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717279(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-data-protection-quick-mode-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717293(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717253(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-key-exchange-main-mode-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717249(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-rules-to-require-encryption.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717270(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-logging", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-workstation-authentication-certificate-template.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717275(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717278(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/confirm-that-certificates-are-deployed-correctly.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717245(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717246(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-a-group-account-in-active-directory.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717247(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717274(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-exemption-list-rule.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717243(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-request-rule.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717283(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717288(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753540(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/documenting-the-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753825(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732933(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725818(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-inbound-rules.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717281(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-outbound-rules.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717259(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/encryption-zone-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770426(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/encryption-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753367(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/exempt-icmp-from-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717292(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/exemption-list.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732202(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771233(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731164(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-active-directory-deployment.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771366(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-current-network-infrastructure.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770899(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-devices.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc726039(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-other-relevant-information.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771791(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731454(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-boundary.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770565(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-encryption.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754085(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-firewall.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731123(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-clients.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770836(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-servers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731908(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732023(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717256(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolated-domain-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731447(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolated-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731788(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831418(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/link-the-gpo-to-the-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717264(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721532(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717265(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717290(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717269(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717266(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-windows-firewall-with-advanced-security.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717254(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-certificate-based-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730835(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-domain-isolation-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771044(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-gpo-deployment.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771733(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732752(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-isolation-groups-for-the-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725693(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-network-access-groups.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771664(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-server-isolation-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732615(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-settings-for-a-basic-firewall-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754986(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-the-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771716(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947826(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730841(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc772556(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770865(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753064(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725659(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-server-access-to-members-of-a-group-only.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717267(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831807(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732486(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732413(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721528(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717251(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731951(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/verify-that-network-traffic-is-authenticated.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717273(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717241(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732024(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", + "redirect_document_id": false + }, { "source_path": "windows/security/operating-system.md", "redirect_url": "/windows/security/operating-system-security", @@ -955,6 +2720,11 @@ "redirect_url": "/windows/security/security-foundations/index", "redirect_document_id": false }, + { + "source_path": "windows/security/security-foundations/msft-security-dev-lifecycle.md", + "redirect_url": "/compliance/assurance/assurance-microsoft-security-development-lifecycle", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", "redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", @@ -1385,6 +3155,11 @@ "redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules", "redirect_document_id": false }, + { + "source_path": "windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md", + "redirect_url": "/windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/change-history-for-threat-protection.md", "redirect_url": "/windows/security/threat-protection", @@ -1427,7 +3202,7 @@ }, { "source_path": "windows/security/threat-protection/device-guard/memory-integrity.md", - "redirect_url": "https://support.microsoft.com/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78", + "redirect_url": "https:/support.microsoft.com/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78", "redirect_document_id": false }, { @@ -4082,7 +5857,7 @@ }, { "source_path": "windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md", - "redirect_url": "https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx", + "redirect_url": "https:/feedback.smartscreen.microsoft.com/smartscreenfaq.aspx", "redirect_document_id": false }, { @@ -4100,6 +5875,11 @@ "redirect_url": "/windows/security/security-foundations/msft-security-dev-lifecycle", "redirect_document_id": false }, + { + "source_path": "windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md", + "redirect_url": "/windows/security/operating-system-security/device-management/override-mitigation-options-for-app-related-security-policies", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", "redirect_url": "/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", @@ -4110,16 +5890,751 @@ "redirect_url": "/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10", "redirect_document_id": false }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/access-this-computer-from-the-network", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/account-lockout-duration.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-duration", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/account-lockout-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/account-policies.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-administrator-account-status", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-guest-account-status", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-rename-administrator-account", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-rename-guest-account", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/add-workstations-to-domain", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/administer-security-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/allow-log-on-locally", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/audit-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/back-up-files-and-directories", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/bypass-traverse-checking", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/change-the-system-time.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/change-the-system-time", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/change-the-time-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/change-the-time-zone", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/create-a-pagefile.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-a-pagefile", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/create-a-token-object.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-a-token-object", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/create-global-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-global-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-permanent-shared-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/create-symbolic-links.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-symbolic-links", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/debug-programs.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/debug-programs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-as-a-service", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-locally", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/enforce-password-history.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/enforce-password-history", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/generate-security-audits.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/generate-security-audits", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/increase-a-process-working-set", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/increase-scheduling-priority", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/kerberos-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/kerberos-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/load-and-unload-device-drivers", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/lock-pages-in-memory", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/log-on-as-a-batch-job", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/log-on-as-a-service", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/manage-auditing-and-security-log", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/maximum-password-age.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-password-age", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", "redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", "redirect_document_id": false }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agress.md", "redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", "redirect_document_id": false }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/minimum-password-age.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/minimum-password-age", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/minimum-password-length.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/minimum-password-length", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/modify-an-object-label.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/modify-an-object-label", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/modify-firmware-environment-values", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-list-manager-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/password-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/password-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/profile-single-process.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/profile-single-process", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/profile-system-performance.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/profile-system-performance", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/remove-computer-from-docking-station", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/replace-a-process-level-token", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/restore-files-and-directories", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/security-options.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/security-options", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/security-policy-settings-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/security-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/security-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/shut-down-the-system.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/shut-down-the-system", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-always.md", "redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", @@ -4140,14 +6655,119 @@ "redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", "redirect_document_id": false }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/synchronize-directory-service-data", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-settings-optional-subsystems", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-rights-assignment.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-rights-assignment", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md", + "redirect_url": "/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md", - "redirect_url": "https://www.microsoft.com/security/blog/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/", + "redirect_url": "https:/www.microsoft.com/security/blog/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-10-mobile-security-guide.md", - "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5", + "redirect_url": "https:/support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5", "redirect_document_id": false }, { @@ -4580,11 +7200,6 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-settings", "redirect_document_id": false }, - { - "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-settings.md", - "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview", - "redirect_document_id": false - }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-technical-reference", @@ -4685,11 +7300,6 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-your-application-control-objectives", "redirect_document_id": false }, - { - "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-your-application-control-objectives.md", - "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview", - "redirect_document_id": false - }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", @@ -4860,11 +7470,6 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-enforcement-settings", "redirect_document_id": false }, - { - "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md", - "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules#enforcement-modes", - "redirect_document_id": false - }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions", @@ -4935,11 +7540,6 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", "redirect_document_id": false }, - { - "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", - "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/wdac", - "redirect_document_id": false - }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets", @@ -4955,11 +7555,6 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies", "redirect_document_id": false }, - { - "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md", - "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/wdac", - "redirect_document_id": false - }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker", @@ -5207,7 +7802,7 @@ }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md", - "redirect_url": "https://aka.ms/AzureCodeSigning", + "redirect_url": "https:/aka.ms/AzureCodeSigning", "redirect_document_id": false }, { @@ -6727,7 +9322,7 @@ }, { "source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", - "redirect_url": "https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx", + "redirect_url": "https:/feedback.smartscreen.microsoft.com/smartscreenfaq.aspx", "redirect_document_id": false }, { @@ -6975,6 +9570,11 @@ "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo", "redirect_document_id": false }, + { + "source_path": "windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md", "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices", @@ -7337,27 +9937,27 @@ }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md", - "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-1-enterprise-basic-security.md", + "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/level-1-enterprise-basic-security.md", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-2-enterprise-enhanced-security.md", - "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-2-enterprise-enhanced-security.md", + "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/level-2-enterprise-enhanced-security.md", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-3-enterprise-high-security.md", - "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-3-enterprise-high-security.md", + "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/level-3-enterprise-high-security.md", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-4-enterprise-devops-security.md", - "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-4-enterprise-devops-security.md", + "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/level-4-enterprise-devops-security.md", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-5-enterprise-administrator-security.md", - "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-5-enterprise-administrator-security.md", + "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/level-5-enterprise-administrator-security.md", "redirect_document_id": false }, { @@ -7367,7 +9967,7 @@ }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md", - "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/windows-security-configuration-framework.md", + "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/windows-security-configuration-framework.md", "redirect_document_id": false }, { @@ -7381,1914 +9981,9 @@ "redirect_document_id": false }, { - "source_path": "windows/security/identity-protection/credential-guard/credential-guard.md", - "redirect_url": "/windows/security/identity-protection/credential-guard", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/credential-guard/credential-guard-considerations.md", - "redirect_url": "/windows/security/identity-protection/credential-guard/considerations-known-issues", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md", - "redirect_url": "/windows/security/identity-protection/credential-guard/how-it-works", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/credential-guard/credential-guard-known-issues.md", - "redirect_url": "/windows/security/identity-protection/credential-guard/considerations-known-issues", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/credential-guard/credential-guard-manage.md", - "redirect_url": "/windows/security/identity-protection/credential-guard/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md", - "redirect_url": "/windows/security/identity-protection/credential-guard/how-it-works", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/credential-guard/credential-guard-requirements.md", - "redirect_url": "/windows/security/identity-protection/credential-guard/index", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/configure-pde-in-intune.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-arso.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-hibernation.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-memory-dumps.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-password-connected-standby.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-disable-wer.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/intune-enable-pde.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/includes/pde-description.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/personal-data-encryption/faq-pde.yml", - "redirect_url": "/windows/security/operating-system-security/data-protection/personal-data-encryption/faq", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-group-policy-settings.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/configure#$bitlocker-policy-settings", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-deployment-comparison.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/configure#bitlocker-policy-settings", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-countermeasures.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/countermeasures", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-recovery-guide-plan.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/recovery-process#bitlocker-recovery-password-viewer", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/network-unlock", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-basic-deployment.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-management-for-enterprises.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/plan", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/operations-guide", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/csv-san", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker/install-server", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md", - "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker#device-encryption", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721530(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/boundary-zone.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725978(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/boundary-zone-gpos.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770729(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731463(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771822(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/documenting-the-zones.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753825(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725818(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design-example.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732933(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/encryption-zone.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753367(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/encryption-zone-gpos.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770426(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/exemption-list.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732202(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-gpos.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771233(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-policy-design-example.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731164(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-boundary.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770565(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-encryption.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754085(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-firewall.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731123(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-clients.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770836(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-servers.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731908(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolated-domain.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731788(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolated-domain-gpos.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731447(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721532(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-certificate-based-authentication.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730835(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-domain-isolation-zones.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771044(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-gpo-deployment.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771733(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732752(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-isolation-groups-for-the-zones.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725693(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-network-access-groups.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771664(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-server-isolation-zones.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732615(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-settings-for-a-basic-firewall-policy.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754986(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-the-gpos.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771716(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947826(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730841(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732486(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721528(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732413(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770289(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947845(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947794(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947848(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947836(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947800(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947783(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947791(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947799(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947827(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947819(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717261(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717238(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717284(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717277(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732023(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717256(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc772556(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770865(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753064(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725659(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731951(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717241(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732024(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717262(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717263(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717260(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717237(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717279(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-data-protection-quick-mode-settings.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717293(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717253(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-key-exchange-main-mode-settings.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717249(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-rules-to-require-encryption.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717270(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-workstation-authentication-certificate-template.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717275(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717278(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/confirm-that-certificates-are-deployed-correctly.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717245(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717246(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-a-group-account-in-active-directory.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717247(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717274(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-exemption-list-rule.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717243(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-request-rule.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717283(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717288(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-inbound-rules.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717281(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-outbound-rules.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717259(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/exempt-icmp-from-authentication.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717292(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/link-the-gpo-to-the-domain.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717264(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717265(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717290(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717269(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717266(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-windows-firewall-with-advanced-security.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717254(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-server-access-to-members-of-a-group-only.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717267(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717251(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/verify-that-network-traffic-is-authenticated.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717273(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731454(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-current-network-infrastructure.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770899(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-active-directory-deployment.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771366(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-devices.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc726039(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-other-relevant-information.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771791(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753540(v=ws.10)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831807(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831418(v=ws.11)", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-logging", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/rdp-sign-in", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/rdp-sign-in", - "redirect_document_id": false - }, - { - "source_path": "windows/security/security-foundations/msft-security-dev-lifecycle.md", - "redirect_url": "/compliance/assurance/assurance-microsoft-security-development-lifecycle", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/pin-reset", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md", - "redirect_url": "/windows-server/administration/performance-tuning/role/active-directory-server/capacity-planning-for-active-directory-domain-services", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-adfs", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-mfa", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-pki", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/cloud", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works#provisioning", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-guide.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-mfa", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-identity-verification.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/requirements", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-mfa.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-mfa.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/deploy/requirements.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/multifactor-unlock", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-and-password-changes.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works-authentication", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works-provisioning", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/policy-settings", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-planning-guide.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/prepare-users", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/passwordless-strategy.md", - "redirect_url": "/windows/security/identity-protection/passwordless-strategy/", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/deploy/cloud.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/cloud-only", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-pki.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-videos.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-faq.yml", - "redirect_url": "/windows/security/identity-protection/hello-for-business/faq", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-pki.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/access-this-computer-from-the-network", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/account-lockout-duration.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-duration", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/account-lockout-policy.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-policy", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/account-policies.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-policies", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-administrator-account-status", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-guest-account-status", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-rename-administrator-account", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-rename-guest-account", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/add-workstations-to-domain", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/administer-security-policy-settings", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/allow-log-on-locally", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/audit-policy.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-policy", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/back-up-files-and-directories", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/bypass-traverse-checking", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/change-the-system-time.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/change-the-system-time", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/change-the-time-zone.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/change-the-time-zone", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/create-a-pagefile.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-a-pagefile", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/create-a-token-object.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-a-token-object", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/create-global-objects.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-global-objects", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-permanent-shared-objects", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/create-symbolic-links.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-symbolic-links", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/debug-programs.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/debug-programs", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-as-a-service", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-locally", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/enforce-password-history.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/enforce-password-history", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/generate-security-audits.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/generate-security-audits", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/increase-a-process-working-set", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/increase-scheduling-priority", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/kerberos-policy.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/kerberos-policy", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/load-and-unload-device-drivers", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/lock-pages-in-memory", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/log-on-as-a-batch-job", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/log-on-as-a-service", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/manage-auditing-and-security-log", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/maximum-password-age.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-password-age", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/minimum-password-age.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/minimum-password-age", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/minimum-password-length.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/minimum-password-length", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/modify-an-object-label.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/modify-an-object-label", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/modify-firmware-environment-values", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-list-manager-policies", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/password-policy.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/password-policy", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/profile-single-process.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/profile-single-process", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/profile-system-performance.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/profile-system-performance", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/remove-computer-from-docking-station", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/replace-a-process-level-token", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/restore-files-and-directories", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/security-options.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/security-options", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/security-policy-settings.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/security-policy-settings", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/security-policy-settings-reference", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/shut-down-the-system.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/shut-down-the-system", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/synchronize-directory-service-data", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-settings-optional-subsystems", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", - "redirect_document_id": false - }, - { - "source_path": "windows/security/threat-protection/security-policy-settings/user-rights-assignment.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-rights-assignment", - "redirect_document_id": false - }, - { - "source_path": "windows/security/cloud-security/index.md", - "redirect_url": "/windows/security/cloud-services", - "redirect_document_id": false - }, - { - "source_path": "windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md", - "redirect_url": "/windows/security/identity-protection/hello-for-business/dual-enrollment", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/app-behavior-with-wip", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/collect-wip-audit-event-logs", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/how-to-disable-wip.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/how-to-disable-wip", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/limitations-with-wip.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/limitations-with-wip", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/mandatory-settings-for-wip", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/overview-create-wip-policy", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/testing-scenarios-for-wip", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/using-owa-with-wip.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/using-owa-with-wip", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/wip-app-enterprise-context", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/windows-information-protection/wip-learning.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/wip-learning", - "redirect_document_id": false - }, - { - "source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/LOB-win32-apps-on-s.md", - "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/wdac-allow-lob-win32-apps", + "source_path": "windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md", + "redirect_url": "/windows/security/application-security/application-control/introduction-to-virtualization-based-security-and-appcontrol.md", "redirect_document_id": false } ] -} +} \ No newline at end of file diff --git a/includes/licensing/windows-defender-application-control-wdac.md b/includes/licensing/windows-defender-application-control-wdac.md index 52264205ff..87446bab24 100644 --- a/includes/licensing/windows-defender-application-control-wdac.md +++ b/includes/licensing/windows-defender-application-control-wdac.md @@ -1,19 +1,19 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 09/18/2023 +ms.date: 09/23/2024 ms.topic: include --- ## Windows edition and licensing requirements -The following table lists the Windows editions that support Windows Defender Application Control (WDAC): +The following table lists the Windows editions that support App Control for Business: |Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| |:---:|:---:|:---:|:---:| |Yes|Yes|Yes|Yes| -Windows Defender Application Control (WDAC) license entitlements are granted by the following licenses: +App Control license entitlements are granted by the following licenses: |Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| |:---:|:---:|:---:|:---:|:---:| diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index dd8f2e1b6b..7d20bc1c4c 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -11,9 +11,9 @@ ms.date: 01/31/2024 -Windows Defender Application Control (WDAC) policies can be managed from an MDM server, or locally by using PowerShell via the WMI Bridge through the ApplicationControl configuration service provider (CSP). The ApplicationControl CSP was added in Windows 10, version 1903. This CSP provides expanded diagnostic capabilities and support for [multiple policies](/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies) (introduced in Windows 10, version 1903). It also provides support for policy deployment (introduced in Windows 10, version 1709) without reboot. Unlike the [AppLocker CSP](applocker-csp.md), the ApplicationControl CSP correctly detects the presence of no-reboot option and consequently doesn't schedule a reboot. +App Control for Business policies can be managed from an MDM server, or locally by using PowerShell via the WMI Bridge through the ApplicationControl configuration service provider (CSP). The ApplicationControl CSP was added in Windows 10, version 1903. This CSP provides expanded diagnostic capabilities and support for [multiple policies](/windows/security/application-security/application-control/app-control-for-business/design/deploy-multiple-appcontrol-policies) (introduced in Windows 10, version 1903). It also provides support for policy deployment (introduced in Windows 10, version 1709) without reboot. Unlike the [AppLocker CSP](applocker-csp.md), the ApplicationControl CSP correctly detects the presence of no-reboot option and consequently doesn't schedule a reboot. -Existing Windows Defender Application Control (WDAC) policies deployed using the AppLocker CSP's CodeIntegrity node can now be deployed using the ApplicationControl CSP URI. Although WDAC policy deployment using the AppLocker CSP will continue to be supported, all new feature work will be done in the ApplicationControl CSP only. +Existing App Control for Business policies deployed using the AppLocker CSP's CodeIntegrity node can now be deployed using the ApplicationControl CSP URI. Although App Control policy deployment using the AppLocker CSP will continue to be supported, all new feature work will be done in the ApplicationControl CSP only. @@ -861,7 +861,7 @@ The following table provides the result of this policy based on different values ## Microsoft Intune Usage Guidance -For customers using Intune standalone or hybrid management with Configuration Manager to deploy custom policies via the ApplicationControl CSP, refer to [Deploy Windows Defender Application Control policies by using Microsoft Intune](/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune). +For customers using Intune standalone or hybrid management with Configuration Manager to deploy custom policies via the ApplicationControl CSP, refer to [Deploy App Control for Business policies by using Microsoft Intune](/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-intune). ## Generic MDM Server Usage Guidance @@ -1014,7 +1014,7 @@ The ApplicationControl CSP can also be managed locally from PowerShell or via Co ### Setup for using the WMI Bridge -1. Convert your WDAC policy to Base64. +1. Convert your App Control policy to Base64. 2. Open PowerShell in Local System context (through PSExec or something similar). 3. Use WMI Interface: diff --git a/windows/client-management/mdm/policy-csp-admx-deviceguard.md b/windows/client-management/mdm/policy-csp-admx-deviceguard.md index 94711a96ae..9ea0e21a78 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceguard.md @@ -14,7 +14,7 @@ ms.date: 08/06/2024 > [!WARNING] -> Group Policy-based deployment of Windows Defender Application Control policies only supports single-policy format WDAC policies. To use WDAC on devices running Windows 10 1903 and greater, or Windows 11, we recommend using an alternative method for [policy deployment](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide). +> Group Policy-based deployment of App Control for Business policies only supports single-policy format WDAC policies. To use WDAC on devices running Windows 10 1903 and greater, or Windows 11, we recommend using an alternative method for [policy deployment](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide). diff --git a/windows/deployment/windows-enterprise-e3-overview.md b/windows/deployment/windows-enterprise-e3-overview.md index 5d58a929ec..7be5082ac3 100644 --- a/windows/deployment/windows-enterprise-e3-overview.md +++ b/windows/deployment/windows-enterprise-e3-overview.md @@ -105,7 +105,6 @@ For more information about implementing Credential Guard, see the following reso - [Security considerations for Original Equipment Manufacturers](/windows-hardware/design/device-experiences/oem-security-considerations) - [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337) - ### AppLocker management AppLocker in Windows Enterprise can be managed by using Group Policy. Group Policy requires having AD DS and that the Windows Enterprise devices are joined to an AD DS domain. AppLocker rules can be created by using Group Policy. The AppLocker rules can then be targeted to the appropriate devices. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/wdac-appid-tagging-guide.md b/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/appcontrol-appid-tagging-guide.md similarity index 50% rename from windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/wdac-appid-tagging-guide.md rename to windows/security/application-security/application-control/app-control-for-business/AppIdTagging/appcontrol-appid-tagging-guide.md index 4dc0da5aba..8ea04f6820 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/wdac-appid-tagging-guide.md +++ b/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/appcontrol-appid-tagging-guide.md @@ -1,23 +1,22 @@ --- -title: Designing, creating, managing, and troubleshooting Windows Defender Application Control AppId Tagging policies -description: How to design, create, manage, and troubleshoot your WDAC AppId Tagging policies +title: Designing, creating, managing, and troubleshooting App Control for Business AppId Tagging policies +description: How to design, create, manage, and troubleshoot your App Control AppId Tagging policies ms.localizationpriority: medium -ms.date: 04/27/2022 +ms.date: 09/11/2024 ms.topic: conceptual --- -# WDAC Application ID (AppId) Tagging guide +# App Control Application ID (AppId) Tagging guide -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] ## AppId Tagging Feature Overview -The Application ID (AppId) Tagging Policy feature, while based off Windows Defender Application Control (WDAC), doesn't control whether applications run. AppId Tagging policies can be used to mark the processes of the running application with a customizable tag defined in the policy. Application processes that pass the AppId policy receive the tag while failing applications don't. +The Application ID (AppId) Tagging Policy feature, while based off App Control for Business, doesn't control whether applications run. AppId Tagging policies can be used to mark the processes of the running application with a customizable tag defined in the policy. Application processes that pass the AppId policy receive the tag while failing applications don't. ## AppId Tagging Feature Availability -The WDAC AppId Tagging feature is available on the following versions of the Windows platform: +The App Control AppId Tagging feature is available on the following versions of the Windows platform: Client: - Windows 10 20H1, 20H2, and 21H1 versions only diff --git a/windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/debugging-operational-guide-appid-tagging-policies.md b/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/debugging-operational-guide-appid-tagging-policies.md similarity index 73% rename from windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/debugging-operational-guide-appid-tagging-policies.md rename to windows/security/application-security/application-control/app-control-for-business/AppIdTagging/debugging-operational-guide-appid-tagging-policies.md index 1507fc348c..e62a226d9b 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/debugging-operational-guide-appid-tagging-policies.md +++ b/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/debugging-operational-guide-appid-tagging-policies.md @@ -2,20 +2,19 @@ title: Testing and Debugging AppId Tagging Policies description: Testing and Debugging AppId Tagging Policies to ensure your policies are deployed successfully. ms.localizationpriority: medium -ms.date: 04/29/2022 +ms.date: 09/11/2024 ms.topic: troubleshooting --- # Testing and Debugging AppId Tagging Policies -> [!NOTE] -> Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] -After deployment of the WDAC AppId Tagging policy, WDAC will log a 3099 policy deployed event in the [Event Viewer logs](../operations/event-id-explanations.md). You first should ensure that the policy has been successfully deployed onto the system by verifying the presence of the 3099 event. +After deployment of the App Control AppId Tagging policy, App Control will log a 3099 policy deployed event in the [Event Viewer logs](../operations/event-id-explanations.md). You first should ensure that the policy has been successfully deployed onto the system by verifying the presence of the 3099 event. ## Verifying Tags on Running Processes -After verifying the policy has been deployed, the next step is to verify that the application processes you expect to pass the AppId Tagging policy have your tag set. Note that processes running at the time of policy deployment will need to be restarted since Windows Defender Application Control (WDAC) can only tag processes created after the policy has been deployed. +After verifying the policy has been deployed, the next step is to verify that the application processes you expect to pass the AppId Tagging policy have your tag set. Note that processes running at the time of policy deployment will need to be restarted since App Control for Business can only tag processes created after the policy has been deployed. 1. Download and Install the Windows Debugger diff --git a/windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/deploy-appid-tagging-policies.md b/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/deploy-appid-tagging-policies.md similarity index 54% rename from windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/deploy-appid-tagging-policies.md rename to windows/security/application-security/application-control/app-control-for-business/AppIdTagging/deploy-appid-tagging-policies.md index 7f0824cace..82fbcd6156 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/deploy-appid-tagging-policies.md +++ b/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/deploy-appid-tagging-policies.md @@ -1,17 +1,16 @@ --- -title: Deploying Windows Defender Application Control AppId tagging policies -description: How to deploy your WDAC AppId tagging policies locally and globally within your managed environment. +title: Deploying App Control for Business AppId tagging policies +description: How to deploy your App Control AppId tagging policies locally and globally within your managed environment. ms.localizationpriority: medium -ms.date: 04/29/2022 +ms.date: 09/11/2024 ms.topic: conceptual --- -# Deploying Windows Defender Application Control AppId tagging policies +# Deploying App Control for Business AppId tagging policies -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. For more information, see [Windows Defender Application Control feature availability](../feature-availability.md). +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] -Similar to Windows Defender Application Control (WDAC) policies, WDAC AppId tagging policies can be deployed locally and to your managed endpoints several ways. Once you've created your AppId tagging policy, use one of the following methods to deploy: +Similar to App Control for Business policies, App Control AppId tagging policies can be deployed locally and to your managed endpoints several ways. Once you've created your AppId tagging policy, use one of the following methods to deploy: 1. [Deploy AppId tagging policies with MDM](#deploy-appid-tagging-policies-with-mdm) 1. [Deploy policies with Configuration Manager](#deploy-appid-tagging-policies-with-configuration-manager) @@ -20,23 +19,23 @@ Similar to Windows Defender Application Control (WDAC) policies, WDAC AppId tagg ## Deploy AppId tagging policies with MDM -Custom AppId tagging policies can be deployed to endpoints using [the OMA-URI feature in MDM](../deployment/deploy-wdac-policies-using-intune.md#deploy-wdac-policies-with-custom-oma-uri). +Custom AppId tagging policies can be deployed to endpoints using [the OMA-URI feature in MDM](../deployment/deploy-appcontrol-policies-using-intune.md#deploy-app-control-policies-with-custom-oma-uri). ## Deploy AppId tagging policies with Configuration Manager -Custom AppId tagging policies can be deployed via Configuration Manager using the [deployment task sequences](../deployment/deploy-wdac-policies-with-memcm.md#deploy-custom-wdac-policies-using-packagesprograms-or-task-sequences), policies can be deployed to your managed endpoints and users. +Custom AppId tagging policies can be deployed via Configuration Manager using the [deployment task sequences](../deployment/deploy-appcontrol-policies-with-memcm.md#deploy-custom-app-control-policies-using-packagesprograms-or-task-sequences), policies can be deployed to your managed endpoints and users. ### Deploy AppId tagging Policies via Scripting -Scripting hosts can be used to deploy AppId tagging policies as well. This approach is often best suited for local deployment, but works for deployment to managed endpoints and users too. For more information on how to deploy WDAC AppId tagging policies via scripting, see [Deploy WDAC policies using script](../deployment/deploy-wdac-policies-with-script.md). For AppId tagging policies, the only applicable method is deploying to version 1903 or later. +Scripting hosts can be used to deploy AppId tagging policies as well. This approach is often best suited for local deployment, but works for deployment to managed endpoints and users too. For more information on how to deploy App Control AppId tagging policies via scripting, see [Deploy App Control policies using script](../deployment/deploy-appcontrol-policies-with-script.md). For AppId tagging policies, the only applicable method is deploying to version 1903 or later. ### Deploying policies via the ApplicationControl CSP -Multiple WDAC policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). The CSP also provides support for rebootless policy deployment. +Multiple App Control policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). The CSP also provides support for rebootless policy deployment. However, when policies are unenrolled from an MDM server, the CSP will attempt to remove every policy from devices, not just the policies added by the CSP. The reason for this is that the ApplicationControl CSP doesn't track enrollment sources for individual policies, even though it will query all policies on a device, regardless if they were deployed by the CSP. For more information, see [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp) to deploy multiple policies, and optionally use Microsoft Intune's Custom OMA-URI capability. > [!NOTE] -> WMI and GP don't currently support multiple policies. If you can't directly access the MDM stack, use the [ApplicationControl CSP via the MDM Bridge WMI Provider](/windows/client-management/mdm/applicationcontrol-csp#powershell-and-wmi-bridge-usage-guidance) to manage multiple policy format Windows Defender Application Control policies. +> WMI and GP don't currently support multiple policies. If you can't directly access the MDM stack, use the [ApplicationControl CSP via the MDM Bridge WMI Provider](/windows/client-management/mdm/applicationcontrol-csp#powershell-and-wmi-bridge-usage-guidance) to manage multiple policy format App Control for Business policies. diff --git a/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/design-create-appid-tagging-policies.md b/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/design-create-appid-tagging-policies.md new file mode 100644 index 0000000000..363d4b5dd8 --- /dev/null +++ b/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/design-create-appid-tagging-policies.md @@ -0,0 +1,102 @@ +--- +title: Create your App Control for Business AppId Tagging Policies +description: Create your App Control for Business AppId tagging policies for Windows devices. +ms.localizationpriority: medium +ms.date: 09/23/2024 +ms.topic: conceptual +--- + +# Creating your App Control AppId Tagging Policies + +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] + +## Create the policy using the App Control Wizard + +You can use the App Control for Business Wizard and the PowerShell commands to create an App Control policy and convert it to an AppIdTagging policy. The App Control Wizard is available for download at the [App Control Wizard Installer site](https://aka.ms/wdacwizard). These PowerShell commands are only available on the supported platforms listed in [AppId Tagging Guide](appcontrol-appid-tagging-guide.md). + +1. Create a new base policy using the templates: + + Start with the Policy Creator task and select Multiple Policy Format and Base Policy. Select the Base Template to use for the policy. The following example shows beginning with the [Default Windows Mode](../design/appcontrol-wizard-create-base-policy.md#template-base-policies) template and build on top of these rules. + + :::image type="content" alt-text="Configuring the policy base and template." source="../images/appid-appcontrol-wizard-1.png" lightbox="../images/appid-appcontrol-wizard-1.png"::: + + > [!NOTE] + > If your AppId Tagging Policy does build off the base templates or does not allow Windows in-box processes, you will notice significant performance regressions, especially during boot. For this reason, it is strongly recommended to build off the base templates. For more information on the issue, see the [AppId Tagging Known Issue](../operations/known-issues.md#slow-boot-and-performance-with-custom-policies). + +2. Set the following rule-options using the Wizard toggles: + + :::image type="content" alt-text="Configuring the policy rule-options." source="../images/appid-appcontrol-wizard-2.png"::: + +3. Create custom rules: + + Selecting the `+ Custom Rules` button opens the Custom Rules panel. The Wizard supports five types of file rules: + + - Publisher rules: Create a rule based off the signing certificate hierarchy. Additionally, the original filename and version can be combined with the signing certificate for added security. + - Path rules: Create a rule based off the path to a file or a parent folder path. Path rules support wildcards. + - File attribute rules: Create a rule based off a file's immutable properties like the original filename, file description, product name or internal name. + - Package app name rules: Create a rule based off the package family name of an appx/msix. + - Hash rules: Create a rule based off the PE Authenticode hash of a file. + + For more information on creating new policy file rules, see the guidelines provided in the [creating policy file rules section](../design/appcontrol-wizard-create-base-policy.md#creating-custom-file-rules). + +4. Convert to AppId Tagging Policy: + + After the Wizard builds the policy file, open the file in a text editor and remove the entire "Value=131" SigningScenario text block. The only remaining signing scenario should be "Value=12" which is the user mode application section. Next, open PowerShell in an elevated prompt and run the following command. Replace the AppIdTagging Key-Value pair for your scenario: + + ```powershell + Set-CIPolicyIdInfo -ResetPolicyID -FilePath .\AppIdPolicy.xml -AppIdTaggingPolicy -AppIdTaggingKey "MyKey" -AppIdTaggingValue "MyValue" + ``` + The policyID GUID is returned by the PowerShell command if successful. + +## Create the policy using PowerShell + +Using this method, you create an AppId Tagging policy directly using the App Control PowerShell commands. These PowerShell commands are only available on the supported platforms listed in [AppId Tagging Guide](appcontrol-appid-tagging-guide.md). In an elevate PowerShell instance: + +1. Create an AppId rule for the policy based on a combination of the signing certificate chain and version of the application. In the example below, the level has been set to SignedVersion. Any of the [App Control File Rule Levels](../design/select-types-of-rules-to-create.md#table-2-app-control-for-business-policy---file-rule-levels) can be used in AppId rules: + + ```powershell + $rule = New-CiPolicyRule -Level SignedVersion -DriverFilePath + ``` +2. Create the AppId Tagging Policy. Replace the AppIdTagging Key-Value pair for your scenario: + + ```powershell + New-CIPolicy -rules $rule -FilePath .\AppIdPolicy.xml -AppIdTaggingPolicy -AppIdTaggingKey "MyKey" -AppIdTaggingValue "MyValue" + ``` +3. Set the rule-options for the policy: + + ```powershell + Set-RuleOption -Option 0 .\AppIdPolicy.xml # Usermode Code Integrity (UMCI) + Set-RuleOption -Option 16 .\AppIdPolicy.xml # Refresh Policy no Reboot + Set-RuleOption -Option 18 .\AppIdPolicy.xml # (Optional) Disable FilePath Rule Protection + ``` + + If you're using filepath rules, you may want to set option 18. Otherwise, there's no need. + +4. Set the name and ID on the policy, which is helpful for future debugging: + + ```powershell + Set-CIPolicyIdInfo -ResetPolicyId -PolicyName "MyPolicyName" -PolicyId "MyPolicyId" -AppIdTaggingPolicy -FilePath ".\AppIdPolicy.xml" + ``` + The policyID GUID is returned by the PowerShell command if successful. + +## Deploy for Local Testing + +After creating your AppId Tagging policy in the above steps, you can deploy the policy to your local machine for testing before broadly deploying the policy to your endpoints: + +1. Depending on your deployment method, convert the xml to binary: + + ```powershell + Convertfrom-CIPolicy .\policy.xml ".\{PolicyIDGUID}.cip" + ``` + +2. Optionally, deploy it for local testing: + + ```powershell + copy ".\{Policy ID}.cip" c:\windows\system32\codeintegrity\CiPolicies\Active\ + ./RefreshPolicy.exe + ``` + + RefreshPolicy.exe is available for download from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=102925). + +## Next Steps +For more information on debugging and broad deployment of the AppId Tagging policy, see [Debugging AppId policies](debugging-operational-guide-appid-tagging-policies.md) and [Deploying AppId policies](deploy-appid-tagging-policies.md). diff --git a/windows/security/application-security/application-control/windows-defender-application-control/TOC.yml b/windows/security/application-security/application-control/app-control-for-business/TOC.yml similarity index 70% rename from windows/security/application-security/application-control/windows-defender-application-control/TOC.yml rename to windows/security/application-security/application-control/app-control-for-business/TOC.yml index 91cc8b46d0..b5ff7c1588 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/TOC.yml +++ b/windows/security/application-security/application-control/app-control-for-business/TOC.yml @@ -1,126 +1,126 @@ - name: Application Control for Windows href: index.yml - name: About application control for Windows - href: wdac.md + href: appcontrol.md expanded: true items: - - name: WDAC and AppLocker Overview - href: wdac-and-applocker-overview.md - - name: WDAC and AppLocker Feature Availability + - name: App Control and AppLocker Overview + href: appcontrol-and-applocker-overview.md + - name: App Control and AppLocker Feature Availability href: feature-availability.md - name: Virtualization-based protection of code integrity - href: ../introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md -- name: WDAC design guide - href: design/wdac-design-guide.md + href: ../introduction-to-virtualization-based-security-and-appcontrol.md +- name: Design guide + href: design/appcontrol-design-guide.md items: - - name: Plan for WDAC policy lifecycle management - href: design/plan-wdac-management.md - - name: Design your WDAC policy + - name: Plan for App Control policy lifecycle management + href: design/plan-appcontrol-management.md + - name: Design your App Control policy items: - - name: Understand WDAC policy design decisions - href: design/understand-wdac-policy-design-decisions.md - - name: Understand WDAC policy rules and file rules + - name: Understand App Control policy design decisions + href: design/understand-appcontrol-policy-design-decisions.md + - name: Understand App Control policy rules and file rules href: design/select-types-of-rules-to-create.md items: - name: Allow apps installed by a managed installer href: design/configure-authorized-apps-deployed-with-a-managed-installer.md - name: Allow reputable apps with Intelligent Security Graph (ISG) - href: design/use-wdac-with-intelligent-security-graph.md + href: design/use-appcontrol-with-intelligent-security-graph.md - name: Allow COM object registration - href: design/allow-com-object-registration-in-wdac-policy.md - - name: Use WDAC with .NET hardening - href: design/wdac-and-dotnet.md - - name: Script enforcement with Windows Defender Application Control + href: design/allow-com-object-registration-in-appcontrol-policy.md + - name: Use App Control with .NET hardening + href: design/appcontrol-and-dotnet.md + - name: Script enforcement with App Control for Business href: design/script-enforcement.md - - name: Manage packaged apps with WDAC - href: design/manage-packaged-apps-with-wdac.md - - name: Use WDAC to control specific plug-ins, add-ins, and modules - href: design/use-wdac-policy-to-control-specific-plug-ins-add-ins-and-modules.md - - name: Understand WDAC policy settings - href: design/understanding-wdac-policy-settings.md - - name: Use multiple WDAC policies - href: design/deploy-multiple-wdac-policies.md - - name: Create your WDAC policy + - name: Manage packaged apps with App Control + href: design/manage-packaged-apps-with-appcontrol.md + - name: Use App Control to control specific plug-ins, add-ins, and modules + href: design/use-appcontrol-policy-to-control-specific-plug-ins-add-ins-and-modules.md + - name: Understand App Control policy settings + href: design/understanding-appcontrol-policy-settings.md + - name: Use multiple App Control policies + href: design/deploy-multiple-appcontrol-policies.md + - name: Create your App Control policy items: - - name: Example WDAC base policies - href: design/example-wdac-base-policies.md - - name: Policy creation for common WDAC usage scenarios - href: design/common-wdac-use-cases.md + - name: Example App Control base policies + href: design/example-appcontrol-base-policies.md + - name: Policy creation for common App Control usage scenarios + href: design/common-appcontrol-use-cases.md items: - - name: Create a WDAC policy for lightly managed devices - href: design/create-wdac-policy-for-lightly-managed-devices.md - - name: Create a WDAC policy for fully managed devices - href: design/create-wdac-policy-for-fully-managed-devices.md - - name: Create a WDAC policy for fixed-workload devices - href: design/create-wdac-policy-using-reference-computer.md - - name: Create a WDAC deny list policy - href: design/create-wdac-deny-policy.md - - name: Applications that can bypass WDAC and how to block them - href: design/applications-that-can-bypass-wdac.md + - name: Create an App Control policy for lightly managed devices + href: design/create-appcontrol-policy-for-lightly-managed-devices.md + - name: Create an App Control policy for fully managed devices + href: design/create-appcontrol-policy-for-fully-managed-devices.md + - name: Create an App Control policy for fixed-workload devices + href: design/create-appcontrol-policy-using-reference-computer.md + - name: Create an App Control deny list policy + href: design/create-appcontrol-deny-policy.md + - name: Applications that can bypass App Control and how to block them + href: design/applications-that-can-bypass-appcontrol.md - name: Microsoft recommended driver block rules href: design/microsoft-recommended-driver-block-rules.md - - name: Use the WDAC Wizard tool - href: design/wdac-wizard.md + - name: Use the App Control Wizard tool + href: design/appcontrol-wizard.md items: - - name: Create a base WDAC policy with the Wizard - href: design/wdac-wizard-create-base-policy.md - - name: Create a supplemental WDAC policy with the Wizard - href: design/wdac-wizard-create-supplemental-policy.md - - name: Editing a WDAC policy with the Wizard - href: design/wdac-wizard-editing-policy.md - - name: Creating WDAC Policy Rules from WDAC Events - href: design/wdac-wizard-parsing-event-logs.md - - name: Merging multiple WDAC policies with the Wizard - href: design/wdac-wizard-merging-policies.md -- name: WDAC deployment guide - href: deployment/wdac-deployment-guide.md + - name: Create a base App Control policy with the Wizard + href: design/appcontrol-wizard-create-base-policy.md + - name: Create a supplemental App Control policy with the Wizard + href: design/appcontrol-wizard-create-supplemental-policy.md + - name: Editing an App Control policy with the Wizard + href: design/appcontrol-wizard-editing-policy.md + - name: Creating App Control Policy Rules from App Control Events + href: design/appcontrol-wizard-parsing-event-logs.md + - name: Merging multiple App Control policies with the Wizard + href: design/appcontrol-wizard-merging-policies.md +- name: Deployment guide + href: deployment/appcontrol-deployment-guide.md items: - - name: Deploy WDAC policies with MDM - href: deployment/deploy-wdac-policies-using-intune.md - - name: Deploy WDAC policies with Configuration Manager - href: deployment/deploy-wdac-policies-with-memcm.md - - name: Deploy WDAC policies with script - href: deployment/deploy-wdac-policies-with-script.md - - name: Deploy WDAC policies with group policy - href: deployment/deploy-wdac-policies-using-group-policy.md - - name: Audit WDAC policies - href: deployment/audit-wdac-policies.md - - name: Merge WDAC policies - href: deployment/merge-wdac-policies.md - - name: Enforce WDAC policies - href: deployment/enforce-wdac-policies.md - - name: Use code signing for added control and protection with WDAC + - name: Deploy App Control policies with MDM + href: deployment/deploy-appcontrol-policies-using-intune.md + - name: Deploy App Control policies with Configuration Manager + href: deployment/deploy-appcontrol-policies-with-memcm.md + - name: Deploy App Control policies with script + href: deployment/deploy-appcontrol-policies-with-script.md + - name: Deploy App Control policies with group policy + href: deployment/deploy-appcontrol-policies-using-group-policy.md + - name: Audit App Control policies + href: deployment/audit-appcontrol-policies.md + - name: Merge App Control policies + href: deployment/merge-appcontrol-policies.md + - name: Enforce App Control policies + href: deployment/enforce-appcontrol-policies.md + - name: Use code signing for added control and protection with App Control href: deployment/use-code-signing-for-better-control-and-protection.md items: - - name: Deploy catalog files to support WDAC - href: deployment/deploy-catalog-files-to-support-wdac.md - - name: Use signed policies to protect Windows Defender Application Control against tampering - href: deployment/use-signed-policies-to-protect-wdac-against-tampering.md - - name: "Optional: Create a code signing cert for WDAC" - href: deployment/create-code-signing-cert-for-wdac.md - - name: Disable WDAC policies - href: deployment/disable-wdac-policies.md -- name: WDAC operational guide - href: operations/wdac-operational-guide.md + - name: Deploy catalog files to support App Control + href: deployment/deploy-catalog-files-to-support-appcontrol.md + - name: Use signed policies to protect App Control for Business against tampering + href: deployment/use-signed-policies-to-protect-appcontrol-against-tampering.md + - name: "Optional: Create a code signing cert for App Control" + href: deployment/create-code-signing-cert-for-appcontrol.md + - name: Disable App Control policies + href: deployment/disable-appcontrol-policies.md +- name: Operational guide + href: operations/appcontrol-operational-guide.md items: - - name: WDAC debugging and troubleshooting - href: operations/wdac-debugging-and-troubleshooting.md - - name: Understanding Application Control event IDs + - name: App Control debugging and troubleshooting + href: operations/appcontrol-debugging-and-troubleshooting.md + - name: Understanding App Control event IDs href: operations/event-id-explanations.md - - name: Understanding Application Control event tags + - name: Understanding App Control event tags href: operations/event-tag-explanations.md - - name: Query WDAC events with Advanced hunting + - name: Query App Control events with Advanced hunting href: operations/querying-application-control-events-centrally-using-advanced-hunting.md - name: Known Issues href: operations/known-issues.md - name: Managed installer and ISG technical reference and troubleshooting guide - href: operations/configure-wdac-managed-installer.md + href: operations/configure-appcontrol-managed-installer.md - name: CITool.exe technical reference href: operations/citool-commands.md - - name: Inbox WDAC policies - href: operations/inbox-wdac-policies.md -- name: WDAC AppId Tagging guide - href: AppIdTagging/wdac-appid-tagging-guide.md + - name: Inbox App Control policies + href: operations/inbox-appcontrol-policies.md +- name: AppId Tagging guide + href: AppIdTagging/appcontrol-appid-tagging-guide.md items: - name: Creating AppId Tagging Policies href: AppIdTagging/design-create-appid-tagging-policies.md diff --git a/windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview.md b/windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview.md new file mode 100644 index 0000000000..5520d9161c --- /dev/null +++ b/windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview.md @@ -0,0 +1,64 @@ +--- +title: App Control and AppLocker Overview +description: Compare Windows application control technologies. +ms.localizationpriority: medium +ms.date: 09/11/2024 +ms.topic: conceptual +--- + +# App Control for Business and AppLocker Overview + +[!INCLUDE [Feature availability note](includes/feature-availability-note.md)] + +Windows 10 and Windows 11 include two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: App Control for Business and AppLocker. + +## App Control for Business + +App Control was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows clients. It was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria), defined by the Microsoft Security Response Center (MSRC). + +App Control policies apply to the managed computer as a whole and affects all users of the device. App Control rules can be defined based on: + +- Attributes of the codesigning certificate(s) used to sign an app and its binaries +- Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file +- The reputation of the app as determined by Microsoft's [Intelligent Security Graph](design/use-appcontrol-with-intelligent-security-graph.md) +- The identity of the process that initiated the installation of the app and its binaries ([managed installer](design/configure-authorized-apps-deployed-with-a-managed-installer.md)) +- The [path from which the app or file is launched](design/select-types-of-rules-to-create.md#more-information-about-filepath-rules) (beginning with Windows 10 version 1903) +- The process that launched the app or binary + +> [!NOTE] +> App Control was originally released as part of Device Guard and called configurable code integrity. Device Guard and configurable code integrity are no longer used except to find where to deploy App Control policy via Group Policy. + +### App Control System Requirements + +App Control policies can be created and applied on any client edition of Windows 10 or Windows 11, or on Windows Server 2016 and higher. App Control policies can be deployed via a Mobile Device Management (MDM) solution, for example, Intune; a management interface such as Configuration Manager; or a script host such as PowerShell. Group Policy can also be used to deploy App Control policies, but is limited to single-policy format policies that work on Windows Server 2016 and 2019. + +For more information on which individual App Control features are available on specific App Control builds, see [App Control feature availability](feature-availability.md). + +## AppLocker + +AppLocker was introduced with Windows 7, and allows organizations to control which applications are allowed to run on their Windows clients. AppLocker helps to prevent end-users from running unapproved software on their computers but doesn't meet the servicing criteria for being a security feature. + +AppLocker policies can apply to all users on a computer, or to individual users and groups. AppLocker rules can be defined based on: + +- Attributes of the codesigning certificate(s) used to sign an app and its binaries. +- Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file. +- The path from which the app or file is launched. + +AppLocker is also used by some features of App Control, including [managed installer](design/configure-authorized-apps-deployed-with-a-managed-installer.md) and the [Intelligent Security Graph](design/use-appcontrol-with-intelligent-security-graph.md). + +### AppLocker System Requirements + +AppLocker policies can only be configured on and applied to devices that are running on the supported versions and editions of the Windows operating system. For more info, see [Requirements to Use AppLocker](applocker/requirements-to-use-applocker.md). +AppLocker policies can be deployed using Group Policy or MDM. + +## Choose when to use App Control or AppLocker + +Generally, customers who are able to implement application control using App Control, rather than AppLocker, should do so. App Control is undergoing continual improvements, and is getting added support from Microsoft management platforms. Although AppLocker continues to receive security fixes, it isn't getting new feature improvements. + +However, in some cases, AppLocker might be the more appropriate technology for your organization. AppLocker is best when: + +- You have a mixed Windows operating system (OS) environment and need to apply the same policy controls to Windows 10 and earlier versions of the OS. +- You need to apply different policies for different users or groups on shared computers. +- You don't want to enforce application control on application files such as DLLs or drivers. + +AppLocker can also be deployed as a complement to App Control to add user or group-specific rules for shared device scenarios, where it's important to prevent some users from running specific apps. As a best practice, you should enforce App Control at the most restrictive level possible for your organization, and then you can use AppLocker to further fine-tune the restrictions. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md b/windows/security/application-security/application-control/app-control-for-business/appcontrol.md similarity index 69% rename from windows/security/application-security/application-control/windows-defender-application-control/wdac.md rename to windows/security/application-security/application-control/app-control-for-business/appcontrol.md index 2d0145d3bc..561da483b6 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md +++ b/windows/security/application-security/application-control/app-control-for-business/appcontrol.md @@ -4,14 +4,13 @@ description: Application Control restricts which applications users are allowed ms.localizationpriority: medium ms.collection: - tier3 -ms.date: 08/30/2023 +ms.date: 09/11/2024 ms.topic: overview --- # Application Control for Windows -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). +[!INCLUDE [Feature availability note](includes/feature-availability-note.md)] With thousands of new malicious files created every day, using traditional methods like antivirus solutions-signature-based detection to fight against malware-provides an inadequate defense against new attacks. @@ -26,14 +25,14 @@ Application control is a crucial line of defense for protecting enterprises give Windows 10 and Windows 11 include two technologies that can be used for application control depending on your organization's specific scenarios and requirements: -- **Windows Defender Application Control (WDAC)**; and +- **App Control for Business**; and - **AppLocker** -## WDAC and Smart App Control +## App Control and Smart App Control -Starting in Windows 11 version 22H2, [Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) provides application control for consumers. Smart App Control is based on WDAC, allowing enterprise customers to create a policy that offers the same security and compatibility with the ability to customize it to run line-of-business (LOB) apps. To make it easier to implement this policy, an [example policy](design/example-wdac-base-policies.md) is provided. The example policy includes **Enabled:Conditional Windows Lockdown Policy** option that isn't supported for WDAC enterprise policies. This rule must be removed before you use the example policy. To use this example policy as a starting point for creating your own policy, see [Create a custom base policy using an example WDAC base policy](design/create-wdac-policy-for-lightly-managed-devices.md#create-a-custom-base-policy-using-an-example-wdac-base-policy). +Starting in Windows 11 version 22H2, [Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) provides application control for consumers. Smart App Control is based on App Control, allowing enterprise customers to create a policy that offers the same security and compatibility with the ability to customize it to run line-of-business (LOB) apps. To make it easier to implement this policy, an [example policy](design/example-appcontrol-base-policies.md) is provided. The example policy includes **Enabled:Conditional Windows Lockdown Policy** option that isn't supported for App Control enterprise policies. This rule must be removed before you use the example policy. To use this example policy as a starting point for creating your own policy, see [Create a custom base policy using an example App Control base policy](design/create-appcontrol-policy-for-lightly-managed-devices.md#create-a-custom-base-policy-using-an-example-app-control-base-policy). -Smart App Control is only available on clean installation of Windows 11 version 22H2 or later, and starts in evaluation mode. Smart App Control is automatically turned off for enterprise managed devices unless the user has turned it on first. To turn off Smart App Control across your organization's endpoints, you can set the **VerifiedAndReputablePolicyState** (DWORD) registry value under `HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy` as shown in the following table. After you change the registry value, you must either restart the device or use [CiTool.exe -r](/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands#refresh-the-wdac-policies-on-the-system) for the change to take effect. +Smart App Control is only available on clean installation of Windows 11 version 22H2 or later, and starts in evaluation mode. Smart App Control is automatically turned off for enterprise managed devices unless the user has turned it on first. To turn off Smart App Control across your organization's endpoints, you can set the **VerifiedAndReputablePolicyState** (DWORD) registry value under `HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy` as shown in the following table. After you change the registry value, you must either restart the device or use [CiTool.exe -r](operations/citool-commands.md#refresh-the-app-control-policies-on-the-system) for the change to take effect. | Value | Description | |-------|-------------| @@ -46,7 +45,7 @@ Smart App Control is only available on clean installation of Windows 11 version ### Smart App Control Enforced Blocks -Smart App Control enforces the [Microsoft Recommended Driver Block rules](design/microsoft-recommended-driver-block-rules.md) and the [Microsoft Recommended Block Rules](design/applications-that-can-bypass-wdac.md), with a few exceptions for compatibility considerations. The following aren't blocked by Smart App Control: +Smart App Control enforces the [Microsoft Recommended Driver Block rules](design/microsoft-recommended-driver-block-rules.md) and the [Microsoft Recommended Block Rules](design/applications-that-can-bypass-appcontrol.md), with a few exceptions for compatibility considerations. The following aren't blocked by Smart App Control: - Infdefaultinstall.exe - Microsoft.Build.dll @@ -57,7 +56,7 @@ Smart App Control enforces the [Microsoft Recommended Driver Block rules](design ## Related articles -- [WDAC design guide](design/wdac-design-guide.md) -- [WDAC deployment guide](deployment/wdac-deployment-guide.md) -- [WDAC operational guide](operations/wdac-operational-guide.md) +- [App Control design guide](design/appcontrol-design-guide.md) +- [App Control deployment guide](deployment/appcontrol-deployment-guide.md) +- [App Control operational guide](operations/appcontrol-operational-guide.md) - [AppLocker overview](applocker/applocker-overview.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md b/windows/security/application-security/application-control/app-control-for-business/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md similarity index 97% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md index 76569e20e6..64ec3acfbf 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md @@ -3,7 +3,7 @@ title: Add rules for packaged apps to existing AppLocker rule-set description: This article for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT). ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Add rules for packaged apps to existing AppLocker rule-set diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/administer-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/administer-applocker.md similarity index 97% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/administer-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/administer-applocker.md index a095fd7246..d2e0c1da1e 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/administer-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/administer-applocker.md @@ -3,7 +3,7 @@ title: Administer AppLocker description: This article for IT professionals provides links to specific procedures to use when administering AppLocker policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 01/03/2024 +ms.date: 09/11/2024 --- # Administer AppLocker @@ -27,11 +27,11 @@ AppLocker helps administrators control how users can access and use files, such | [Edit an AppLocker policy](edit-an-applocker-policy.md) | This article for IT professionals describes the steps required to modify an AppLocker policy. | | [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md) | This article discusses the steps required to test an AppLocker policy prior to deployment. | | [Deploy AppLocker policies by using the enforce rules setting](deploy-applocker-policies-by-using-the-enforce-rules-setting.md) | This article for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. | -| [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md) | This article for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. | +| [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md) | This article for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker policies. | | [Optimize AppLocker performance](optimize-applocker-performance.md) | This article for IT professionals describes how to optimize AppLocker policy enforcement. | | [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) | This article for IT professionals describes how to monitor app usage when AppLocker policies are applied. | | [Manage packaged apps with AppLocker](manage-packaged-apps-with-applocker.md) | This article for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy. | -| [Working with AppLocker rules](working-with-applocker-rules.md) | This article for IT professionals describes AppLocker rule types and how to work with them for your application control policies. | +| [Working with AppLocker rules](working-with-applocker-rules.md) | This article for IT professionals describes AppLocker rule types and how to work with them for your policies. | | [Working with AppLocker policies](working-with-applocker-policies.md) | This article for IT professionals provides links to procedural articles about creating, maintaining, and testing AppLocker policies. | ## Using the MMC snap-ins to administer AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-architecture-and-components.md b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-architecture-and-components.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-architecture-and-components.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/applocker-architecture-and-components.md index 763fd8e86d..7314cce2f9 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-architecture-and-components.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-architecture-and-components.md @@ -3,7 +3,7 @@ title: AppLocker architecture and components description: This article for IT professional describes AppLocker’s basic architecture and its major components. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # AppLocker architecture and components diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-functions.md b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-functions.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-functions.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/applocker-functions.md index 8ab68a0205..2ce3ad5532 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-functions.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-functions.md @@ -3,7 +3,7 @@ title: AppLocker functions description: This article for the IT professional lists the functions and security levels for AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # AppLocker functions diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview.md similarity index 92% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview.md index 654b172dca..1af7a371bb 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview.md @@ -1,23 +1,23 @@ --- title: AppLocker -description: This article provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. +description: This article provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker policies. ms.collection: - tier3 - must-keep ms.topic: conceptual ms.localizationpriority: medium -ms.date: 01/03/2024 +ms.date: 09/11/2024 --- # AppLocker -This article provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. AppLocker is also used by some features of Windows Defender Application Control. +This article provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. AppLocker is also used by some features of App Control for Business. > [!NOTE] -> AppLocker is a defense-in-depth security feature and not considered a defensible Windows [security feature](https://www.microsoft.com/msrc/windows-security-servicing-criteria). [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview) should be used when the goal is to provide robust protection against a threat and there are expected to be no by-design limitations that would prevent the security feature from achieving this goal. +> AppLocker is a defense-in-depth security feature and not considered a defensible Windows [security feature](https://www.microsoft.com/msrc/windows-security-servicing-criteria). [App Control for Business](../appcontrol-and-applocker-overview.md) should be used when the goal is to provide robust protection against a threat and there are expected to be no by-design limitations that would prevent the security feature from achieving this goal. > [!NOTE] -> By default, AppLocker policy only applies to code launched in a user's context. On Windows 10, Windows 11, and Windows Server 2016 or later, you can apply AppLocker policy to non-user processes, including those running as SYSTEM. For more information, see [AppLocker rule collection extensions](/windows/security/application-security/application-control/windows-defender-application-control/applocker/rule-collection-extensions#services-enforcement). +> By default, AppLocker policy only applies to code launched in a user's context. On Windows 10, Windows 11, and Windows Server 2016 or later, you can apply AppLocker policy to non-user processes, including those running as SYSTEM. For more information, see [AppLocker rule collection extensions](rule-collection-extensions.md#services-enforcement). AppLocker can help you: diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policies-deployment-guide.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policies-deployment-guide.md index cb437f92b7..8520621d36 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policies-deployment-guide.md @@ -3,7 +3,7 @@ title: AppLocker deployment guide description: This article for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # AppLocker deployment guide diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policies-design-guide.md b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policies-design-guide.md similarity index 83% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policies-design-guide.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policies-design-guide.md index 0299b53b2a..174ed4907c 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policies-design-guide.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policies-design-guide.md @@ -3,7 +3,7 @@ title: AppLocker design guide description: This article for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # AppLocker design guide @@ -12,14 +12,14 @@ This article for the IT professional introduces the design and planning steps re This guide provides important designing and planning information for deploying application control policies by using AppLocker. Through a sequential and iterative process, you can create an AppLocker policy deployment plan for your organization that addresses your specific application control requirements by department, organizational unit, or business group. -To understand if AppLocker is the correct application control solution for your organization, see [Windows Defender Application Control and AppLocker overview](/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview). +To understand if AppLocker is the correct application control solution for your organization, see [App Control for Business and AppLocker overview](../appcontrol-and-applocker-overview.md). ## In this section | Article | Description | | --- | --- | | [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md) | This article describes AppLocker design questions, possible answers, and other considerations when you plan a deployment of application control policies by using AppLocker. | -| [Determine your application control objectives](determine-your-application-control-objectives.md) | This article helps you with the decisions you need to make to determine what applications to control and how to control them using AppLocker. | +| [Determine your application control objectives](../appcontrol-and-applocker-overview.md) | This article helps you with the decisions you need to make to determine what applications to control and how to control them using AppLocker. | | [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) | This article describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. | | [Select the types of rules to create](select-types-of-rules-to-create.md) | This article lists resources you can use when selecting your application control policy rules by using AppLocker. | | [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) | This overview article describes the process to follow when you're planning to deploy AppLocker rules. | diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policy-use-scenarios.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policy-use-scenarios.md index a2776beaac..0d11e182ca 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-policy-use-scenarios.md @@ -3,7 +3,7 @@ title: AppLocker policy use scenarios description: This article for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # AppLocker policy use scenarios diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-processes-and-interactions.md b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-processes-and-interactions.md similarity index 94% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-processes-and-interactions.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/applocker-processes-and-interactions.md index 36cd302f29..4bc0bd0949 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-processes-and-interactions.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-processes-and-interactions.md @@ -3,13 +3,12 @@ title: AppLocker processes and interactions description: This article for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # AppLocker processes and interactions -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] This article for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. @@ -77,7 +76,7 @@ There are three different types of conditions that can be applied to rules: An AppLocker policy is a set of rule collections and their corresponding configured enforcement mode settings applied to one or more computers. -- [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md) +- [Understand AppLocker enforcement settings](working-with-applocker-rules.md#enforcement-modes) Rule enforcement is applied only to collections of rules, not individual rules. AppLocker divides the rules into four collections: executable files, Windows Installer files, scripts, and DLL files. The options for rule enforcement are **Not configured**, **Enforce rules**, or **Audit only**. Together, all AppLocker rule collections compose the application control policy, or AppLocker policy. By default, if enforcement isn't configured and rules are present in a rule collection, those rules are enforced. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-technical-reference.md b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-technical-reference.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-technical-reference.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/applocker-technical-reference.md index 0952a3d433..5dd3820526 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-technical-reference.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-technical-reference.md @@ -3,7 +3,7 @@ title: AppLocker technical reference description: This overview article for IT professionals provides links to the articles in the technical reference. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # AppLocker technical reference diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/security/application-security/application-control/app-control-for-business/applocker/configure-an-applocker-policy-for-audit-only.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/configure-an-applocker-policy-for-audit-only.md index b6654f9688..422f3a9acd 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/configure-an-applocker-policy-for-audit-only.md @@ -3,7 +3,7 @@ title: Configure an AppLocker policy for audit only description: This article for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Configure an AppLocker policy for audit only diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md b/windows/security/application-security/application-control/app-control-for-business/applocker/configure-an-applocker-policy-for-enforce-rules.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/configure-an-applocker-policy-for-enforce-rules.md index 5762b9c128..07c51af5bb 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/configure-an-applocker-policy-for-enforce-rules.md @@ -3,7 +3,7 @@ title: Configure an AppLocker policy for enforce rules description: This article for IT professionals describes the steps to enable the AppLocker policy enforcement setting. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Configure an AppLocker policy for enforce rules diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md b/windows/security/application-security/application-control/app-control-for-business/applocker/configure-exceptions-for-an-applocker-rule.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/configure-exceptions-for-an-applocker-rule.md index 3e1a1dcca4..11900e02c0 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/configure-exceptions-for-an-applocker-rule.md @@ -3,7 +3,7 @@ title: Add exceptions for an AppLocker rule description: This article for IT professionals describes the steps to specify which apps can or can't run as exceptions to an AppLocker rule. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Add exceptions for an AppLocker rule diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md b/windows/security/application-security/application-control/app-control-for-business/applocker/configure-the-appLocker-reference-device.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/configure-the-appLocker-reference-device.md index 9ad52b4cd3..f6acca16ba 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/configure-the-appLocker-reference-device.md @@ -3,7 +3,7 @@ title: Configure the AppLocker reference device description: This article for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Configure the AppLocker reference device diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-application-identity-service.md b/windows/security/application-security/application-control/app-control-for-business/applocker/configure-the-application-identity-service.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-application-identity-service.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/configure-the-application-identity-service.md index b31f8f059d..c4156e9b57 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-application-identity-service.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/configure-the-application-identity-service.md @@ -3,7 +3,7 @@ title: Configure the Application Identity service description: This article for IT professionals shows how to configure the Application Identity service to start automatically or manually. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Configure the Application Identity service diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md b/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-for-packaged-apps.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-for-packaged-apps.md index 6f06404070..07fd6f2866 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-for-packaged-apps.md @@ -3,7 +3,7 @@ title: Create a rule for packaged apps description: This article for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Create a rule for packaged apps diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md b/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-file-hash-condition.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-file-hash-condition.md index a486b03055..b764bb0493 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-file-hash-condition.md @@ -3,7 +3,7 @@ title: Create a rule that uses a file hash condition description: This article for IT professionals shows how to create an AppLocker rule with a file hash condition. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Create a rule that uses a file hash condition diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md b/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-path-condition.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-path-condition.md index c90bf8fe32..fe26c1ee6a 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-path-condition.md @@ -3,7 +3,7 @@ title: Create a rule that uses a path condition description: This article for IT professionals shows how to create an AppLocker rule with a path condition. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Create a rule that uses a path condition diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md b/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-publisher-condition.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-publisher-condition.md index 8da8f1de23..9b07438ec7 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/create-a-rule-that-uses-a-publisher-condition.md @@ -3,7 +3,7 @@ title: Create a rule that uses a publisher condition description: This article for IT professionals shows how to create an AppLocker rule with a publisher condition. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Create a rule that uses a publisher condition diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-applocker-default-rules.md b/windows/security/application-security/application-control/app-control-for-business/applocker/create-applocker-default-rules.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/create-applocker-default-rules.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/create-applocker-default-rules.md index b6ddfb364e..fd2aa8e292 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-applocker-default-rules.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/create-applocker-default-rules.md @@ -3,7 +3,7 @@ title: Create AppLocker default rules description: This article for IT professionals describes the steps to create a standard set of AppLocker rules that allow Windows system files to run. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Create AppLocker default rules diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md b/windows/security/application-security/application-control/app-control-for-business/applocker/create-list-of-applications-deployed-to-each-business-group.md similarity index 97% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/create-list-of-applications-deployed-to-each-business-group.md index de0b5c522f..f015e79882 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/create-list-of-applications-deployed-to-each-business-group.md @@ -3,7 +3,7 @@ title: Create a list of apps deployed to each business group description: This article describes the process of gathering app usage requirements from each business group to implement application control policies by using AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Gathering app usage requirements @@ -30,7 +30,7 @@ Using the Automatically Generate Rules wizard quickly creates rules for the appl Using the **Audit only** enforcement method permits you to view the logs because it collects information about every process on the computers receiving the Group Policy Object (GPO). Therefore, you can evaluate the possible effects of enforcement on computers in a business group. AppLocker includes Windows PowerShell cmdlets that you can use to analyze the events from the event log and cmdlets to create rules. However, when you use Group Policy to deploy to several computers, a means to collect events in a central location is important for manageability. Because AppLocker logs information about files that users or other processes start on a computer, you could miss creating some rules initially. Therefore, you should continue your evaluation until you can verify that all required applications that are allowed to run are accessed successfully. > [!TIP] -> If you run Application Verifier against a custom application with any AppLocker policies enabled, it might prevent the application from running. You should either disable Application Verifier or AppLocker. +> If you run Application Verifier against a custom application with any AppLocker policies enabled, it might prevent the application from running. You should either disable Application Verifier or AppLocker. You can create an inventory of Packaged apps on a device by using two methods: the **Get-AppxPackage** Windows PowerShell cmdlet or the AppLocker console. @@ -44,7 +44,7 @@ The following articles describe how to perform each method: Identify the business group and each organizational unit (OU) within that group for application control policies. In addition, you should identify whether or not AppLocker is the most appropriate solution for these policies. For info about these steps, see the following articles: - [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md) -- [Determine your application control objectives](determine-your-application-control-objectives.md) +- [Determine your application control objectives](../appcontrol-and-applocker-overview.md) ## Next steps diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-your-applocker-policies.md b/windows/security/application-security/application-control/app-control-for-business/applocker/create-your-applocker-policies.md similarity index 97% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/create-your-applocker-policies.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/create-your-applocker-policies.md index 1b14478169..69119137f4 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-your-applocker-policies.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/create-your-applocker-policies.md @@ -3,7 +3,7 @@ title: Create Your AppLocker policies description: This overview article for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Create Your AppLocker policies @@ -18,7 +18,7 @@ You can develop an application control policy plan to guide you in making succes 1. [Understand the AppLocker policy deployment process](understand-the-applocker-policy-deployment-process.md) 2. [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md) -3. [Determine your application control objectives](determine-your-application-control-objectives.md) +3. [Determine your application control objectives](../appcontrol-and-applocker-overview.md) 4. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) 5. [Select the types of rules to create](select-types-of-rules-to-create.md) 6. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-your-applocker-rules.md b/windows/security/application-security/application-control/app-control-for-business/applocker/create-your-applocker-rules.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/create-your-applocker-rules.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/create-your-applocker-rules.md index e04367462f..415e9582f8 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-your-applocker-rules.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/create-your-applocker-rules.md @@ -3,7 +3,7 @@ title: Create Your AppLocker rules description: This article for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Create Your AppLocker rules diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/delete-an-applocker-rule.md b/windows/security/application-security/application-control/app-control-for-business/applocker/delete-an-applocker-rule.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/delete-an-applocker-rule.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/delete-an-applocker-rule.md index 0c7ba5799c..95836e5b28 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/delete-an-applocker-rule.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/delete-an-applocker-rule.md @@ -3,7 +3,7 @@ title: Delete an AppLocker rule description: This article for IT professionals describes the steps to delete an AppLocker rule. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Delete an AppLocker rule diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/security/application-security/application-control/app-control-for-business/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md similarity index 92% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md index e974fdf194..83e603b364 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md @@ -3,7 +3,7 @@ title: Deploy AppLocker policies by using the enforce rules setting description: This article for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 01/03/2024 +ms.date: 09/11/2024 --- # Deploy AppLocker policies by using the enforce rules setting @@ -14,7 +14,7 @@ This article for IT professionals describes the steps to deploy AppLocker polici These procedures assume that your AppLocker policies are deployed with the enforcement mode set to **Audit only**, and you have been collecting data through the AppLocker event logs and other channels to determine what effect these policies have on your environment and the policy's adherence to your application control design. -For info about the AppLocker policy enforcement setting, see [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md). +For info about the AppLocker policy enforcement setting, see [Understand AppLocker enforcement settings](working-with-applocker-rules.md#enforcement-modes). For info about how to plan an AppLocker policy deployment, see [AppLocker Design Guide](applocker-policies-design-guide.md). @@ -24,7 +24,7 @@ Updating an AppLocker policy that is currently enforced in your production envir ## Step 2: Alter the enforcement setting -Rule enforcement is applied to all rules within a rule collection, not to individual rules. AppLocker divides the rules into collections: executable files, Windows Installer files, packaged apps, scripts, and DLL files. For information about the enforcement mode setting, see [Understand AppLocker Enforcement Settings](understand-applocker-enforcement-settings.md). For the procedure to alter the enforcement mode setting, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md). +Rule enforcement is applied to all rules within a rule collection, not to individual rules. AppLocker divides the rules into collections: executable files, Windows Installer files, packaged apps, scripts, and DLL files. For information about the enforcement mode setting, see [Understand AppLocker Enforcement Settings](working-with-applocker-rules.md#enforcement-modes). For the procedure to alter the enforcement mode setting, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md). ## Step 3: Update the policy diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md b/windows/security/application-security/application-control/app-control-for-business/applocker/deploy-the-applocker-policy-into-production.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/deploy-the-applocker-policy-into-production.md index d2ef52adad..941a047e99 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/deploy-the-applocker-policy-into-production.md @@ -3,7 +3,7 @@ title: Deploy the AppLocker policy into production description: This article for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Deploy the AppLocker policy into production diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md b/windows/security/application-security/application-control/app-control-for-business/applocker/determine-group-policy-structure-and-rule-enforcement.md similarity index 87% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/determine-group-policy-structure-and-rule-enforcement.md index fb13e22d88..29380fe1e1 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/determine-group-policy-structure-and-rule-enforcement.md @@ -3,7 +3,7 @@ title: Determine the Group Policy structure and rule enforcement description: This overview article describes the process to follow when you're planning to deploy AppLocker rules. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Determine the Group Policy structure and rule enforcement @@ -14,7 +14,7 @@ This overview article describes the process to follow when you're planning to de | Article | Description | | --- | --- | -| [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md) | This article describes the AppLocker enforcement settings for rule collections. | +| [Understand AppLocker enforcement settings](working-with-applocker-rules.md#enforcement-modes) | This article describes the AppLocker enforcement settings for rule collections. | | [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md) | This article for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy.| | [Document the Group Policy structure and AppLocker rule enforcement](document-group-policy-structure-and-applocker-rule-enforcement.md) | This planning article describes what you need to investigate, determine, and document for your policy plan when you use AppLocker. | diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/security/application-security/application-control/app-control-for-business/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md index 56fef83f74..e1c6c88c0a 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md @@ -3,7 +3,7 @@ title: Find digitally signed apps on a reference device description: This article for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Determine which apps are digitally signed on a reference device diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md b/windows/security/application-security/application-control/app-control-for-business/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md index 64307b01ba..bf1a962a76 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md @@ -3,7 +3,7 @@ title: Display a custom URL message when users try to run a blocked app description: This article for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy blocks an app. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Display a custom URL message when users try to run a blocked app diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/dll-rules-in-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/dll-rules-in-applocker.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/dll-rules-in-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/dll-rules-in-applocker.md index 36da65e276..054c18fb61 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/dll-rules-in-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/dll-rules-in-applocker.md @@ -3,7 +3,7 @@ title: DLL rules in AppLocker description: This article describes the file formats and available default rules for the DLL rule collection. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # DLL rules in AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/security/application-security/application-control/app-control-for-business/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md similarity index 95% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md index 294689bc28..b440a69b68 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md @@ -3,7 +3,7 @@ title: Document Group Policy structure & AppLocker rule enforcement description: This planning article describes what you need to include in your plan when you use AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Document the Group Policy structure and AppLocker rule enforcement @@ -14,7 +14,7 @@ This planning article describes what you should include in your plan when you us To complete this AppLocker planning document, you should first complete the following steps: -1. [Determine your application control objectives](determine-your-application-control-objectives.md) +1. [Determine your application control objectives](../appcontrol-and-applocker-overview.md) 2. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) 3. [Select the types of rules to create](select-types-of-rules-to-create.md) 4. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/document-your-application-list.md b/windows/security/application-security/application-control/app-control-for-business/applocker/document-your-application-list.md similarity index 97% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/document-your-application-list.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/document-your-application-list.md index f42d12d410..00e357875d 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/document-your-application-list.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/document-your-application-list.md @@ -3,7 +3,7 @@ title: Document your app list description: This planning article describes the app information that you should document when you create a list of apps for AppLocker policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Document your app list @@ -14,7 +14,7 @@ This planning article describes the app information that you should document whe ### Apps -Record the name of the app, its publisher information (if digitally signed), and its importance to the business. +Record the name of the app, its publisher information (if digitally signed), and its importance to the business. ### Installation path diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/document-your-applocker-rules.md b/windows/security/application-security/application-control/app-control-for-business/applocker/document-your-applocker-rules.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/document-your-applocker-rules.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/document-your-applocker-rules.md index 1d5ff7d78e..efd0c0211f 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/document-your-applocker-rules.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/document-your-applocker-rules.md @@ -3,7 +3,7 @@ title: Document your AppLocker rules description: Learn how to document your AppLocker rules and associate rule conditions with files, permissions, rule source, and implementation. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Document your AppLocker rules diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/edit-an-applocker-policy.md b/windows/security/application-security/application-control/app-control-for-business/applocker/edit-an-applocker-policy.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/edit-an-applocker-policy.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/edit-an-applocker-policy.md index fe3ac2062b..3ebf404dc6 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/edit-an-applocker-policy.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/edit-an-applocker-policy.md @@ -3,7 +3,7 @@ title: Edit an AppLocker policy description: This article for IT professionals describes the steps required to modify an AppLocker policy. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 01/03/2024 +ms.date: 09/11/2024 --- # Edit an AppLocker policy diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/edit-applocker-rules.md b/windows/security/application-security/application-control/app-control-for-business/applocker/edit-applocker-rules.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/edit-applocker-rules.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/edit-applocker-rules.md index 111678d496..7ae6e91083 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/edit-applocker-rules.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/edit-applocker-rules.md @@ -3,7 +3,7 @@ title: Edit AppLocker rules description: This article for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Edit AppLocker rules diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md b/windows/security/application-security/application-control/app-control-for-business/applocker/enable-the-dll-rule-collection.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/enable-the-dll-rule-collection.md index d48deeaad8..c2569a0918 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/enable-the-dll-rule-collection.md @@ -3,7 +3,7 @@ title: Enable the DLL rule collection description: This article for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Enable the DLL rule collection diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/enforce-applocker-rules.md b/windows/security/application-security/application-control/app-control-for-business/applocker/enforce-applocker-rules.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/enforce-applocker-rules.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/enforce-applocker-rules.md index 757d76eb6c..2abb621ddc 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/enforce-applocker-rules.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/enforce-applocker-rules.md @@ -3,7 +3,7 @@ title: Enforce AppLocker rules description: This article for IT professionals describes how to enforce application control rules by using AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Enforce AppLocker rules diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/executable-rules-in-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/executable-rules-in-applocker.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/executable-rules-in-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/executable-rules-in-applocker.md index e90dc2b98e..99ffe04a6d 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/executable-rules-in-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/executable-rules-in-applocker.md @@ -3,7 +3,7 @@ title: Executable rules in AppLocker description: This article describes the file formats and available default rules for the executable rule collection. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Executable rules in AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md b/windows/security/application-security/application-control/app-control-for-business/applocker/export-an-applocker-policy-from-a-gpo.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/export-an-applocker-policy-from-a-gpo.md index b4150f2544..c9fe560838 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/export-an-applocker-policy-from-a-gpo.md @@ -3,7 +3,7 @@ title: Export an AppLocker policy from a GPO description: This article for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Export an AppLocker policy from a GPO diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md b/windows/security/application-security/application-control/app-control-for-business/applocker/export-an-applocker-policy-to-an-xml-file.md similarity index 97% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/export-an-applocker-policy-to-an-xml-file.md index 9612096a6e..106a4d836e 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/export-an-applocker-policy-to-an-xml-file.md @@ -3,7 +3,7 @@ title: Export an AppLocker policy to an XML file description: This article for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Export an AppLocker policy to an XML file diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/how-applocker-works-techref.md b/windows/security/application-security/application-control/app-control-for-business/applocker/how-applocker-works-techref.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/how-applocker-works-techref.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/how-applocker-works-techref.md index b2f3e10097..c704a9e977 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/how-applocker-works-techref.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/how-applocker-works-techref.md @@ -3,7 +3,7 @@ title: How AppLocker works description: This article for the IT professional provides links to articles about AppLocker architecture and components, processes and interactions, rules and policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # How AppLocker works diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/images/applocker-plan-inheritance.gif b/windows/security/application-security/application-control/app-control-for-business/applocker/images/applocker-plan-inheritance.gif similarity index 100% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/images/applocker-plan-inheritance.gif rename to windows/security/application-security/application-control/app-control-for-business/applocker/images/applocker-plan-inheritance.gif diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/images/applocker-plandeploy-quickreference.gif b/windows/security/application-security/application-control/app-control-for-business/applocker/images/applocker-plandeploy-quickreference.gif similarity index 100% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/images/applocker-plandeploy-quickreference.gif rename to windows/security/application-security/application-control/app-control-for-business/applocker/images/applocker-plandeploy-quickreference.gif diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/images/blockedappmsg.gif b/windows/security/application-security/application-control/app-control-for-business/applocker/images/blockedappmsg.gif similarity index 100% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/images/blockedappmsg.gif rename to windows/security/application-security/application-control/app-control-for-business/applocker/images/blockedappmsg.gif diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md b/windows/security/application-security/application-control/app-control-for-business/applocker/import-an-applocker-policy-from-another-computer.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/import-an-applocker-policy-from-another-computer.md index 6998942c9b..2472b7892c 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/import-an-applocker-policy-from-another-computer.md @@ -3,7 +3,7 @@ title: Import an AppLocker policy from another computer description: This article for IT professionals describes how to import an AppLocker policy. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Import an AppLocker policy from another computer diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md b/windows/security/application-security/application-control/app-control-for-business/applocker/import-an-applocker-policy-into-a-gpo.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/import-an-applocker-policy-into-a-gpo.md index cf00b805b3..039d978649 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/import-an-applocker-policy-into-a-gpo.md @@ -3,7 +3,7 @@ title: Import an AppLocker policy into a GPO description: This article for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Import an AppLocker policy into a GPO diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/maintain-applocker-policies.md b/windows/security/application-security/application-control/app-control-for-business/applocker/maintain-applocker-policies.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/maintain-applocker-policies.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/maintain-applocker-policies.md index 75f6df943a..a4926c5f73 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/maintain-applocker-policies.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/maintain-applocker-policies.md @@ -3,7 +3,7 @@ title: Maintain AppLocker policies description: Learn how to maintain rules within AppLocker policies. View common AppLocker maintenance scenarios and see the methods to use to maintain AppLocker policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 01/03/2024 +ms.date: 09/11/2024 --- # Maintain AppLocker policies diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/manage-packaged-apps-with-applocker.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/manage-packaged-apps-with-applocker.md index f190ea35b7..b3e041a0f1 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/manage-packaged-apps-with-applocker.md @@ -3,7 +3,7 @@ title: Manage packaged apps with AppLocker description: Learn concepts and lists procedures to help you manage packaged apps with AppLocker as part of your overall application control strategy. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/20/2023 +ms.date: 09/11/2024 --- # Manage packaged apps with AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md b/windows/security/application-security/application-control/app-control-for-business/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md similarity index 89% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md index 2489e8b738..4df24222a0 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md @@ -3,14 +3,14 @@ title: Merge AppLocker policies by using Set-ApplockerPolicy description: This article for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Merge AppLocker policies by using Set-ApplockerPolicy This article for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. -The **Set-AppLockerPolicy** cmdlet sets the specified Group Policy Object (GPO) to contain the specified AppLocker policy. If no Lightweight Directory Access Protocol (LDAP) is specified, the local policy is used. When the Merge parameter is used, rules in the specified AppLocker policy are merged with the AppLocker rules in the target GPO specified in the LDAP path. Merging policies removes rules with duplicate rule IDs, and the enforcement mode setting is chosen as described in [Working with AppLocker rules](/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules#enforcement-modes). If the Merge parameter isn't specified, then the new policy overwrites the existing policy. +The **Set-AppLockerPolicy** cmdlet sets the specified Group Policy Object (GPO) to contain the specified AppLocker policy. If no Lightweight Directory Access Protocol (LDAP) is specified, the local policy is used. When the Merge parameter is used, rules in the specified AppLocker policy are merged with the AppLocker rules in the target GPO specified in the LDAP path. Merging policies removes rules with duplicate rule IDs, and the enforcement mode setting is chosen as described in [Working with AppLocker rules](working-with-applocker-rules.md#enforcement-modes). If the Merge parameter isn't specified, then the new policy overwrites the existing policy. For info about using **Set-AppLockerPolicy**, including syntax descriptions and parameters, see [Set-AppLockerPolicy](/powershell/module/applocker/set-applockerpolicy). diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/merge-applocker-policies-manually.md b/windows/security/application-security/application-control/app-control-for-business/applocker/merge-applocker-policies-manually.md similarity index 79% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/merge-applocker-policies-manually.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/merge-applocker-policies-manually.md index a17f0dbc2f..324bef3248 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/merge-applocker-policies-manually.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/merge-applocker-policies-manually.md @@ -3,7 +3,7 @@ title: Merge AppLocker policies manually description: This article for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Merge AppLocker policies manually @@ -12,7 +12,7 @@ This article for IT professionals describes the steps to manually merge AppLocke If you need to merge multiple AppLocker policies into a single one, you can either manually merge the policies or use the Windows PowerShell cmdlets for AppLocker. You can't automatically merge policies by using the AppLocker console. For info about merging policies by using Windows PowerShell, see [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md). -The AppLocker policy is stored in XML format, and an exported policy can be edited with any text or XML editor. To export an AppLocker policy, see [Export an AppLocker policy to an XML file](/windows/security/application-security/application-control/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file). Before making changes to an AppLocker policy manually, review [Working with AppLocker rules](/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules). +The AppLocker policy is stored in XML format, and an exported policy can be edited with any text or XML editor. To export an AppLocker policy, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md). Before making changes to an AppLocker policy manually, review [Working with AppLocker rules](working-with-applocker-rules.md). Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/monitor-application-usage-with-applocker.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/monitor-application-usage-with-applocker.md index 984bdf95d2..14b704afe3 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/monitor-application-usage-with-applocker.md @@ -3,7 +3,7 @@ title: Monitor app usage with AppLocker description: This article for IT professionals describes how to monitor app usage when AppLocker policies are applied. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/19/2023 +ms.date: 09/11/2024 --- # Monitor app usage with AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/optimize-applocker-performance.md b/windows/security/application-security/application-control/app-control-for-business/applocker/optimize-applocker-performance.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/optimize-applocker-performance.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/optimize-applocker-performance.md index 63277272b1..f160bda367 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/optimize-applocker-performance.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/optimize-applocker-performance.md @@ -3,7 +3,7 @@ title: Optimize AppLocker performance description: This article for IT professionals describes how to optimize AppLocker policy enforcement. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 01/03/2024 +ms.date: 09/11/2024 --- # Optimize AppLocker performance diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md index d084a76681..7085567383 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md @@ -3,7 +3,7 @@ title: Packaged apps and packaged app installer rules in AppLocker description: This article explains the AppLocker rule collection for packaged app installers and packaged apps. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Packaged apps and packaged app installer rules in AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/application-security/application-control/app-control-for-business/applocker/plan-for-applocker-policy-management.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/plan-for-applocker-policy-management.md index d82b85d412..51f30ea841 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/plan-for-applocker-policy-management.md @@ -3,7 +3,7 @@ title: Plan for AppLocker policy management description: This article describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Plan for AppLocker policy management @@ -58,7 +58,7 @@ AppLocker event log is located in the following path: **Applications and Service 2. **MSI and Script**. Contains events for all files affected by the Windows Installer and script rule collections (.msi, .msp, .ps1, .bat, .cmd, .vbs, and .js). 3. **Packaged app-Deployment** or **Packaged app-Execution**, contains events for all Universal Windows apps affected by the packaged app and packed app installer rule collection (.appx). -Collecting these events in a central location can help you maintain your AppLocker policy and troubleshoot rule configuration problems. +Collecting these events in a central location can help you maintain your AppLocker policy and troubleshoot rule configuration problems. ### Policy maintenance @@ -101,7 +101,7 @@ Before editing the rule collection, first determine what rule is preventing the To complete this AppLocker planning document, you should first complete the following steps: -1. [Determine your application control objectives](determine-your-application-control-objectives.md) +1. [Determine your application control objectives](../appcontrol-and-applocker-overview.md) 2. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) 3. [Select the types of rules to create](select-types-of-rules-to-create.md) 4. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/refresh-an-applocker-policy.md b/windows/security/application-security/application-control/app-control-for-business/applocker/refresh-an-applocker-policy.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/refresh-an-applocker-policy.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/refresh-an-applocker-policy.md index 4dcd7f89ab..5d2df1f250 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/refresh-an-applocker-policy.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/refresh-an-applocker-policy.md @@ -3,7 +3,7 @@ title: Refresh an AppLocker policy description: This article for IT professionals describes the steps to force an update for an AppLocker policy. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Refresh an AppLocker policy diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md b/windows/security/application-security/application-control/app-control-for-business/applocker/requirements-for-deploying-applocker-policies.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/requirements-for-deploying-applocker-policies.md index eb55e89166..2caf917483 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/requirements-for-deploying-applocker-policies.md @@ -3,7 +3,7 @@ title: Requirements for deploying AppLocker policies description: This deployment article for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Requirements for deploying AppLocker policies diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-to-use-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/requirements-to-use-applocker.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-to-use-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/requirements-to-use-applocker.md index 3d5dcd1008..7bb94f1197 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-to-use-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/requirements-to-use-applocker.md @@ -3,7 +3,7 @@ title: Requirements to use AppLocker description: This article for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Requirements to use AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/rule-collection-extensions.md b/windows/security/application-security/application-control/app-control-for-business/applocker/rule-collection-extensions.md similarity index 86% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/rule-collection-extensions.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/rule-collection-extensions.md index f8756d82ac..e4481ab2c7 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/rule-collection-extensions.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/rule-collection-extensions.md @@ -6,7 +6,7 @@ ms.collection: - must-keep ms.topic: conceptual ms.localizationpriority: medium -ms.date: 06/07/2024 +ms.date: 09/11/2024 --- # AppLocker rule collection extensions @@ -29,7 +29,7 @@ This article describes the rule collection extensions added in Windows 10 and la ## Services enforcement -By default, AppLocker policy only applies to code running in a user's context. On Windows 10, Windows 11, and Windows Server 2016 or later, you can apply AppLocker policy to nonuser processes, including services running as SYSTEM. You must enable services enforcement when using AppLocker with Windows Defender Application Control's (WDAC) [managed installer](/windows/security/application-security/application-control/windows-defender-application-control/design/configure-authorized-apps-deployed-with-a-managed-installer) feature. +By default, AppLocker policy only applies to code running in a user's context. On Windows 10, Windows 11, and Windows Server 2016 or later, you can apply AppLocker policy to nonuser processes, including services running as SYSTEM. You must enable services enforcement when using AppLocker with App Control for Business's [managed installer](../design/configure-authorized-apps-deployed-with-a-managed-installer.md) feature. To apply AppLocker policy to nonuser processes, set ```` in the ```` section as shown in the preceding XML fragment. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md b/windows/security/application-security/application-control/app-control-for-business/applocker/run-the-automatically-generate-rules-wizard.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/run-the-automatically-generate-rules-wizard.md index d4d62202c4..3108458c0f 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/run-the-automatically-generate-rules-wizard.md @@ -3,7 +3,7 @@ title: Run the Automatically Generate Rules wizard description: This article for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Run the Automatically Generate Rules wizard diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/script-rules-in-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/script-rules-in-applocker.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/script-rules-in-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/script-rules-in-applocker.md index 0343d4d644..bc342eba8b 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/script-rules-in-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/script-rules-in-applocker.md @@ -3,7 +3,7 @@ title: Script rules in AppLocker description: This article describes the file formats and available default rules for the script rule collection. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Script rules in AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/security-considerations-for-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/security-considerations-for-applocker.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/security-considerations-for-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/security-considerations-for-applocker.md index 0422c26a4d..6a11796ca7 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/security-considerations-for-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/security-considerations-for-applocker.md @@ -3,7 +3,7 @@ title: Security considerations for AppLocker description: This article for the IT professional describes the security considerations you need to address when implementing AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Security considerations for AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/select-types-of-rules-to-create.md b/windows/security/application-security/application-control/app-control-for-business/applocker/select-types-of-rules-to-create.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/select-types-of-rules-to-create.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/select-types-of-rules-to-create.md index 6c5dde6cc8..8000ce41d4 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/select-types-of-rules-to-create.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/select-types-of-rules-to-create.md @@ -3,7 +3,7 @@ title: Select the types of rules to create description: This article lists resources you can use when selecting your application control policy rules by using AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Select the types of rules to create diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/security/application-security/application-control/app-control-for-business/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md index 180145ef77..c7042db13e 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md @@ -3,7 +3,7 @@ title: Test an AppLocker policy by using Test-AppLockerPolicy description: This article for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Test an AppLocker policy by using Test-AppLockerPolicy diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md b/windows/security/application-security/application-control/app-control-for-business/applocker/test-and-update-an-applocker-policy.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/test-and-update-an-applocker-policy.md index e47477a31a..00e03f5081 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/test-and-update-an-applocker-policy.md @@ -3,7 +3,7 @@ title: Test and update an AppLocker policy description: This article discusses the steps required to test an AppLocker policy prior to deployment. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 01/03/2024 +ms.date: 09/11/2024 --- # Test and update an AppLocker policy diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/tools-to-use-with-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/tools-to-use-with-applocker.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/tools-to-use-with-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/tools-to-use-with-applocker.md index 38354ddb98..5b1ed0083d 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/tools-to-use-with-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/tools-to-use-with-applocker.md @@ -3,7 +3,7 @@ title: Tools to use with AppLocker description: This article for the IT professional describes the tools available to create and administer AppLocker policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Tools to use with AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understand-applocker-policy-design-decisions.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understand-applocker-policy-design-decisions.md index 898b41da58..3cc00fdf6e 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understand-applocker-policy-design-decisions.md @@ -3,7 +3,7 @@ title: Understand AppLocker policy design decisions description: Review some common considerations while you're planning to use AppLocker to deploy application control policies within a Windows environment. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Understand AppLocker policy design decisions diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md similarity index 93% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index e2740a5bf6..89f62e0cb9 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -3,14 +3,14 @@ title: Understand AppLocker rules and enforcement setting inheritance in Group P description: This article for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Understand AppLocker rules and enforcement setting inheritance in Group Policy This article for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. -Rule enforcement is applied only to collections of rules, not individual rules. For more info on rule collections, see [AppLocker rule collections](/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules#rule-collections). +Rule enforcement is applied only to collections of rules, not individual rules. For more info on rule collections, see [AppLocker rule collections](working-with-applocker-rules.md#rule-collections). Group Policy merges AppLocker policy in two ways: diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understand-the-applocker-policy-deployment-process.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understand-the-applocker-policy-deployment-process.md index 3340e10f44..43e63220e5 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understand-the-applocker-policy-deployment-process.md @@ -3,7 +3,7 @@ title: Understand the AppLocker policy deployment process description: This planning and deployment article for the IT professional describes the process for using AppLocker when deploying application control policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Understand the AppLocker policy deployment process diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md index bd84599f4e..86c795601f 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md @@ -3,7 +3,7 @@ title: Understanding AppLocker allow and deny actions on rules description: This article explains the differences between allow and deny actions on AppLocker rules. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Understanding AppLocker allow and deny actions on rules diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-default-rules.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-default-rules.md similarity index 95% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-default-rules.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-default-rules.md index b70374af0f..67b52608e3 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-default-rules.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-default-rules.md @@ -3,7 +3,7 @@ title: Understanding AppLocker default rules description: This article for IT professional describes the set of rules that can be used to ensure that required Windows system files continue to run when the policy is applied. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Understanding AppLocker default rules @@ -29,9 +29,9 @@ These permissions settings are applied to this folder for app compatibility. How | --- | --- | | [Executable rules in AppLocker](executable-rules-in-applocker.md) | This article describes the file formats and available default rules for the executable rule collection. | | [Windows Installer rules in AppLocker](windows-installer-rules-in-applocker.md) | This article describes the file formats and available default rules for the Windows Installer rule collection.| -| [Script rules in AppLocker](script-rules-in-applocker.md) | This article describes the file formats and available default rules for the script rule collection.| -| [DLL rules in AppLocker](dll-rules-in-applocker.md) | This article describes the file formats and available default rules for the DLL rule collection.| -| [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md) | This article explains the AppLocker rule collection for packaged app installers and packaged apps.| +| [Script rules in AppLocker](script-rules-in-applocker.md) | This article describes the file formats and available default rules for the script rule collection.| +| [DLL rules in AppLocker](dll-rules-in-applocker.md) | This article describes the file formats and available default rules for the DLL rule collection.| +| [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md) | This article explains the AppLocker rule collection for packaged app installers and packaged apps.| ## Related articles diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-behavior.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-behavior.md index e97d2e0962..0d9b08e51c 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-behavior.md @@ -3,7 +3,7 @@ title: Understanding AppLocker rule behavior description: This article describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Understanding AppLocker rule behavior diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-collections.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-collections.md index bd418d4ce7..8ee9ed92d5 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-collections.md @@ -3,7 +3,7 @@ title: Understanding AppLocker rule collections description: This article explains the five different types of AppLocker rule collections used to enforce AppLocker policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Understanding AppLocker rule collections diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-condition-types.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-condition-types.md index 2c4967a466..1bbbc6329c 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-condition-types.md @@ -3,7 +3,7 @@ title: Understanding AppLocker rule condition types description: This article for the IT professional describes the three types of AppLocker rule conditions. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Understanding AppLocker rule condition types diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-exceptions.md similarity index 94% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-exceptions.md index 2df99102d0..b95fadae6e 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-rule-exceptions.md @@ -3,7 +3,7 @@ title: Understanding AppLocker rule exceptions description: This article describes the result of applying AppLocker rule exceptions to rule collections. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Understanding AppLocker rule exceptions @@ -14,8 +14,8 @@ This article describes the result of applying AppLocker rule exceptions to rule You can apply AppLocker rules to individual users or a group of users. If you apply a rule to a group of users, the rule affects all users in that group. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset. -For example, the rule "Allow Everyone to run Windows except Registry Editor" allows Everyone to run Windows binaries, but doesn't allow anyone to run Registry Editor (by adding %WINDIR%\regedit.exe as a Path Exception for the rule). -The effect of this rule would prevent users such as Helpdesk personnel from running the Registry Editor, a program that is necessary for their support tasks. +For example, the rule "Allow Everyone to run Windows except Registry Editor" allows Everyone to run Windows binaries, but doesn't allow anyone to run Registry Editor (by adding %WINDIR%\regedit.exe as a Path Exception for the rule). +The effect of this rule would prevent users such as Helpdesk personnel from running the Registry Editor, a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Helpdesk user group: "Allow Helpdesk to run Registry Editor" and add %WINDIR%\regedit.exe as an allowed path. If you create a deny rule that blocks Registry Editor for all users, the deny rule overrides the second rule that allows the Helpdesk user group to run Registry Editor. ## Related articles diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-file-hash-rule-condition-in-applocker.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-file-hash-rule-condition-in-applocker.md index 9937009a5e..b9460ff54a 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-file-hash-rule-condition-in-applocker.md @@ -3,7 +3,7 @@ title: Understanding the file hash rule condition in AppLocker description: This article explains how to use the AppLocker file hash rule condition and its advantages and disadvantages. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Understanding the file hash rule condition in AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-path-rule-condition-in-applocker.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-path-rule-condition-in-applocker.md index 2d1d4b9cae..4175eba0ef 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-path-rule-condition-in-applocker.md @@ -3,7 +3,7 @@ title: Understanding the path rule condition in AppLocker description: This article explains how to apply the AppLocker path rule condition and its advantages and disadvantages. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Understanding the path rule condition in AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-publisher-rule-condition-in-applocker.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-publisher-rule-condition-in-applocker.md index 171ef6e3f1..be3c3767d4 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-publisher-rule-condition-in-applocker.md @@ -3,7 +3,7 @@ title: Understanding the publisher rule condition in AppLocker description: This article explains how to apply the AppLocker publisher rule condition and what controls are available. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # Understanding the publisher rule condition in AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/security/application-security/application-control/app-control-for-business/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index 47b1b1388d..8bc76ea93a 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -3,7 +3,7 @@ title: Use a reference device to create and maintain AppLocker policies description: This article for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/22/2023 +ms.date: 09/11/2024 --- # Use a reference device to create and maintain AppLocker policies diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md b/windows/security/application-security/application-control/app-control-for-business/applocker/use-the-applocker-windows-powershell-cmdlets.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/use-the-applocker-windows-powershell-cmdlets.md index 0678fb60b9..574c33a03b 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/use-the-applocker-windows-powershell-cmdlets.md @@ -3,7 +3,7 @@ title: Use the AppLocker Windows PowerShell cmdlets description: This article for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 01/03/2024 +ms.date: 09/11/2024 --- # Use the AppLocker Windows PowerShell cmdlets diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/using-event-viewer-with-applocker.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/using-event-viewer-with-applocker.md index 19b2256345..65fa1be015 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/using-event-viewer-with-applocker.md @@ -3,7 +3,7 @@ title: Using Event Viewer with AppLocker description: This article lists AppLocker events and describes how to use Event Viewer with AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/what-is-applocker.md similarity index 86% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/what-is-applocker.md index 256c416dbf..9fa362969d 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/what-is-applocker.md @@ -3,14 +3,14 @@ title: What Is AppLocker description: This article for the IT professional describes what AppLocker is. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/23/2023 +ms.date: 09/11/2024 --- # What Is AppLocker? This article for the IT professional describes what AppLocker is. -Windows includes two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: Windows Defender Application Control (WDAC) and AppLocker. For information to help you choose when to use WDAC or AppLocker, see [WDAC and AppLocker overview](/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview). +Windows includes two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: App Control for Business and AppLocker. For information to help you choose when to use App Control or AppLocker, see [App Control and AppLocker overview](../appcontrol-and-applocker-overview.md). AppLocker helps you create rules to allow or deny apps from running based on information about the apps' files. You can also use AppLocker to control which users or groups can run those apps. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md b/windows/security/application-security/application-control/app-control-for-business/applocker/windows-installer-rules-in-applocker.md similarity index 98% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/windows-installer-rules-in-applocker.md index e64e6e97ff..cfc1ce02c6 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/windows-installer-rules-in-applocker.md @@ -3,7 +3,7 @@ title: Windows Installer rules in AppLocker description: This article describes the file formats and available default rules for the Windows Installer rule collection. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/24/2023 +ms.date: 09/11/2024 --- # Windows Installer rules in AppLocker diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-policies.md b/windows/security/application-security/application-control/app-control-for-business/applocker/working-with-applocker-policies.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-policies.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/working-with-applocker-policies.md index 189d8f1654..2a7f5153ec 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-policies.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/working-with-applocker-policies.md @@ -3,7 +3,7 @@ title: Working with AppLocker policies description: This article for IT professionals provides links to procedural articles about creating, maintaining, and testing AppLocker policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/21/2023 +ms.date: 09/11/2024 --- # Working with AppLocker policies diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules.md b/windows/security/application-security/application-control/app-control-for-business/applocker/working-with-applocker-rules.md similarity index 99% rename from windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules.md rename to windows/security/application-security/application-control/app-control-for-business/applocker/working-with-applocker-rules.md index e06ef57ede..c827358a61 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules.md +++ b/windows/security/application-security/application-control/app-control-for-business/applocker/working-with-applocker-rules.md @@ -3,7 +3,7 @@ title: Working with AppLocker rules description: This article for IT professionals describes AppLocker rule types and how to work with them for your application control policies. ms.localizationpriority: medium msauthor: jsuther -ms.date: 12/21/2023 +ms.date: 09/11/2024 ms.topic: conceptual --- diff --git a/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide.md b/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide.md new file mode 100644 index 0000000000..4ee7ef2757 --- /dev/null +++ b/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide.md @@ -0,0 +1,55 @@ +--- +title: Deploying App Control for Business policies +description: Learn how to plan and implement an App Control deployment. +ms.localizationpriority: medium +ms.date: 09/11/2024 +ms.topic: overview +--- + +# Deploying App Control for Business policies + +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] + +You should now have one or more App Control for Business policies ready to deploy. If you haven't yet completed the steps described in the [App Control Design Guide](../design/appcontrol-design-guide.md), do so now before proceeding. + +## Convert your App Control policy XML to binary + +Before you deploy your App Control policies, you must first convert the XML to its binary form. You can do this using the following PowerShell example. You must set the $AppControlPolicyXMLFile variable to point to your App Control policy XML file. + +```powershell +## Update the path to your App Control policy XML +$AppControlPolicyXMLFile = $env:USERPROFILE + "\Desktop\MyAppControlPolicy.xml" +[xml]$AppControlPolicy = Get-Content -Path $AppControlPolicyXMLFile +if (($AppControlPolicy.SiPolicy.PolicyID) -ne $null) ## Multiple policy format (For Windows builds 1903+ only, including Server 2022) +{ + $PolicyID = $AppControlPolicy.SiPolicy.PolicyID + $PolicyBinary = $PolicyID+".cip" +} +else ## Single policy format (Windows Server 2016 and 2019, and Windows 10 1809 LTSC) +{ + $PolicyBinary = "SiPolicy.p7b" +} + +## Binary file will be written to your desktop +ConvertFrom-CIPolicy -XmlFilePath $AppControlPolicyXMLFile -BinaryFilePath $env:USERPROFILE\Desktop\$PolicyBinary +``` + +## Plan your deployment + +As with any significant change to your environment, implementing App Control can have unintended consequences. To ensure the best chance for success, you should follow safe deployment practices and plan your deployment carefully. Identify the devices you'll manage with App Control and split them into deployment rings. This way, you can control the speed and scale of the deployment and respond if anything goes wrong. Define the success criteria that will determine when it's safe to continue from one ring to the next. + +All App Control for Business policy changes should be deployed in audit mode before proceeding to enforcement. Carefully monitor events from devices where the policy has been deployed to ensure the block events you observe match your expectation before broadening the deployment to other deployment rings. If your organization uses Microsoft Defender for Endpoint, you can use the Advanced Hunting feature to centrally monitor App Control-related events. Otherwise, we recommend using an event log forwarding solution to collect relevant events from your managed endpoints. + +## Choose how to deploy App Control policies + +> [!IMPORTANT] +> Due to a known issue, you should always activate new **signed** App Control Base policies with a reboot on systems with [**memory integrity**](../../../../hardware-security/enable-virtualization-based-protection-of-code-integrity.md) enabled. We recommend [deploying via script](deploy-appcontrol-policies-with-script.md) in this case. +> +> This issue does not affect updates to signed Base policies that are already active on the system, deployment of unsigned policies, or deployment of supplemental policies (signed or unsigned). It also does not affect deployments to systems that are not running memory integrity. + +There are several options to deploy App Control for Business policies to managed endpoints, including: + +- [Deploy using a Mobile Device Management (MDM) solution](deploy-appcontrol-policies-using-intune.md), such as Microsoft Intune +- [Deploy using Microsoft Configuration Manager](deploy-appcontrol-policies-with-memcm.md) +- [Deploy via script](deploy-appcontrol-policies-with-script.md) +- [Deploy via group policy](deploy-appcontrol-policies-using-group-policy.md) diff --git a/windows/security/application-security/application-control/app-control-for-business/deployment/audit-appcontrol-policies.md b/windows/security/application-security/application-control/app-control-for-business/deployment/audit-appcontrol-policies.md new file mode 100644 index 0000000000..6f8919e77d --- /dev/null +++ b/windows/security/application-security/application-control/app-control-for-business/deployment/audit-appcontrol-policies.md @@ -0,0 +1,60 @@ +--- +title: Use audit events to create App Control policy rules +description: Audits allow admins to discover apps, binaries, and scripts that should be added to the App Control policy. +ms.localizationpriority: medium +ms.date: 09/11/2024 +ms.topic: conceptual +--- + +# Use audit events to create App Control policy rules + +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] + +Running App Control in audit mode lets you discover applications, binaries, and scripts that are missing from your App Control policy but should be included. + +While an App Control policy is running in audit mode, any binary that runs but would have been denied is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. Script and MSI are logged in the **Applications and Services Logs\\Microsoft\\Windows\\AppLocker\\MSI and Script** event log. These events can be used to generate a new App Control policy that can be merged with the original Base policy or deployed as a separate Supplemental policy, if allowed. + +## Overview of the process to create App Control policy to allow apps using audit events + +> [!Note] +> You must have already deployed an App Control audit mode policy to use this process. If you have not already done so, see [Deploying App Control for Business policies](appcontrol-deployment-guide.md). + +To familiarize yourself with creating App Control rules from audit events, follow these steps on a device with an App Control audit mode policy. + +1. Install and run an application not allowed by the App Control policy but that you want to allow. + +2. Review the **CodeIntegrity - Operational** and **AppLocker - MSI and Script** event logs to confirm events, like those shown in Figure 1, are generated related to the application. For information about the types of events you should see, refer to [Understanding App Control events](../operations/event-id-explanations.md). + + **Figure 1. Exceptions to the deployed App Control policy**
+ :::image type="content" alt-text="Event showing exception to App Control policy." source="../images/dg-fig23-exceptionstocode.png"::: + +3. In an elevated PowerShell session, run the following commands to initialize variables used by this procedure. This procedure builds upon the **Lamna_FullyManagedClients_Audit.xml** policy introduced in [Create an App Control policy for fully managed devices](../design/create-appcontrol-policy-for-fully-managed-devices.md) and will produce a new policy called **EventsPolicy.xml**. + + ```powershell + $PolicyName= "Lamna_FullyManagedClients_Audit" + $LamnaPolicy=$env:userprofile+"\Desktop\"+$PolicyName+".xml" + $EventsPolicy=$env:userprofile+"\Desktop\EventsPolicy.xml" + $EventsPolicyWarnings=$env:userprofile+"\Desktop\EventsPolicyWarnings.txt" + ``` + +4. Use [New-CIPolicy](/powershell/module/configci/new-cipolicy) to generate a new App Control policy from logged audit events. This example uses a **FilePublisher** file rule level and a **Hash** fallback level. Warning messages are redirected to a text file **EventsPolicyWarnings.txt**. + + ```powershell + New-CIPolicy -FilePath $EventsPolicy -Audit -Level FilePublisher -Fallback SignedVersion,FilePublisher,Hash -UserPEs -MultiplePolicyFormat 3> $EventsPolicyWarnings + ``` + + > [!NOTE] + > When you create policies from audit events, you should carefully consider the file rule level that you select to trust. The preceding example uses the **FilePublisher** rule level with a fallback level of **Hash**, which may be more specific than desired. You can re-run the above command using different **-Level** and **-Fallback** options to meet your needs. For more information about App Control rule levels, see [Understand App Control policy rules and file rules](../design/select-types-of-rules-to-create.md). + +5. Find and review the App Control policy file **EventsPolicy.xml** that should be found on your desktop. Ensure that it only includes file and signer rules for applications, binaries, and scripts you wish to allow. You can remove rules by manually editing the policy XML or use the App Control Policy Wizard tool (see [Editing existing base and supplemental App Control policies with the Wizard](../design/appcontrol-wizard-editing-policy.md)). + +6. Find and review the text file **EventsPolicyWarnings.txt** that should be found on your desktop. This file will include a warning for any files that App Control couldn't create a rule for at either the specified rule level or fallback rule level. + + > [!NOTE] + > New-CIPolicy only creates rules for files that can still be found on disk. Files which are no longer present on the system will not have a rule created to allow them. However, the event log should have sufficient information to allow these files by manually editing the policy XML to add rules. You can use an existing rule as a template and verify your results against the App Control policy schema definition found at **%windir%\schemas\CodeIntegrity\cipolicy.xsd**. + +7. Merge **EventsPolicy.xml** with the Base policy **Lamna_FullyManagedClients_Audit.xml** or convert it to a supplemental policy. + + For information on merging policies, refer to [Merge App Control for Business policies](merge-appcontrol-policies.md) and for information on supplemental policies see [Use multiple App Control for Business Policies](../design/deploy-multiple-appcontrol-policies.md). + +8. Convert the Base or Supplemental policy to binary and deploy using your preferred method. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/deployment/create-code-signing-cert-for-wdac.md b/windows/security/application-security/application-control/app-control-for-business/deployment/create-code-signing-cert-for-appcontrol.md similarity index 77% rename from windows/security/application-security/application-control/windows-defender-application-control/deployment/create-code-signing-cert-for-wdac.md rename to windows/security/application-security/application-control/app-control-for-business/deployment/create-code-signing-cert-for-appcontrol.md index 7c3eabc52d..773daf6a82 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/deployment/create-code-signing-cert-for-wdac.md +++ b/windows/security/application-security/application-control/app-control-for-business/deployment/create-code-signing-cert-for-appcontrol.md @@ -1,22 +1,21 @@ --- -title: Create a code signing cert for Windows Defender Application Control -description: Learn how to set up a publicly issued code signing certificate, so you can sign catalog files or WDAC policies internally. +title: Create a code signing cert for App Control for Business +description: Learn how to set up a publicly issued code signing certificate, so you can sign catalog files or App Control policies internally. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 12/01/2022 +ms.date: 09/11/2024 --- -# Optional: Create a code signing cert for Windows Defender Application Control +# Optional: Create a code signing cert for App Control for Business ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] -As you deploy Windows Defender Application Control (WDAC), you might need to sign catalog files or WDAC policies internally. To do this signing, you'll either need to use [Microsoft's Trusted Signing service](/azure/trusted-signing/), a publicly issued code signing certificate or an internal CA. If you've purchased a code signing certificate, you can skip this article, and instead follow other articles listed in the [Windows Defender Application Control Deployment Guide](wdac-deployment-guide.md). +As you deploy App Control for Business, you might need to sign catalog files or App Control policies internally. To do this signing, you'll either need to use [Microsoft's Trusted Signing service](/azure/trusted-signing/), a publicly issued code signing certificate or an internal CA. If you've purchased a code signing certificate, you can skip this article, and instead follow other articles listed in the [App Control for Business Deployment Guide](appcontrol-deployment-guide.md). If you have an internal CA, complete these steps to create a code signing certificate. > [!WARNING] -> When creating signing certificates for WDAC policy signing, Boot failure (blue screen) may occur if your signing certificate does not follow these rules: +> When creating signing certificates for App Control policy signing, Boot failure (blue screen) may occur if your signing certificate does not follow these rules: > > - All policies, including base and supplemental, must be signed according to the [PKCS 7 Standard](https://datatracker.ietf.org/doc/html/rfc5652). > - Use RSA keys with 2K, 3K, or 4K key size only. ECDSA isn't supported. @@ -34,7 +33,7 @@ If you have an internal CA, complete these steps to create a code signing certif 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** from the **Certification Authority** list, and then select **Windows 8 / Windows Server 2012** from the **Certificate recipient** list. -5. On the **General** tab, specify the **Template display name** and **Template name**. This example uses the name **WDAC Catalog Signing Certificate**. +5. On the **General** tab, specify the **Template display name** and **Template name**. This example uses the name **App Control Catalog Signing Certificate**. 6. On the **Request Handling** tab, select the **Allow private key to be exported** check box. @@ -64,7 +63,7 @@ When this certificate template has been created, you must publish it to the CA p A list of available templates to issue appears, including the template you created. -2. Select the WDAC Catalog signing certificate, and then select **OK**. +2. Select the App Control Catalog signing certificate, and then select **OK**. Now that the template is available to be issued, you must request one from the computer running Windows 10 or Windows 11 on which you create and sign catalog files. To begin, open the MMC, and then complete the following steps: @@ -76,7 +75,7 @@ Now that the template is available to be issued, you must request one from the c 4. In the **Request Certificate** list, select your newly created code signing certificate, and then select the blue text that requests additional information, as shown in Figure 4. - ![Request Certificates: more information required.](../images/dg-fig31-getmoreinfo.png) + :::image type="content" alt-text="Request Certificates: more information required." source="../images/dg-fig31-getmoreinfo.png"::: Figure 4. Get more information for your code signing certificate @@ -95,6 +94,6 @@ This certificate must be installed in the user's personal store on the computer 3. Choose the default settings, and then select **Export all extended properties**. -4. Set a password, select an export path, and then select **WDACCatSigningCert.pfx** as the file name. +4. Set a password, select an export path, and then select **AppControlCatSigningCert.pfx** as the file name. When the certificate has been exported, import it into the personal store for the user who will be signing the catalog files or code integrity policies on the specific computer that will be signing them. diff --git a/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy.md b/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy.md new file mode 100644 index 0000000000..5efe8cdcdb --- /dev/null +++ b/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy.md @@ -0,0 +1,58 @@ +--- +title: Deploy App Control policies via Group Policy +description: App Control for Business policies can easily be deployed and managed with Group Policy. Learn how by following this step-by-step guide. +ms.localizationpriority: medium +ms.date: 09/11/2024 +ms.topic: how-to +--- + +# Deploy App Control for Business policies by using Group Policy + +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] + +> [!IMPORTANT] +> Due to a known issue, you should always activate new **signed** App Control Base policies *with a reboot* on systems with [**memory integrity**](../../../../hardware-security/enable-virtualization-based-protection-of-code-integrity.md) enabled. Instead of Group Policy, deploy new signed App Control Base policies [via script](deploy-appcontrol-policies-with-script.md#deploying-signed-policies) and activate the policy with a system restart. +> +> This issue does not affect updates to signed Base policies that are already active on the system, deployment of unsigned policies, or deployment of supplemental policies (signed or unsigned). It also does not affect deployments to systems that are not running memory integrity. + +Single-policy format App Control for Business policies (pre-1903 policy schema) can be easily deployed and managed with Group Policy. + +> [!IMPORTANT] +> Group Policy-based deployment of App Control for Business policies only supports single-policy format App Control policies. To use App Control on devices running Windows 10 1903 and greater, or Windows 11, we recommend using an alternative method for policy deployment. + +You should now have an App Control policy converted into binary form. If not, follow the steps described in [Deploying App Control for Business policies](appcontrol-deployment-guide.md). + +The following procedure walks you through how to deploy an App Control policy called **SiPolicy.p7b** to a test OU called *App Control Enabled PCs* by using a GPO called **Contoso GPO Test**. + +To deploy and manage an App Control for Business policy with Group Policy: + +1. On a client computer on which RSAT is installed, open the GPMC by running **GPMC.MSC** + +2. Create a new GPO: right-click an OU and then select **Create a GPO in this domain, and Link it here**. + + > [!NOTE] + > You can use any OU name. Also, security group filtering is an option when you consider different ways of combining App Control policies (or keeping them separate), as discussed in [Plan for App Control for Business lifecycle policy management](../design/plan-appcontrol-management.md). + + :::image type="content" alt-text="Group Policy Management, create a GPO." source="../images/dg-fig24-creategpo.png"::: + +3. Name the new GPO. You can choose any name. + +4. Open the Group Policy Management Editor: right-click the new GPO, and then select **Edit**. + +5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Deploy App Control for Business** and then select **Edit**. + + ![Edit the Group Policy for App Control for Business.](../images/appcontrol-edit-gp.png) + +6. In the **Deploy App Control for Business** dialog box, select the **Enabled** option, and then specify the App Control policy deployment path. + + In this policy setting, you specify either the local path where the policy will exist on each client computer or a Universal Naming Convention (UNC) path that the client computers will look to retrieve the latest version of the policy. For example, the path to SiPolicy.p7b using the steps described in [Deploying App Control for Business policies](appcontrol-deployment-guide.md) would be %USERPROFILE%\Desktop\SiPolicy.p7b. + + > [!NOTE] + > This policy file does not need to be copied to every computer. You can instead copy the App Control policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers. + + :::image type="content" alt-text="Group Policy called Deploy App Control for Business." source="../images/dg-fig26-enablecode.png"::: + + > [!NOTE] + > You may have noticed that the GPO setting references a .p7b file, but the file extension and name of the policy binary do not matter. Regardless of what you name your policy binary, they are all converted to SIPolicy.p7b when applied to the client computers running Windows 10. If you are deploying different App Control policies to different sets of devices, you may want to give each of your App Control policies a friendly name and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. + +7. Close the Group Policy Management Editor, and then restart the Windows test computer. Restarting the computer updates the App Control policy. diff --git a/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-intune.md b/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-intune.md new file mode 100644 index 0000000000..472b039866 --- /dev/null +++ b/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-intune.md @@ -0,0 +1,89 @@ +--- +title: Deploy App Control policies using Mobile Device Management (MDM) +description: You can use an MDM like Microsoft Intune to configure App Control for Business. Learn how with this step-by-step guide. +ms.localizationpriority: medium +ms.date: 09/11/2024 +ms.topic: how-to +--- + +# Deploy App Control policies using Mobile Device Management (MDM) + +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] + +You can use a Mobile Device Management (MDM) solution, like Microsoft Intune, to configure App Control for Business on client machines. Intune includes native support for App Control, which can be a helpful starting point, but customers may find the available circle-of-trust options too limiting. To deploy a custom policy through Intune and define your own circle of trust, you can configure a profile using Custom OMA-URI. If your organization uses another MDM solution, check with your solution provider for App Control policy deployment steps. + +> [!IMPORTANT] +> Due to a known issue, you should always activate new **signed** App Control Base policies *with a reboot* on systems with [**memory integrity**](../../../../hardware-security/enable-virtualization-based-protection-of-code-integrity.md) enabled. Instead of Mobile Device Management (MDM), deploy new signed App Control Base policies [via script](deploy-appcontrol-policies-with-script.md) and activate the policy with a system restart. +> +> This issue does not affect updates to signed Base policies that are already active on the system, deployment of unsigned policies, or deployment of supplemental policies (signed or unsigned). It also does not affect deployments to systems that are not running memory integrity. + +## Use Intune's built-in policies + +Intune's built-in App Control for Business support allows you to configure Windows client computers to only run: + +- Windows components +- Third-party hardware and software kernel drivers +- Microsoft Store-signed apps +- [Optional] Reputable apps as defined by the Intelligent Security Graph (ISG) + +> [!NOTE] +> Intune's built-in policies use the pre-1903 single-policy format version of the DefaultWindows policy. Use the [improved Intune App Control experience](/mem/intune/protect/endpoint-security-app-control-policy), currently in public preview, to create and deploy multiple-policy format files. Or, you can use Intune's custom OMA-URI feature to deploy your own multiple-policy format App Control policies and leverage features available on Windows 10 1903+ or Windows 11 as described later in this topic. + +> [!NOTE] +> Intune currently uses the AppLocker CSP to deploy its built-in policies. The AppLocker CSP always requests a device restart when it applies App Control policies. Use the [improved Intune App Control experience](/mem/intune/protect/endpoint-security-app-control-policy), currently in public preview, to deploy your own App Control policies without a restart. Or, you can use Intune's custom OMA-URI feature with the ApplicationControl CSP. + +To use Intune's built-in App Control policies, configure [Endpoint Protection for Windows 10 (and later)](/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json). + +## Deploy App Control policies with custom OMA-URI + +> [!NOTE] +> Policies deployed through Intune custom OMA-URI are subject to a 350,000 byte limit. Customers should create App Control for Business policies that use signature-based rules, the Intelligent Security Graph, and managed installers where practical. Customers whose devices are running 1903+ builds of Windows are also encouraged to use [multiple policies](../design/deploy-multiple-appcontrol-policies.md) which allow more granular policy. + +You should now have one or more App Control policies converted into binary form. If not, follow the steps described in [Deploying App Control for Business policies](appcontrol-deployment-guide.md). + +### Deploy custom App Control policies on Windows 10 1903+ + +Beginning with Windows 10 1903, custom OMA-URI policy deployment can use the [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp), which has support for multiple policies and rebootless policies. + +> [!NOTE] +> You must convert your custom policy XML to binary form before deploying with OMA-URI. + +The steps to use Intune's custom OMA-URI functionality are: + +1. Open the Microsoft Intune portal and [create a profile with custom settings](/mem/intune/configuration/custom-settings-windows-10). + +2. Specify a **Name** and **Description** and use the following values for the remaining custom OMA-URI settings: + - **OMA-URI**: `./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy` + - **Data type**: Base64 (file) + - **Certificate file**: Upload your binary format policy file. To do this, change your {GUID}.cip file to {GUID}.bin. You don't need to upload a Base64 file, as Intune converts the uploaded .bin file to Base64 on your behalf. + + :::image type="content" alt-text="Configure custom App Control." source="../images/appcontrol-intune-custom-oma-uri.png" lightbox="../images/appcontrol-intune-custom-oma-uri.png"::: + +> [!NOTE] +> For the _Policy GUID_ value, do not include the curly brackets. + +### Remove App Control policies on Windows 10 1903+ + +Upon deletion, policies deployed through Intune via the ApplicationControl CSP are removed from the system but stay in effect until the next reboot. In order to disable App Control for Business enforcement, first replace the existing policy with a new version of the policy that will "Allow *", like the rules in the example policy at %windir%\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml. Once the updated policy is deployed, you can then delete the policy from the Intune portal. This deletion will prevent anything from being blocked and fully remove the App Control policy on the next reboot. + +### For pre-1903 systems + +#### Deploying policies + +The steps to use Intune's Custom OMA-URI functionality to apply the [AppLocker CSP](/windows/client-management/mdm/applocker-csp) and deploy a custom App Control policy to pre-1903 systems are: + +1. Convert the policy XML to binary format using the [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy) cmdlet in order to be deployed. The binary policy may be signed or unsigned. + +2. Open the Microsoft Intune portal and [create a profile with custom settings](/mem/intune/configuration/custom-settings-windows-10). + +3. Specify a **Name** and **Description** and use the following values for the remaining custom OMA-URI settings: + - **OMA-URI**: `./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/_Grouping_/CodeIntegrity/Policy` + - **Data type**: Base64 (file) + - **Certificate file**: upload your binary format policy file + + > [!NOTE] + > Deploying policies via the AppLocker CSP will force a reboot during OOBE. + +#### Removing policies + +Policies deployed through Intune via the AppLocker CSP can't be deleted through the Intune console. In order to disable App Control for Business policy enforcement, either deploy an audit-mode policy or use a script to delete the existing policy. diff --git a/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm.md b/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm.md new file mode 100644 index 0000000000..5baec955a9 --- /dev/null +++ b/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm.md @@ -0,0 +1,81 @@ +--- +title: Deploy App Control for Business policies with Configuration Manager +description: You can use Microsoft Configuration Manager to configure App Control for Business. Learn how with this step-by-step guide. +ms.date: 09/11/2024 +ms.topic: how-to +ms.localizationpriority: medium +--- + +# Deploy App Control policies by using Microsoft Configuration Manager + +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] + +You can use Microsoft Configuration Manager to configure App Control for Business on client machines. + +## Use Configuration Manager's built-in policies + +Configuration Manager includes native support for App Control, which allows you to configure Windows 10 and Windows 11 client computers with a policy that will only allow: + +- Windows components +- Microsoft Store apps +- Apps installed by Configuration Manager (Configuration Manager self-configured as a managed installer) +- (Optional) Reputable apps as defined by the Intelligent Security Graph (ISG) +- (Optional) Apps and executables already installed in admin-definable folder locations that Configuration Manager will allow through a one-time scan during policy creation on managed endpoints. + +Configuration Manager doesn't remove policies once deployed. To stop enforcement, you should switch the policy to audit mode, which will produce the same effect. If you want to disable App Control for Business altogether (including audit mode), you can deploy a script to delete the policy file from disk, and either trigger a reboot or wait for the next reboot. + +### Create an App Control Policy in Configuration Manager + +1. Select **Asset and Compliance** > **Endpoint Protection** > **App Control for Business** > **Create Application Control Policy** + + :::image type="content" alt-text="Create an App Control policy in Configuration Manager." source="../images/memcm/memcm-create-appcontrol-policy.jpg"::: + +2. Enter the name of the policy > **Next** +3. Enable **Enforce a restart of devices so that this policy can be enforced for all processes** +4. Select the mode that you want the policy to run (Enforcement enabled / Audit Only) +5. Select **Next** + + :::image type="content" alt-text="Create an enforced App Control policy in Configuration Manager." source="../images/memcm/memcm-create-appcontrol-policy-2.jpg"::: + +6. Select **Add** to begin creating rules for trusted software + + :::image type="content" alt-text="Create an App Control path rule in Configuration Manager." source="../images/memcm/memcm-create-appcontrol-rule.jpg"::: + +7. Select **File** or **Folder** to create a path rule > **Browse** + + :::image type="content" alt-text="Select a file or folder to create a path rule." source="../images/memcm/memcm-create-appcontrol-rule-2.jpg"::: + +8. Select the executable or folder for your path rule > **OK** + + :::image type="content" alt-text="Select the executable file or folder." source="../images/memcm/memcm-create-appcontrol-rule-3.jpg"::: + +9. Select **OK** to add the rule to the table of trusted files or folder +10. Select **Next** to navigate to the summary page > **Close** + + :::image type="content" alt-text="Confirm the App Control path rule in Configuration Manager." source="../images/memcm/memcm-confirm-appcontrol-rule.jpg"::: + +### Deploy the App Control policy in Configuration Manager + +1. Right-click the newly created policy > **Deploy Application Control Policy** + + :::image type="content" alt-text="Deploy App Control via Configuration Manager." source="../images/memcm/memcm-deploy-appcontrol.jpg"::: + +2. Select **Browse** + + :::image type="content" alt-text="Select Browse." source="../images/memcm/memcm-deploy-appcontrol-2.jpg"::: + +3. Select the Device Collection you created earlier > **OK** + + :::image type="content" alt-text="Select the device collection." source="../images/memcm/memcm-deploy-appcontrol-3.jpg"::: + +4. Change the schedule > **OK** + + :::image type="content" alt-text="Change the App Control deployment schedule." source="../images/memcm/memcm-deploy-appcontrol-4.jpg"::: + +For more information on using Configuration Manager's native App Control policies, see [App Control for Business management with Configuration Manager](/mem/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager). + +Download the entire [App Control in Configuration Manager lab paper](https://download.microsoft.com/download/c/f/d/cfd6227c-8ec4-442d-8c50-825550d412f6/WDAC-Deploy-WDAC-using-MEMCM.pdf). + +## Deploy custom App Control policies using Packages/Programs or Task Sequences + +Using Configuration Manager's built-in policies can be a helpful starting point, but customers may find the circle-of-trust options available in Configuration Manager too limiting. To define your own circle-of-trust, you can use Configuration Manager to deploy custom App Control policies using [script-based deployment](deploy-appcontrol-policies-with-script.md) via Software Distribution Packages and Programs or Operating System Deployment Task Sequences. diff --git a/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-script.md b/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-script.md new file mode 100644 index 0000000000..369252b993 --- /dev/null +++ b/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-script.md @@ -0,0 +1,104 @@ +--- +title: Deploy App Control for Business policies using script +description: Use scripts to deploy App Control for Business policies. Learn how with this step-by-step guide. +ms.manager: jsuther +ms.date: 09/11/2024 +ms.topic: how-to +ms.localizationpriority: medium +--- + +# Deploy App Control policies using script + +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] + +This article describes how to deploy App Control for Business policies using script. The following instructions use PowerShell but can work with any scripting host. + +You should now have one or more App Control policies converted into binary form. If not, follow the steps described in [Deploying App Control for Business policies](appcontrol-deployment-guide.md). + +> [!IMPORTANT] +> Due to a known issue, you should always activate new **signed** App Control Base policies with a reboot on systems with [**memory integrity**](../../../../hardware-security/enable-virtualization-based-protection-of-code-integrity.md) enabled. Skip all steps below that use CiTool, RefreshPolicy.exe, or WMI to initiate a policy activation. Instead, copy the policy binary to the correct system32 and EFI locations and then activate the policy with a system restart. +> +> This issue does not affect updates to signed Base policies that are already active on the system, deployment of unsigned policies, or deployment of supplemental policies (signed or unsigned). It also does not affect deployments to systems that are not running memory integrity. + +## Deploying policies for Windows 11 22H2 and above + +You can use the inbox [CiTool](../operations/citool-commands.md) to apply policies on Windows 11 22H2 with the following commands. Be sure to replace **<Path to policy binary file to deploy>** in the following example with the actual path to your App Control policy binary file. + +```powershell +# Policy binary files should be named as {GUID}.cip for multiple policy format files (where {GUID} = from the Policy XML) +$PolicyBinary = "" +CiTool --update-policy $PolicyBinary [-json] +``` + +## Deploying policies for Windows 11, Windows 10 version 1903 and above, and Windows Server 2022 and above + +To use this procedure, download and distribute the [App Control policy refresh tool](https://aka.ms/refreshpolicy) to all managed endpoints. Ensure your App Control policies allow the App Control policy refresh tool or use a managed installer to distribute the tool. + +1. Initialize the variables to be used by the script. + + ```powershell + # Policy binary files should be named as {GUID}.cip for multiple policy format files (where {GUID} = from the Policy XML) + $PolicyBinary = "" + $DestinationFolder = $env:windir+"\System32\CodeIntegrity\CIPolicies\Active\" + $RefreshPolicyTool = "" + ``` + +2. Copy App Control for Business policy binary to the destination folder. + + ```powershell + Copy-Item -Path $PolicyBinary -Destination $DestinationFolder -Force + ``` + +3. Repeat steps 1-2 as appropriate to deploy more App Control policies. +4. Run RefreshPolicy.exe to activate and refresh all App Control policies on the managed endpoint. + + ```powershell + & $RefreshPolicyTool + ``` + +## Deploying policies for all other versions of Windows and Windows Server + +Use WMI to apply policies on all other versions of Windows and Windows Server. + +1. Initialize the variables to be used by the script. + + ```powershell + # Policy binary files should be named as SiPolicy.p7b for Windows 10 versions earlier than 1903 + $PolicyBinary = "" + $DestinationBinary = $env:windir+"\System32\CodeIntegrity\SiPolicy.p7b" + ``` + +2. Copy App Control for Business policy binary to the destination. + + ```powershell + Copy-Item -Path $PolicyBinary -Destination $DestinationBinary -Force + ``` + +3. Refresh and activate App Control policy using WMI + + ```powershell + Invoke-CimMethod -Namespace root\Microsoft\Windows\CI -ClassName PS_UpdateAndCompareCIPolicy -MethodName Update -Arguments @{FilePath = $DestinationBinary} + ``` + +## Deploying signed policies + +If you're using [signed App Control policies](use-signed-policies-to-protect-appcontrol-against-tampering.md), the policies must be deployed into your device's EFI partition in addition to the locations outlined in the earlier sections. Unsigned App Control policies don't need to be present in the EFI partition. + +1. Mount the EFI volume and make the directory, if it doesn't exist, in an elevated PowerShell prompt: + + ```powershell + $MountPoint = 'C:\EFIMount' + $EFIDestinationFolder = "$MountPoint\EFI\Microsoft\Boot\CiPolicies\Active" + $EFIPartition = (Get-Partition | Where-Object IsSystem).AccessPaths[0] + if (-Not (Test-Path $MountPoint)) { New-Item -Path $MountPoint -Type Directory -Force } + mountvol $MountPoint $EFIPartition + if (-Not (Test-Path $EFIDestinationFolder)) { New-Item -Path $EFIDestinationFolder -Type Directory -Force } + ``` + +2. Copy the signed policy to the created folder: + + ```powershell + Copy-Item -Path $PolicyBinary -Destination $EFIDestinationFolder -Force + ``` + +3. Restart the system. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-catalog-files-to-support-wdac.md b/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-catalog-files-to-support-appcontrol.md similarity index 89% rename from windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-catalog-files-to-support-wdac.md rename to windows/security/application-security/application-control/app-control-for-business/deployment/deploy-catalog-files-to-support-appcontrol.md index 2265945d4e..ff49b5a9fe 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-catalog-files-to-support-wdac.md +++ b/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-catalog-files-to-support-appcontrol.md @@ -1,21 +1,20 @@ --- -title: Deploy catalog files to support Windows Defender Application Control -description: Catalog files simplify running unsigned applications in the presence of a Windows Defender Application Control (WDAC) policy. +title: Deploy catalog files to support App Control for Business +description: Catalog files simplify running unsigned applications in the presence of an App Control for Business policy. ms.localizationpriority: medium ms.topic: how-to -ms.date: 11/30/2022 +ms.date: 09/11/2024 --- -# Deploy catalog files to support Windows Defender Application Control +# Deploy catalog files to support App Control for Business -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. For more information, see [Windows Defender Application Control feature availability](../feature-availability.md). +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] -*Catalog files* can be important in your deployment of Windows Defender Application Control (WDAC) if you have unsigned line-of-business (LOB) applications for which the process of signing is difficult. You can also use catalog files to add your own signature to apps you get from independent software vendors (ISV) when you don't want to trust all code signed by that ISV. In this way, catalog files provide a convenient way for you to "bless" apps for use in your WDAC-managed environment. And, you can create catalog files for existing apps without requiring access to the original source code or needing any expensive repackaging. +*Catalog files* can be important in your deployment of App Control for Business if you have unsigned line-of-business (LOB) applications for which the process of signing is difficult. You can also use catalog files to add your own signature to apps you get from independent software vendors (ISV) when you don't want to trust all code signed by that ISV. In this way, catalog files provide a convenient way for you to "bless" apps for use in your App Control-managed environment. And, you can create catalog files for existing apps without requiring access to the original source code or needing any expensive repackaging. You need to [obtain a code signing certificate for your own use](use-code-signing-for-better-control-and-protection.md#obtain-code-signing-certificates-for-your-own-use) and use it to sign the catalog file. Then, distribute the signed catalog file using your preferred content deployment mechanism. -Finally, add a signer rule to your WDAC policy for your signing certificate. Then, any apps covered by your signed catalog files are able to run, even if the apps were previously unsigned. With this foundation, you can more easily build a WDAC policy that blocks all unsigned code, because most malware is unsigned. +Finally, add a signer rule to your App Control policy for your signing certificate. Then, any apps covered by your signed catalog files are able to run, even if the apps were previously unsigned. With this foundation, you can more easily build an App Control policy that blocks all unsigned code, because most malware is unsigned. ## Create catalog files using Package Inspector @@ -34,7 +33,7 @@ To create a catalog file for an existing app, you can use a tool called **Packag $PolicyBinary = $env:USERPROFILE+"\Desktop\"+$PolicyId.substring(11)+".cip" ``` - Then apply the policy as described in [Deploy Windows Defender Application Control policies with script](deploy-wdac-policies-with-script.md). + Then apply the policy as described in [Deploy App Control for Business policies with script](deploy-appcontrol-policies-with-script.md). 2. Start Package Inspector to monitor file creation on a **local drive** where you install the app, for example, drive C: @@ -92,15 +91,15 @@ For the code signing certificate that you use to sign the catalog file, import i 1. Initialize the variables to use. Replace the `$ExamplePath` and `$CatFileName` variables as needed: ```powershell - $ExamplePath=$env:userprofile+"\Desktop" - $CatFileName=$ExamplePath+"\LOBApp-Contoso.cat" - ``` + $ExamplePath=$env:userprofile+"\Desktop" + $CatFileName=$ExamplePath+"\LOBApp-Contoso.cat" + ``` 2. Sign the catalog file with Signtool.exe: ```powershell - sign /n "ContosoSigningCert" /fd sha256 /v $CatFileName - ``` + sign /n "ContosoSigningCert" /fd sha256 /v $CatFileName + ``` > [!NOTE] > The `` variable should be the full path to the Signtool.exe utility. `ContosoSigningCert` represents the subject name of the certificate that you use to sign the catalog file. This certificate should be imported to your personal certificate store on the computer on which you are attempting to sign the catalog file. @@ -109,7 +108,7 @@ For the code signing certificate that you use to sign the catalog file, import i 3. Verify the catalog file's digital signature. Right-click the catalog file, and then select **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with a **sha256** algorithm, as shown in Figure 1. - ![Digital Signature list in file Properties.](../images/dg-fig12-verifysigning.png) + :::image type="content" alt-text="Digital Signature list in file Properties." source="../images/dg-fig12-verifysigning.png"::: Figure 1. Verify that the signing certificate exists. @@ -123,16 +122,16 @@ For testing purposes, you can manually copy signed catalog files to this folder. To simplify the management of catalog files, you can use group policy preferences to deploy catalog files to the appropriate computers in your organization. -The following process walks you through the deployment of a signed catalog file called **LOBApp-Contoso.cat** to a test OU called **WDAC Enabled PCs** with a GPO called **Contoso Catalog File GPO Test**. +The following process walks you through the deployment of a signed catalog file called **LOBApp-Contoso.cat** to a test OU called **App Control Enabled PCs** with a GPO called **Contoso Catalog File GPO Test**. 1. From either a domain controller or a client computer that has Remote Server Administration Tools installed, open the Group Policy Management Console by running **GPMC.MSC** or by searching for Group Policy Management. -2. Create a new GPO: right-click an OU, for example, the **WDAC Enabled PCs OU**, and then select **Create a GPO in this domain, and Link it here**, as shown in Figure 2. +2. Create a new GPO: right-click an OU, for example, the **App Control Enabled PCs OU**, and then select **Create a GPO in this domain, and Link it here**, as shown in Figure 2. > [!NOTE] - > You can use any OU name. Also, security group filtering is an option when you consider different ways of combining WDAC policies. + > You can use any OU name. Also, security group filtering is an option when you consider different ways of combining App Control policies. - ![Group Policy Management, create a GPO.](../images/dg-fig13-createnewgpo.png) + :::image type="content" alt-text="Group Policy Management, create a GPO." source="../images/dg-fig13-createnewgpo.png"::: Figure 2. Create a new GPO. @@ -142,7 +141,7 @@ The following process walks you through the deployment of a signed catalog file 5. Within the selected GPO, navigate to **Computer Configuration\\Preferences\\Windows Settings\\Files**. Right-click **Files**, point to **New**, and then select **File**, as shown in Figure 3. - ![Group Policy Management Editor, New File.](../images/dg-fig14-createnewfile.png) + :::image type="content" alt-text="Group Policy Management Editor, New File." source="../images/dg-fig14-createnewfile.png"::: Figure 3. Create a new file. @@ -299,9 +298,9 @@ At the time of the next software inventory cycle, when the targeted clients rece > [!NOTE] > If nothing is displayed in this view, navigate to Software\\Last Software Scan in Resource Explorer to verify that the client has recently completed a software inventory scan. -## Allow apps signed by your catalog signing certificate in your WDAC policy +## Allow apps signed by your catalog signing certificate in your App Control policy -Now that you have your signed catalog file, you can add a signer rule to your policy that allows anything signed with that certificate. If you haven't yet created a WDAC policy, see the [Windows Defender Application Control design guide](../design/wdac-design-guide.md). +Now that you have your signed catalog file, you can add a signer rule to your policy that allows anything signed with that certificate. If you haven't yet created an App Control policy, see the [App Control for Business design guide](../design/appcontrol-design-guide.md). On a computer where the signed catalog file has been deployed, you can use [New-CiPolicyRule](/powershell/module/configci/new-cipolicyrule) to create a signer rule from any file included in that catalog. Then use [Merge-CiPolicy](/powershell/module/configci/merge-cipolicy) to add the rule to your policy XML. Be sure to replace the path values in the following sample: diff --git a/windows/security/application-security/application-control/windows-defender-application-control/deployment/disable-wdac-policies.md b/windows/security/application-security/application-control/app-control-for-business/deployment/disable-appcontrol-policies.md similarity index 58% rename from windows/security/application-security/application-control/windows-defender-application-control/deployment/disable-wdac-policies.md rename to windows/security/application-security/application-control/app-control-for-business/deployment/disable-appcontrol-policies.md index 2685a6db1d..f1e65d8fff 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/deployment/disable-wdac-policies.md +++ b/windows/security/application-security/application-control/app-control-for-business/deployment/disable-appcontrol-policies.md @@ -1,24 +1,23 @@ --- -title: Remove Windows Defender Application Control policies -description: Learn how to disable both signed and unsigned Windows Defender Application Control policies, within Windows and within the BIOS. +title: Remove App Control for Business policies +description: Learn how to disable both signed and unsigned App Control for Business policies, within Windows and within the BIOS. ms.localizationpriority: medium -ms.date: 11/04/2022 +ms.date: 09/11/2024 ms.topic: how-to --- -# Remove Windows Defender Application Control (WDAC) policies +# Remove App Control for Business policies ->[!NOTE] ->Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). +[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)] -## Removing WDAC policies +## Removing App Control policies -There may come a time when you want to remove one or more WDAC policies, or remove all WDAC policies you've deployed. This article describes the various ways to remove WDAC policies. +There may come a time when you want to remove one or more App Control policies, or remove all App Control policies you've deployed. This article describes the various ways to remove App Control policies. > [!IMPORTANT] -> **Signed WDAC policy** +> **Signed App Control policy** > -> If the policy you are trying to remove is a signed WDAC policy, you must first deploy a signed replacement policy that includes option **6 Enabled:Unsigned System Integrity Policy**. +> If the policy you are trying to remove is a signed App Control policy, you must first deploy a signed replacement policy that includes option **6 Enabled:Unsigned System Integrity Policy**. > > The replacement policy must have the same PolicyId as the one it's replacing and a version that's equal to or greater than the existing policy. The replacement policy must also include \. > @@ -33,29 +32,29 @@ To make a policy effectively inactive before removing it, you can first replace 1. Replace the policy rules with "Allow *" rules; 2. Set option **3 Enabled:Audit Mode** to change the policy to audit mode only; 3. Set option **11 Disabled:Script Enforcement**; -4. Allow all COM objects. See [Allow COM object registration in a WDAC policy](/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy#examples); +4. Allow all COM objects. See [Allow COM object registration in an App Control policy](../design/allow-com-object-registration-in-appcontrol-policy.md#examples); 5. If applicable, remove option **0 Enabled:UMCI** to convert the policy to kernel mode only. > [!IMPORTANT] -> After you remove a policy, restart the computer for it to take effect. You can't remove WDAC policies without restarting the device. +> After you remove a policy, restart the computer for it to take effect. You can't remove App Control policies without restarting the device. -### Remove WDAC policies using CiTool.exe +### Remove App Control policies using CiTool.exe -Beginning with the Windows 11 2022 Update, you can remove WDAC policies using CiTool.exe. From an elevated command window, run the following command. Be sure to replace the text *PolicyId GUID* with the actual PolicyId of the WDAC policy you want to remove: +Beginning with the Windows 11 2022 Update, you can remove App Control policies using CiTool.exe. From an elevated command window, run the following command. Be sure to replace the text *PolicyId GUID* with the actual PolicyId of the App Control policy you want to remove: ```powershell - CiTool.exe -rp "{PolicyId GUID}" -json +CiTool.exe -rp "{PolicyId GUID}" -json ``` Then restart the computer. -### Remove WDAC policies using MDM solutions like Intune +### Remove App Control policies using MDM solutions like Intune -You can use a Mobile Device Management (MDM) solution, like Microsoft Intune, to remove WDAC policies from client machines using the [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp). +You can use a Mobile Device Management (MDM) solution, like Microsoft Intune, to remove App Control policies from client machines using the [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp). - -1. Mount the EFI volume and make the directory, if it doesn't exist, in an elevated PowerShell prompt: - - ```powershell - $MountPoint = 'C:\EFIMount' - $EFIDestinationFolder = "$MountPoint\EFI\Microsoft\Boot\CiPolicies\Active" - $EFIPartition = (Get-Partition | Where-Object IsSystem).AccessPaths[0] - if (-Not (Test-Path $MountPoint)) { New-Item -Path $MountPoint -Type Directory -Force } - mountvol $MountPoint $EFIPartition - if (-Not (Test-Path $EFIDestinationFolder)) { New-Item -Path $EFIDestinationFolder -Type Directory -Force } - ``` - -2. Copy the signed policy to the created folder: - - ```powershell - Copy-Item -Path $PolicyBinary -Destination $EFIDestinationFolder -Force - ``` - -3. Restart the system. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/deployment/wdac-deployment-guide.md b/windows/security/application-security/application-control/windows-defender-application-control/deployment/wdac-deployment-guide.md deleted file mode 100644 index 46d07c19a7..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/deployment/wdac-deployment-guide.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Deploying Windows Defender Application Control (WDAC) policies -description: Learn how to plan and implement a WDAC deployment. -ms.localizationpriority: medium -ms.date: 01/23/2023 -ms.topic: overview ---- - -# Deploying Windows Defender Application Control (WDAC) policies - -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -You should now have one or more Windows Defender Application Control (WDAC) policies ready to deploy. If you haven't yet completed the steps described in the [WDAC Design Guide](../design/wdac-design-guide.md), do so now before proceeding. - -## Convert your WDAC policy XML to binary - -Before you deploy your WDAC policies, you must first convert the XML to its binary form. You can do this using the following PowerShell example. You must set the $WDACPolicyXMLFile variable to point to your WDAC policy XML file. - - ```powershell - ## Update the path to your WDAC policy XML - $WDACPolicyXMLFile = $env:USERPROFILE + "\Desktop\MyWDACPolicy.xml" - [xml]$WDACPolicy = Get-Content -Path $WDACPolicyXMLFile - if (($WDACPolicy.SiPolicy.PolicyID) -ne $null) ## Multiple policy format (For Windows builds 1903+ only, including Server 2022) - { - $PolicyID = $WDACPolicy.SiPolicy.PolicyID - $PolicyBinary = $PolicyID+".cip" - } - else ## Single policy format (Windows Server 2016 and 2019, and Windows 10 1809 LTSC) - { - $PolicyBinary = "SiPolicy.p7b" - } - - ## Binary file will be written to your desktop - ConvertFrom-CIPolicy -XmlFilePath $WDACPolicyXMLFile -BinaryFilePath $env:USERPROFILE\Desktop\$PolicyBinary - ``` - -## Plan your deployment - -As with any significant change to your environment, implementing application control can have unintended consequences. To ensure the best chance for success, you should follow safe deployment practices and plan your deployment carefully. Identify the devices you'll manage with WDAC and split them into deployment rings. This way, you can control the speed and scale of the deployment and respond if anything goes wrong. Define the success criteria that will determine when it's safe to continue from one ring to the next. - -All Windows Defender Application Control policy changes should be deployed in audit mode before proceeding to enforcement. Carefully monitor events from devices where the policy has been deployed to ensure the block events you observe match your expectation before broadening the deployment to other deployment rings. If your organization uses Microsoft Defender for Endpoint, you can use the Advanced Hunting feature to centrally monitor WDAC-related events. Otherwise, we recommend using an event log forwarding solution to collect relevant events from your managed endpoints. - -## Choose how to deploy WDAC policies - -> [!IMPORTANT] -> Due to a known issue, you should always activate new **signed** WDAC Base policies with a reboot on systems with [**memory integrity**](../../../../hardware-security/enable-virtualization-based-protection-of-code-integrity.md) enabled. We recommend [deploying via script](deploy-wdac-policies-with-script.md) in this case. -> -> This issue does not affect updates to signed Base policies that are already active on the system, deployment of unsigned policies, or deployment of supplemental policies (signed or unsigned). It also does not affect deployments to systems that are not running memory integrity. - -There are several options to deploy Windows Defender Application Control policies to managed endpoints, including: - -- [Deploy using a Mobile Device Management (MDM) solution](deploy-wdac-policies-using-intune.md), such as Microsoft Intune -- [Deploy using Microsoft Configuration Manager](deploy-wdac-policies-with-memcm.md) -- [Deploy via script](deploy-wdac-policies-with-script.md) -- [Deploy via group policy](deploy-wdac-policies-using-group-policy.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/common-wdac-use-cases.md b/windows/security/application-security/application-control/windows-defender-application-control/design/common-wdac-use-cases.md deleted file mode 100644 index 7f203efaf7..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/common-wdac-use-cases.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Policy creation for common WDAC usage scenarios -description: Develop a plan for deploying Windows Defender Application Control (WDAC) in your organization based on these common scenarios. -ms.localizationpriority: medium -ms.date: 04/05/2023 -ms.topic: conceptual ---- - -# Windows Defender Application Control deployment in different scenarios: types of devices - -> [!NOTE] -> Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -Typically, deployment of Windows Defender Application Control (WDAC) happens best in phases, rather than being a feature that you simply "turn on." The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices. The following table can help you begin to develop a plan for deploying WDAC in your organization. It's common for organizations to have device use cases across each of the categories described. - -## Types of devices - -| Type of device | How WDAC relates to this type of device | -|------------------------------------|------------------------------------------------------| -| **Lightly managed devices**: Company-owned, but users are free to install software.
Devices are required to run organization's antivirus solution and client management tools. | Windows Defender Application Control can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. | -| **Fully managed devices**: Allowed software is restricted by IT department.
Users can request for more software, or install from a list of applications provided by IT department.
Examples: locked-down, company-owned desktops and laptops. | An initial baseline Windows Defender Application Control policy can be established and enforced. Whenever the IT department approves more applications, it updates the WDAC policy and (for unsigned LOB applications) the catalog. | -| **Fixed-workload devices**: Perform same tasks every day.
Lists of approved applications rarely change.
Examples: kiosks, point-of-sale systems, call center computers. | Windows Defender Application Control can be deployed fully, and deployment and ongoing administration are relatively straightforward.
After Windows Defender Application Control deployment, only approved applications can run. This rule is because of protections offered by WDAC. | -| **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | In most cases, Windows Defender Application Control doesn't apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. However, you may choose to deploy an audit-mode policy to these devices or employ a blocklist only policy to prevent specific apps or binaries that are considered malicious or vulnerable by your organization. | - -## An introduction to Lamna Healthcare Company - -In the next set of articles, we'll explore each of the above scenarios using a fictional organization called Lamna Healthcare Company. - -Lamna Healthcare Company (Lamna) is a large healthcare provider operating in the United States. Lamna employs thousands of people, from doctors and nurses to accountants, in-house lawyers, and IT technicians. Their device use cases are varied and include single-user workstations for their professional staff, shared kiosks used by doctors and nurses to access patient records, dedicated medical devices such as MRI scanners, and many others. Additionally, Lamna has a relaxed, bring-your-own-device policy for many of their professional staff. - -Lamna uses [Microsoft Intune](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager) in hybrid mode with both Configuration Manager and Intune. Although they use Microsoft Intune to deploy many applications, Lamna has always had relaxed application usage practices: individual teams and employees have been able to install and use any applications they deem necessary for their role on their own workstations. Lamna also recently started to use [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) for better endpoint detection and response. - -Recently, Lamna experienced a ransomware event that required an expensive recovery process and may have included data exfiltration by the unknown attacker. Part of the attack included installing and running malicious binaries that evaded detection by Lamna's antivirus solution but would have been blocked by an application control policy. In response, Lamna's executive board has authorized many new security IT responses, including tightening policies for application use and introducing application control. - -## Up next - -- [Create a Windows Defender Application Control policy for lightly managed devices](create-wdac-policy-for-lightly-managed-devices.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/create-wdac-policy-for-fully-managed-devices.md b/windows/security/application-security/application-control/windows-defender-application-control/design/create-wdac-policy-for-fully-managed-devices.md deleted file mode 100644 index 76720b9535..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/create-wdac-policy-for-fully-managed-devices.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: Create a WDAC policy for fully managed devices -description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in system core. -ms.topic: conceptual -ms.localizationpriority: medium -ms.date: 11/07/2022 ---- - -# Create a WDAC policy for fully managed devices - ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -This section outlines the process to create a Windows Defender Application Control (WDAC) policy for **fully managed devices** within an organization. The key difference between this scenario and [lightly managed devices](create-wdac-policy-for-lightly-managed-devices.md) is that all software deployed to a fully managed device is managed by IT and users of the device can't install arbitrary apps. Ideally, all apps are deployed using a software distribution solution, such as Microsoft Intune. Additionally, users on fully managed devices should ideally run as standard user and only authorized IT pros have administrative access. - -> [!NOTE] -> Some of the Windows Defender Application Control options described in this topic are only available on Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs. - -As described in [common Windows Defender Application Control deployment scenarios](common-wdac-use-cases.md), we'll use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of application control to prevent unwanted or unauthorized applications from running on their managed devices. - -**Alice Pena** is the IT team lead tasked with the rollout of WDAC. - -Alice previously created a policy for the organization's lightly managed devices. Some devices, however, are more tightly managed and can benefit from a more constrained policy. In particular, certain job functions such as administrative staff and firstline workers aren't granted administrator level access to their devices. Similarly, shared kiosks are configured only with a managed set of apps and all users of the device except IT run as standard user. On these devices, all apps are deployed and installed by IT. - -## Define the "circle-of-trust" for fully managed devices - -Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's fully managed devices: - -- All clients are running Windows 10 version 1903 or above or Windows 11; -- All clients are managed by Configuration Manager or with Intune; -- Most, but not all, apps are deployed using Configuration Manager; -- Sometimes, IT staff install apps directly to these devices without using Configuration Manager; -- All users except IT are standard users on these devices. - -Alice's team develops a simple console application, called *LamnaITInstaller.exe*, which will become the authorized way for IT staff to install apps directly to devices. *LamnaITInstaller.exe* allows the IT pro to launch another process, such as an app installer. Alice will configure *LamnaITInstaller.exe* as an extra managed installer for WDAC and allows her to remove the need for filepath rules. - -Based on the above, Alice defines the pseudo-rules for the policy: - -1. **"Windows works"** rules that authorize: - - Windows - - WHQL (third-party kernel drivers) - - Windows Store signed apps - -2. **"ConfigMgr works"** rules that include signer and hash rules for Configuration Manager components to properly function. -3. **Allow Managed Installer** (Configuration Manager and *LamnaITInstaller.exe* configured as a managed installer) - -The critical differences between this set of pseudo-rules and those pseudo-rules defined for Lamna's [lightly managed devices](create-wdac-policy-for-lightly-managed-devices.md#define-the-circle-of-trust-for-lightly-managed-devices) are: - -- Removal of the Intelligent Security Graph (ISG) option; and -- Removal of filepath rules. - -## Create a custom base policy using an example WDAC base policy - -Having defined the "circle-of-trust", Alice is ready to generate the initial policy for Lamna's fully managed devices and decides to use Configuration Manager to create the initial base policy and then customize it to meet Lamna's needs. - -Alice follows these steps to complete this task: - -> [!NOTE] -> If you do not use Configuration Manager or prefer to use a different [example Windows Defender Application Control base policy](example-wdac-base-policies.md) for your own policy, skip to step 2 and substitute the Configuration Manager policy path with your preferred example base policy. - -1. [Use Configuration Manager to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 or above, or Windows 11. - -2. On the client device, run the following commands in an elevated Windows PowerShell session to initialize variables: - - ```powershell - $PolicyPath=$env:userprofile+"\Desktop\" - $PolicyName= "Lamna_FullyManagedClients_Audit" - $LamnaPolicy=$PolicyPath+$PolicyName+".xml" - $ConfigMgrPolicy=$env:windir+"\CCM\DeviceGuard\MergedPolicy_Audit_ISG.xml" - ``` - -3. Copy the policy created by Configuration Manager to the desktop: - - ```powershell - cp $ConfigMgrPolicy $LamnaPolicy - ``` - -4. Give the new policy a unique ID, descriptive name, and initial version number: - - ```powershell - Set-CIPolicyIdInfo -FilePath $LamnaPolicy -PolicyName $PolicyName -ResetPolicyID - Set-CIPolicyVersion -FilePath $LamnaPolicy -Version "1.0.0.0" - ``` - -5. Modify the copied policy to set policy rules: - - ```powershell - Set-RuleOption -FilePath $LamnaPolicy -Option 3 # Audit Mode - Set-RuleOption -FilePath $LamnaPolicy -Option 6 # Unsigned Policy - Set-RuleOption -FilePath $LamnaPolicy -Option 9 # Advanced Boot Menu - Set-RuleOption -FilePath $LamnaPolicy -Option 12 # Enforce Store Apps - Set-RuleOption -FilePath $LamnaPolicy -Option 13 # Managed Installer - Set-RuleOption -FilePath $LamnaPolicy -Option 16 # No Reboot - Set-RuleOption -FilePath $LamnaPolicy -Option 17 # Allow Supplemental - Set-RuleOption -FilePath $LamnaPolicy -Option 19 # Dynamic Code Security - ``` - -6. If appropriate, add more signer or file rules to further customize the policy for your organization. - -7. Use [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy) to convert the Windows Defender Application Control policy to a binary format: - - ```powershell - [xml]$PolicyXML = Get-Content $LamnaPolicy - $LamnaPolicyBin = Join-Path $PolicyPath "$($PolicyXML.SiPolicy.PolicyID).cip" - ConvertFrom-CIPolicy $LamnaPolicy $LamnaPolicyBin - ``` - -8. Upload your base policy XML and the associated binary to a source control solution such as [GitHub](https://github.com/) or a document management solution such as [Office 365 SharePoint](https://products.office.com/sharepoint/collaboration). - -At this point, Alice now has an initial policy that is ready to deploy in audit mode to the managed clients within Lamna. - -## Security considerations of this fully managed policy - -Alice has defined a policy for Lamna's fully managed devices that makes some trade-offs between security and manageability for apps. Some of the trade-offs include: - -- **Users with administrative access**
- Although applying to fewer users, Lamna still allows some IT staff to sign in to its fully managed devices as administrator. This privilege allows these users (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer that would allow them to gain persistent app authorization for whatever apps or binaries they wish. - - Possible mitigations: - - Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies. - - Create and deploy signed catalog files as part of the app deployment process in order to remove the requirement for managed installer. - - Use device attestation to detect the configuration state of WDAC at boot time and use that information to condition access to sensitive corporate resources. -- **Unsigned policies**
- Unsigned policies can be replaced or removed without consequence by any process running as administrator. Unsigned base policies that also enable supplemental policies can have their "circle-of-trust" altered by any unsigned supplemental policy. - - Existing mitigations applied: - - Limit who can elevate to administrator on the device. - - Possible mitigations: - - Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies. -- **Managed installer**
- See [security considerations with managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md#security-considerations-with-managed-installer) - - Existing mitigations applied: - - Limit who can elevate to administrator on the device. - - Possible mitigations: - - Create and deploy signed catalog files as part of the app deployment process in order to remove the requirement for managed installer. -- **Supplemental policies**
- Supplemental policies are designed to relax the associated base policy. Additionally allowing unsigned policies allows any administrator process to expand the "circle-of-trust" defined by the base policy without restriction. - - Possible mitigations: - - Use signed WDAC policies that allow authorized signed supplemental policies only. - - Use a restrictive audit mode policy to audit app usage and augment vulnerability detection. - -## Up next - -- [Create a Windows Defender Application Control policy for fixed-workload devices using a reference computer](create-wdac-policy-using-reference-computer.md) -- [Prepare to deploy Windows Defender Application Control policies](../deployment/wdac-deployment-guide.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/create-wdac-policy-using-reference-computer.md b/windows/security/application-security/application-control/windows-defender-application-control/design/create-wdac-policy-using-reference-computer.md deleted file mode 100644 index 4b7a2f317b..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/create-wdac-policy-using-reference-computer.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: Create a WDAC policy using a reference computer -description: To create a Windows Defender Application Control (WDAC) policy that allows all code installed on a reference computer within your organization, follow this guide. -ms.localizationpriority: medium -ms.date: 08/08/2022 -ms.topic: how-to ---- - -# Create a WDAC policy using a reference computer - ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -This section outlines the process to create a Windows Defender Application Control (WDAC) policy **using a reference computer** that is already configured with the software you want to allow. You can use this approach for fixed-workload devices that are dedicated to a specific functional purpose and share common configuration attributes with other devices servicing the same functional role. Examples of fixed-workload devices may include Active Directory Domain Controllers, Secure Admin Workstations, pharmaceutical drug-mixing equipment, manufacturing devices, cash registers, ATMs, etc. This approach can also be used to turn on WDAC on systems "in the wild" and you want to minimize the potential impact on users' productivity. - -> [!NOTE] -> Some of the Windows Defender Application Control options described in this topic are only available on Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs. - -As described in [common Windows Defender Application Control deployment scenarios](common-wdac-use-cases.md), we'll use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of application control to prevent unwanted or unauthorized applications from running on their managed devices. - -**Alice Pena** is the IT team lead tasked with the rollout of WDAC. - -## Create a custom base policy using a reference device - -Alice previously created a policy for the organization's fully managed end-user devices. She now wants to use WDAC to protect Lamna's critical infrastructure servers. Lamna's imaging practice for infrastructure systems is to establish a "golden" image as a reference for what an ideal system should look like, and then use that image to clone more company assets. Alice decides to use these same "golden" image systems to create the WDAC policies, which will result in separate custom base policies for each type of infrastructure server. As with imaging, she'll have to create policies from multiple golden computers based on model, department, application set, and so on. - -> [!NOTE] -> Make sure the reference computer is virus and malware-free, and install any software you want to be scanned before creating the WDAC policy.

Each installed software application should be validated as trustworthy before you create a policy.

We recommend that you review the reference computer for software that can load arbitrary DLLs and run code or scripts that could render the PC more vulnerable. Examples include software aimed at development or scripting such as msbuild.exe (part of Visual Studio and the .NET Framework) which can be removed if you don't want to run scripts. You can remove or disable such software on the reference computer. - -Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's critical infrastructure servers: - -- All devices are running Windows Server 2019 or above; -- All apps are centrally managed and deployed; -- No interactive users. - -Based on the above, Alice defines the pseudo-rules for the policy: - -1. **"Windows works"** rules that authorize: - - Windows - - WHQL (third-party kernel drivers) - - Windows Store signed apps - -2. Rules for **scanned files** that authorize all pre-existing app binaries found on the device - -To create the WDAC policy, Alice runs each of the following commands in an elevated Windows PowerShell session, in order: - -1. Initialize variables. - - ```powershell - $PolicyPath=$env:userprofile+"\Desktop\" - $PolicyName="FixedWorkloadPolicy_Audit" - $LamnaServerPolicy=$PolicyPath+$PolicyName+".xml" - $DefaultWindowsPolicy=$env:windir+"\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Audit.xml" - ``` - -2. Use [New-CIPolicy](/powershell/module/configci/new-cipolicy) to create a new WDAC policy by scanning the system for installed applications: - - ```powershell - New-CIPolicy -FilePath $LamnaServerPolicy -Level SignedVersion -Fallback FilePublisher,FileName,Hash -ScanPath c:\ -UserPEs -MultiplePolicyFormat -OmitPaths c:\Windows,'C:\Program Files\WindowsApps\',c:\windows.old\,c:\users\ 3> CIPolicyLog.txt - ``` - - > [!Note] - > - > - You can add the **-Fallback** parameter to catch any applications not discovered using the primary file rule level specified by the **-Level** parameter. For more information about file rule level options, see [Windows Defender Application Control file rule levels](select-types-of-rules-to-create.md). - > - To specify that the WDAC policy scan only a specific drive, include the **-ScanPath** parameter followed by a path. Without this parameter, the tool will scan the C-drive by default. - > - When you specify the **-UserPEs** parameter (to include user mode executables in the scan), rule option **0 Enabled:UMCI** is automatically added to the WDAC policy. If you do not specify **-UserPEs**, the policy will be empty of user mode executables and will only have rules for kernel mode binaries like drivers. In other words, the allow list will not include applications. If you create such a policy and later add rule option **0 Enabled:UMCI**, all attempts to start applications will cause a response from Windows Defender Application Control. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application. - > - To create a policy for Windows 10 1903 and above, including support for supplemental policies, use **-MultiplePolicyFormat**. - > - To specify a list of paths to exclude from the scan, use the **-OmitPaths** option and supply a comma-delimited list of paths. - > - The preceding example includes `3> CIPolicylog.txt`, which redirects warning messages to a text file, **CIPolicylog.txt**. - -3. Merge the new policy with the WindowsDefault_Audit policy to ensure all Windows binaries and kernel drivers will load. - - ```powershell - Merge-CIPolicy -OutputFilePath $LamnaServerPolicy -PolicyPaths $LamnaServerPolicy,$DefaultWindowsPolicy - ``` - -4. Give the new policy a descriptive name, and initial version number: - - ```powershell - Set-CIPolicyIdInfo -FilePath $LamnaServerPolicy -PolicyName $PolicyName - Set-CIPolicyVersion -FilePath $LamnaServerPolicy -Version "1.0.0.0" - ``` - -5. Modify the merged policy to set policy rules: - - ```powershell - Set-RuleOption -FilePath $LamnaServerPolicy -Option 3 # Audit Mode - Set-RuleOption -FilePath $LamnaServerPolicy -Option 6 # Unsigned Policy - Set-RuleOption -FilePath $LamnaServerPolicy -Option 9 # Advanced Boot Menu - Set-RuleOption -FilePath $LamnaServerPolicy -Option 12 # Enforce Store Apps - Set-RuleOption -FilePath $LamnaServerPolicy -Option 16 # No Reboot - Set-RuleOption -FilePath $LamnaServerPolicy -Option 17 # Allow Supplemental - Set-RuleOption -FilePath $LamnaServerPolicy -Option 19 # Dynamic Code Security - ``` - -6. If appropriate, add more signer or file rules to further customize the policy for your organization. - -7. Use [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy) to convert the WDAC policy to a binary format: - - ```powershell - [xml]$LamnaServerPolicyXML = Get-Content $LamnaServerPolicy - $PolicyId = $LamnaServerPolicyXML.SiPolicy.PolicyId - $LamnaServerPolicyBin = $PolicyPath+$PolicyId+".cip" - ConvertFrom-CIPolicy $LamnaServerPolicy $LamnaServerPolicyBin - ``` - -8. Upload the base policy XML and the associated binary to a source control solution such as [GitHub](https://github.com/) or a document management solution such as [Office 365 SharePoint](https://products.office.com/sharepoint/collaboration). - -Alice now has an initial policy for Lamna's critical infrastructure servers that is ready to deploy in audit mode. - -## Create a custom base policy to minimize user impact on in-use client devices - -Alice previously created a policy for the organization's fully managed devices. Alice has included the fully managed device policy as part of Lamna's device build process so all new devices now begin with WDAC enabled. She's preparing to deploy the policy to systems that are already in use, but is worried about causing disruption to users' productivity. To minimize that risk, Alice decides to take a different approach for those systems. She'll continue to deploy the fully managed device policy in audit mode to those devices, but for enforcement mode she'll merge the fully managed device policy rules with a policy created by scanning the device for all previously installed software. In this way, each device is treated as its own "golden" system. - -Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's fully managed in-use devices: - -- Everything described for Lamna's [Fully Managed Devices](create-wdac-policy-for-fully-managed-devices.md); -- Users have installed apps that they need to continue to run. - -Based on the above, Alice defines the pseudo-rules for the policy: - -1. Everything included in the Fully Managed Devices policy -2. Rules for **scanned files** that authorize all pre-existing app binaries found on the device - -For Lamna's existing, in-use devices, Alice deploys a script along with the Fully Managed Devices policy XML (not the converted WDAC policy binary). The script then generates a custom policy locally on the client as described in the previous section, but instead of merging with the DefaultWindows policy, the script merges with Lamna's Fully Managed Devices policy. Alice also modifies the steps above to match the requirements of this different use case. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md b/windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md deleted file mode 100644 index caebc2c6c3..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Plan for WDAC policy management -description: Learn about the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control policies. -ms.localizationpriority: medium -ms.date: 11/22/2023 -ms.topic: conceptual ---- - -# Plan for Windows Defender Application Control lifecycle policy management - ->[!NOTE] ->Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -This article describes the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control (WDAC) policies. - -## Policy XML lifecycle management - -The first step in implementing application control is to consider how your policies will be managed and maintained over time. Developing a process for managing Windows Defender Application Control policies helps ensure that WDAC continues to effectively control how applications are allowed to run in your organization. - -Most Windows Defender Application Control policies will evolve over time and proceed through a set of identifiable phases during their lifetime. Typically, these phases include: - -1. [Define (or refine) the "circle-of-trust"](understand-wdac-policy-design-decisions.md) for the policy and build an audit mode version of the policy XML. In audit mode, block events are generated but files aren't prevented from executing. -2. [Deploy the audit mode policy](/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies) to intended devices. -3. [Monitor audit block events](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations) from the intended devices and add/edit/delete rules as needed to address unexpected/unwanted blocks. -4. Repeat steps 2-3 until the remaining block events meet expectations. -5. [Generate the enforced mode version](/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies) of the policy. In enforced mode, files that the policy doesn't allow are prevented from running and corresponding block events are generated. -6. [Deploy the enforced mode policy](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) to intended devices. We recommend using staged rollouts for enforced policies to detect and respond to issues before deploying the policy broadly. -7. Repeat steps 1-6 anytime the desired "circle-of-trust" changes. - -![Recommended WDAC policy deployment process.](../images/policyflow.png) - -### Keep WDAC policies in a source control or document management solution - -To effectively manage Windows Defender Application Control policies, you should store and maintain your policy XML documents in a central repository that is accessible to everyone responsible for WDAC policy management. We recommend a source control solution such as [GitHub](https://github.com/) or a document management solution such as [Office 365 SharePoint](https://products.office.com/sharepoint/collaboration), which provide version control and allow you to specify metadata about the XML documents. - -### Set PolicyName, PolicyID, and Version metadata for each policy - -Use the [Set-CIPolicyIDInfo](/powershell/module/configci/set-cipolicyidinfo) cmdlet to give each policy a descriptive name and set a unique policy ID. These unique attributes help you differentiate each policy when reviewing Windows Defender Application Control events or when viewing the policy XML document. Although you can specify a string value for PolicyId, for policies using the multiple policy format we recommend using the -ResetPolicyId switch to let the system autogenerate a unique ID for the policy. - -> [!NOTE] -> PolicyID only applies to policies using the [multiple policy format](deploy-multiple-wdac-policies.md) on computers running Windows 10, version 1903 and above, or Windows 11. Running -ResetPolicyId on a policy created for pre-1903 computers will convert it to multiple policy format and prevent it from running on those earlier versions of Windows 10. -> PolicyID should be set only once per policy and use different PolicyID's for the audit and enforced mode versions of each policy. - -In addition, we recommend using the [Set-CIPolicyVersion](/powershell/module/configci/set-cipolicyversion) cmdlet to increment the policy's internal version number when you make changes to the policy. The version must be defined as a standard four-part version string (for example, "1.0.0.0"). - -### Policy rule updates - -You might need to revise your policy when new apps are deployed or existing apps are updated by the software publisher to ensure that apps run correctly. Whether policy rule updates are required will depend significantly on the types of rules your policy includes. Rules based on codesigning certificates provide the most resiliency against app changes while rules based on file attributes or hash are most likely to require updates when apps change. Alternatively, if you use WDAC [managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md) functionality and consistently deploy all apps and their updates through your managed installer, then you're less likely to need policy updates. - -## WDAC event management - -Each time that WDAC blocks a process, events are written to either the CodeIntegrity\Operational or the AppLocker\MSI and Script Windows event logs. The event describes the file that tried to run, the attributes of that file and its signatures, and the process that attempted to run the blocked file. - -Collecting these events in a central location can help you maintain your Windows Defender Application Control policy and troubleshoot rule configuration problems. You can [use the Azure Monitor Agent](/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent) to automatically collect your WDAC events for analysis. - -Additionally, [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) collects WDAC events which can be queried using the [advanced hunting](../operations/querying-application-control-events-centrally-using-advanced-hunting.md) feature. - -## Application and user support policy - -Considerations include: - -- What type of end-user support is provided for blocked applications? -- How are new rules added to the policy? -- How are existing rules updated? -- Are events forwarded for review? - -### Help desk support - -If your organization has an established help desk support department in place, consider the following points when deploying Windows Defender Application Control policies: - -- What documentation does your support department require for new policy deployments? -- What are the critical processes in each business group both in work flow and timing that will be affected by application control policies and how could they affect your support department's workload? -- Who are the contacts in the support department? -- How will the support department resolve application control issues between the end user and those resources who maintain the Windows Defender Application Control rules? - -### End-user support - -Because Windows Defender Application Control is preventing unapproved apps from running, it's important that your organization carefully plans how to provide end-user support. Considerations include: - -- Do you want to use an intranet site as a frontline of support for users who try to run a blocked app? -- How do you want to support exceptions to the policy? Will you allow users to run a script to temporarily allow access to a blocked app? - -## Document your plan - -After deciding how your organization will manage your Windows Defender Application Control policy, record your findings. - -- **End-user support policy.** Document the process that you'll use for handling calls from users who have attempted to run a blocked app, and ensure that support personnel have clear escalation steps so that the administrator can update the Windows Defender Application Control policy, if necessary. -- **Event processing.** Document whether events will be collected in a central location called a store, how that store will be archived, and whether the events will be processed for analysis. -- **Policy management.** Detail what policies are planned, how they'll be managed, and how rules will be maintained over time. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/script-enforcement.md b/windows/security/application-security/application-control/windows-defender-application-control/design/script-enforcement.md deleted file mode 100644 index 8ebfc6ca57..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/script-enforcement.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Understand WDAC script enforcement -description: WDAC script enforcement -ms.manager: jsuther -ms.date: 05/26/2023 -ms.topic: conceptual -ms.localizationpriority: medium ---- - -# Script enforcement with Windows Defender Application Control (WDAC) - -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -> [!IMPORTANT] -> Option **11 Disabled:Script Enforcement** is not supported on **Windows Server 2016** or on **Windows 10 1607 LTSB** and should not be used on those platforms. Doing so will result in unexpected script enforcement behaviors. - -## Script enforcement overview - -By default, script enforcement is enabled for all WDAC policies unless the option **11 Disabled:Script Enforcement** is set in the policy. WDAC script enforcement involves a handshake between an enlightened script host, such as PowerShell, and WDAC. However, the script host handles the actual enforcement behavior. Some script hosts, like the Microsoft HTML Application Host (mshta.exe), block all code execution if any WDAC UMCI policy is active. Most script hosts first ask WDAC whether a script should be allowed to run based on the WDAC policies currently active. The script host then either blocks, allows, or changes *how* the script is run to best protect the user and the device. - -Validation for signed scripts is done using the [WinVerifyTrust API](/windows/win32/api/wintrust/nf-wintrust-winverifytrust). To pass validation, the signature root must be present in the trusted root store on the device and your WDAC policy must allow it. This behavior is different from WDAC validation for executable files, which doesn't require installation of the root certificate. - -WDAC shares the *AppLocker - MSI and Script* event log for all script enforcement events. Whenever a script host asks WDAC if a script should be allowed, an event is logged with the answer WDAC returned to the script host. For more information on WDAC script enforcement events, see [Understanding Application Control events](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations#windows-applocker-msi-and-script-log). - -> [!NOTE] -> When a script runs that is not allowed by policy, WDAC raises an event indicating that the script was "blocked." However, the actual script enforcement behavior is handled by the script host and may not actually completely block the file from running. -> -> Also be aware that some script hosts may change how they behave even if a WDAC policy is in audit mode only. You should review the script host specific information in this article and test thoroughly within your environment to ensure the scripts you need to run are working properly. - -## Enlightened script hosts that are part of Windows - -### PowerShell - -Your WDAC policies must allow all PowerShell scripts (.ps1), modules (.psm1), and manifests (.psd1) for them to run with Full Language rights. - -Your WDAC policies must also allow any **dependent modules** that are loaded by an allowed module, and module functions must be exported explicitly by name when WDAC is enforced. Modules that don't specify any exported functions (no export name list) still load but no module functions are accessible. Modules that use wildcards (\*) in their name will fail to load. - -Any PowerShell script that isn't allowed by WDAC policy still runs, but only in Constrained Language Mode. - -PowerShell **dot-sourcing** isn't recommended. Instead, scripts should use PowerShell modules to provide common functionality. If an allowed script file does try to run dot-sourced script files, those script files must also pass the policy. - -WDAC puts **interactive PowerShell** into Constrained Language Mode if any WDAC UMCI policy is enforced and *any* active WDAC policy enables script enforcement, even if that policy is in audit mode. To run interactive PowerShell with Full Language rights, you must disable script enforcement for *all* policies. - -For more information, see [About Language Modes](/powershell/module/microsoft.powershell.core/about/about_language_modes) and [Constrained Language Mode](https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/). - -### VBscript, cscript, and jscript - -Your WDAC policies must allow all scripts run using the Windows Based Script Host (wscript.exe) or the Microsoft Console Based Script Host (cscript.exe). If not, the script is blocked. - -### Microsoft HTML Application Host (MSHTA) and MSXML - -All code execution using MSHTA or MSXML is blocked if any WDAC policy with script enforcement is active, even if that policy is in audit mode. - -### COM objects - -WDAC additionally enforces a restricted allowlist for COM objects that your WDAC policy can expand or further restrict. COM object enforcement **isn't** affected by option **11 Disabled:Script Enforcement**. For more information on how to allow or deny COM objects, see [Allow COM object registration](/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy). - -## Scripts that aren't directly controlled by WDAC - -WDAC doesn't directly control code run via the Windows Command Processor (cmd.exe), including .bat/.cmd script files. However, anything that such a batch script tries to run is subject to WDAC control. If you don't need to run cmd.exe, it's recommended to block it outright or allow it only by exception based on the calling process. See [Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules](/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules). - -WDAC doesn't control scripts run through an unenlightened script host, such as many 3rd-party Java or Python engines. If your WDAC policy allows an unenlightened script host to run, then you implicitly allow all scripts run through that host. For non-Microsoft script hosts, you should check with the software vendor whether their script hosts are enlightened to WDAC policy. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/understanding-wdac-policy-settings.md b/windows/security/application-security/application-control/windows-defender-application-control/design/understanding-wdac-policy-settings.md deleted file mode 100644 index 6f2f154463..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/understanding-wdac-policy-settings.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Understanding Windows Defender Application Control (WDAC) secure settings -description: Learn about secure settings in Windows Defender Application Control. -ms.localizationpriority: medium -ms.date: 04/05/2023 -ms.topic: conceptual ---- - -# Understanding WDAC Policy Settings - -Windows Defender Application Control (WDAC) policies expose a Settings section where policy authors can define arbitrary secure settings. Secure Settings provide local admin tamper-free settings for secure boot enabled systems, with policy signing enabled. Settings consist of a Provider, Key, ValueName, and a setting value. Setting values can be of type boolean, ulong, binary, and string. Applications can query for policy settings using WldpQuerySecurityPolicy. - -An example settings section of a Windows Defender Application Control policy: - -```xml - - - - true - - - -``` - -## Example Scenario - -An application that may want to restrict its capabilities, when used on a system with an active Windows Defender Application Control policy. Application authors can define a WDAC policy, setting their application queries, in order to disable certain features. For example, if Contoso's Foo Application wants to disable a risky feature, such as macro execution, they can define a WDAC policy setting, and query for it at runtime. Contoso can then instruct IT administrators to configure the setting in their WDAC policy, if they don't want Foo Application to execute macros on a system with a WDAC policy. - -## WldpQuerySecurityPolicy - -API that queries the secure settings of a Windows Defender Application Control policy. - -### Syntax - -``` C++ -HRESULT WINAPI WldpQuerySecurityPolicy( - _In_ const UNICODE_STRING * Provider, - _In_ const UNICODE_STRING * Key, - _In_ const UNICODE_STRING * ValueName, - _Out_ PWLDP_SECURE_SETTING_VALUE_TYPE ValueType, - _Out_writes_bytes_opt_(*ValueSize) PVOID Value, - _Inout_ PULONG ValueSize) -``` - -### Parameters - -Provider [in] -Setting Provider name. - -#### Key [in] - -Key name of the Key-Value pair under Setting Provider "Provider". - -#### ValueName [in] - -The value name of the "Key-Value" pair. - -#### ValueType [in, out] - -Pointer to receive the value type. - -#### Value [in, out] - -Pointer to a buffer to receive the value. The buffer should be of size "ValueSize". If this value is NULL, this function returns the required buffer size for Value. - -#### ValueSize [in, out] - -On input, it indicates the buffer size of "Value". On successful return, it indicates the size of data written to Value buffer. - -#### Return Value - -This method returns S_OK if successful or a failure code otherwise. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/use-wdac-policy-to-control-specific-plug-ins-add-ins-and-modules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/use-wdac-policy-to-control-specific-plug-ins-add-ins-and-modules.md deleted file mode 100644 index d46c2de5a6..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/use-wdac-policy-to-control-specific-plug-ins-add-ins-and-modules.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules -description: WDAC policies can be used not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps. -ms.localizationpriority: medium -ms.date: 11/02/2022 -ms.topic: how-to ---- - -# Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules - -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -You can use Windows Defender Application Control (WDAC) policies to control applications and also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser): - -| Approach | Guideline | -|---|---| -| You can work from a list of plug-ins, add-ins, or modules that you want only a specific application to be able to run. Other applications would be blocked from running them. | Use `New-CIPolicyRule` with the `-AppID` option. | -| In addition, you can work from a list of plug-ins, add-ins, or modules that you want to block in a specific application. Other applications would be allowed to run them. | Use `New-CIPolicyRule` with the `-AppID` and `-Deny` options. | - -For example, to add rules to a WDAC policy called "Lamna_FullyManagedClients_Audit.xml" that allow **addin1.dll** and **addin2.dll** to be run by **ERP1.exe**, Lamna's enterprise resource planning (ERP) application, run the following commands. In the second command, **+=** is used to add a second rule to the **$rule** variable: - -```powershell -$rule = New-CIPolicyRule -DriverFilePath '.\temp\addin1.dll' -Level FileName -AppID '.\ERP1.exe' -$rule += New-CIPolicyRule -DriverFilePath '.\temp\addin2.dll' -Level FileName -AppID '.\ERP1.exe' -``` - -As another example, to create a Windows Defender Application Control policy that blocks **addin3.dll** from running in Microsoft Word, run the following command. You must include the `-Deny` option to block the specified add-ins in the specified application. Once you have all the rules you want, you can merge them into an existing WDAC policy using the Merge-CIPolicy cmdlet as shown here: - -```powershell -$rule += New-CIPolicyRule -DriverFilePath '.\temp\addin3.dll' -Level FileName -Deny -AppID '.\winword.exe' -Merge-CIPolicy -OutputFilePath .\Lamna_FullyManagedClients_Audit.xml -PolicyPaths .\Lamna_FullyManagedClients_Audit.xml -Rules $rule -``` diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/use-wdac-with-intelligent-security-graph.md b/windows/security/application-security/application-control/windows-defender-application-control/design/use-wdac-with-intelligent-security-graph.md deleted file mode 100644 index 02cd2f93cd..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/use-wdac-with-intelligent-security-graph.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Authorize reputable apps with the Intelligent Security Graph (ISG) -description: Automatically authorize applications that Microsoft's ISG recognizes as having known good reputation. -ms.localizationpriority: medium -ms.date: 12/31/2017 -ms.topic: how-to ---- - -# Authorize reputable apps with the Intelligent Security Graph (ISG) - -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -Application control can be difficult to implement in organizations that don't deploy and manage applications through an IT-managed system. In such environments, users can acquire the applications they want to use for work, making it hard to build an effective application control policy. - -To reduce end-user friction and helpdesk calls, you can set Windows Defender Application Control (WDAC) to automatically allow applications that Microsoft's Intelligent Security Graph (ISG) recognizes as having known good reputation. The ISG option helps organizations begin to implement application control even when the organization has limited control over their app ecosystem. To learn more about the ISG, see the Security section in [Major services and features in Microsoft Graph](/graph/overview-major-services). - -> [!WARNING] -> Binaries that are critical to boot the system must be allowed using explicit rules in your WDAC policy. Do not rely on the ISG to authorize these files. -> -> The ISG option is not the recommended way to allow apps that are business critical. You should always authorize business critical apps using explicit allow rules or by installing them with a [managed installer](/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer). - -## How does WDAC work with the ISG? - -The ISG isn't a "list" of apps. Rather, it uses the same vast security intelligence and machine learning analytics that power Microsoft Defender SmartScreen and Microsoft Defender Antivirus to help classify applications as having "known good", "known bad", or "unknown" reputation. This cloud-based AI is based on trillions of signals collected from Windows endpoints and other data sources, and processed every 24 hours. As a result, the decision from the cloud can change. - -WDAC only checks the ISG for binaries that aren't explicitly allowed or denied by your policy, and that weren't installed by a managed installer. When such a binary runs on a system with WDAC enabled with the ISG option, WDAC will check the file's reputation by sending its hash and signing information to the cloud. If the ISG reports that the file has a "known good" reputation, then the file will be allowed to run. Otherwise, it will be blocked by WDAC. - -If the file with good reputation is an application installer, the installer's reputation will pass along to any files that it writes to disk. This way, all the files needed to install and run an app inherit the positive reputation data from the installer. Files authorized based on the installer's reputation will have the $KERNEL.SMARTLOCKER.ORIGINCLAIM kernel Extended Attribute (EA) written to the file. - -WDAC periodically requeries the reputation data on a file. Additionally, enterprises can specify that any cached reputation results are flushed on reboot by using the **Enabled:Invalidate EAs on Reboot** option. - -## Configuring ISG authorization for your WDAC policy - -Setting up the ISG is easy using any management solution you wish. Configuring the ISG option involves these basic steps: - -- [Ensure that the **Enabled:Intelligent Security Graph authorization** option is set in the WDAC policy XML](#ensure-that-the-isg-option-is-set-in-the-wdac-policy-xml) -- [Enable the necessary services to allow WDAC to use the ISG correctly on the client](#enable-the-necessary-services-to-allow-wdac-to-use-the-isg-correctly-on-the-client) - -### Ensure that the ISG option is set in the WDAC policy XML - -To allow apps and binaries based on the Microsoft Intelligent Security Graph, the **Enabled:Intelligent Security Graph authorization** option must be specified in the WDAC policy. This step can be done with the Set-RuleOption cmdlet. You should also set the **Enabled:Invalidate EAs on Reboot** option so that ISG results are verified again after each reboot. The ISG option isn't recommended for devices that don't have regular access to the internet. The following example shows both options set. - -```xml - - - - - - - - - - - - - - - - - - - - - - - -``` - -### Enable the necessary services to allow WDAC to use the ISG correctly on the client - -In order for the heuristics used by the ISG to function properly, other components in Windows must be enabled. You can configure these components by running the appidtel executable in `c:\windows\system32`. - -```console -appidtel start -``` - -This step isn't required for WDAC policies deployed over MDM, as the CSP will enable the necessary components. This step is also not required when the ISG is configured using Configuration Manager's WDAC integration. - -## Security considerations with the ISG option - -Since the ISG is a heuristic-based mechanism, it doesn't provide the same security guarantees as explicit allow or deny rules. It's best suited where users operate with standard user rights and where a security monitoring solution like Microsoft Defender for Endpoint is used. - -Processes running with kernel privileges can circumvent WDAC by setting the ISG extended file attribute to make a binary appear to have known good reputation. - -Also, since the ISG option passes along reputation from app installers to the binaries they write to disk, it can over-authorize files in some cases. For example, if the installer launches the app upon completion, any files the app writes during that first run will also be allowed. - -## Known limitations with using the ISG - -Since the ISG only allows binaries that are "known good", there are cases where the ISG may be unable to predict whether legitimate software is safe to run. If that happens, the software will be blocked by WDAC. In this case, you need to allow the software with a rule in your WDAC policy, deploy a catalog signed by a certificate trusted in the WDAC policy, or install the software from a WDAC managed installer. Installers or applications that dynamically create binaries at runtime, and self-updating applications, may exhibit this symptom. - -Packaged apps aren't supported with the ISG and will need to be separately authorized in your WDAC policy. Since packaged apps have a strong app identity and must be signed, it's straightforward to [authorize packaged apps](/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control) with your WDAC policy. - -The ISG doesn't authorize kernel mode drivers. The WDAC policy must have rules that allow the necessary drivers to run. - -> [!NOTE] -> A rule that explicitly denies or allows a file will take precedence over that file's reputation data. Microsoft Intune's built-in WDAC support includes the option to trust apps with good reputation via the ISG, but it has no option to add explicit allow or deny rules. In most cases, customers using application control will need to deploy a custom WDAC policy (which can include the ISG option if desired) using [Intune's OMA-URI functionality](../deployment/deploy-wdac-policies-using-intune.md#deploy-wdac-policies-with-custom-oma-uri). diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet.md b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet.md deleted file mode 100644 index f99639f8fd..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Windows Defender Application Control and .NET -description: Understand how WDAC and .NET work together and use Dynamic Code Security to verify code loaded by .NET at runtime. -ms.localizationpriority: medium -ms.date: 11/22/2023 -ms.topic: conceptual ---- - -# Windows Defender Application Control (WDAC) and .NET - -.NET apps (as written in a high-level language like C#) are compiled to an Intermediate Language (IL). IL is a compact code format that can be supported on any operating system or architecture. Most .NET apps use APIs that are supported in multiple environments, requiring only the .NET runtime to run. IL needs to be compiled to native code in order to execute on a CPU, for example Arm64 or x64. When .NET compiles IL to native image (NI) on a device with a WDAC user mode policy, it first checks whether the original IL file passes the current WDAC policies. If so, .NET sets an NTFS extended attribute (EA) on the generated NI file so that WDAC knows to trust it as well. When the .NET app runs, WDAC sees the EA on the NI file and allows it. - -The EA set on the NI file only applies to the currently active WDAC policies. If one of the active WDAC policies is updated or a new policy is applied, the EA on the NI file is invalidated. The next time the app runs, WDAC will block the NI file. .NET handles the block gracefully and falls back to the original IL code. If the IL still passes the latest WDAC policies, then the app runs without any functional impact. Since the IL is now being compiled at runtime, you might notice a slight impact to performance of the app. When .NET must fall back to IL, .NET will also schedule a process to run at the next maintenance window to regenerate all NI files, thus reestablishing the WDAC EA for all code that passes the latest WDAC policies. - -In some cases, if an NI file is blocked, you might see a "false positive" block event in the *CodeIntegrity - Operational* event log as described in [WDAC Admin Tips & Known Issues](/windows/security/threat-protection/windows-defender-application-control/operations/known-issues#net-native-images-may-generate-false-positive-block-events). - -To mitigate any performance impact caused when the WDAC EA isn't valid or missing: - -- Avoid updating the WDAC policies often. -- Run `ngen update` (on all machine architectures) to force .NET to regenerate all NI files immediately after applying changes to your WDAC policies. -- Migrate applications to .NET Core (.NET 6 or greater). - -## WDAC and .NET hardening - -Security researchers found that some .NET capabilities that allow apps to load libraries from external sources or generate new code at runtime can be used to circumvent WDAC controls. -To address this potential vulnerability, WDAC includes an option called *Dynamic Code Security* that works with .NET to verify code loaded at runtime. - -When the Dynamic Code Security option is enabled, Application Control policy is applied to libraries that .NET loads from external sources. For example, any remote sources, such as the internet or a network share. - -> [!IMPORTANT] -> .Net dynamic code security hardening is *turned on and enforced* if any WDAC policy with UMCI enabled has set option **19 Enabled:Dynamic Code Security**. There is no audit mode for this feature. You should test your apps with this option set before turning it on across large numbers of devices. - -Additionally, it detects tampering in code generated to disk by .NET and blocks loading code that was tampered with. - -Dynamic Code Security isn't enabled by default because existing policies might not account for externally loaded libraries. -Additionally, a few .NET loading features, including loading unsigned assemblies built with System.Reflection.Emit, aren't currently supported with Dynamic Code Security enabled. -Microsoft recommends testing Dynamic Code Security in audit mode before enforcing it to discover whether any new libraries should be included in the policy. - -Additionally, customers can precompile for deployment only to prevent an allowed executable from being terminated because it tries to load unsigned dynamically generated code. See the "Precompiling for Deployment Only" section in the [ASP.NET Precompilation Overview](/previous-versions/aspnet/bb398860(v=vs.100)) document for how to fix that. - -To enable Dynamic Code Security, add the following option to the `` section of your WDAC policy: - -```xml - - - -``` diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-design-guide.md b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-design-guide.md deleted file mode 100644 index 84a5e4839a..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-design-guide.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Windows Defender Application Control design guide -description: Microsoft Windows Defender Application Control allows organizations to control what apps and drivers will run on their managed Windows devices. -ms.localizationpriority: medium -ms.topic: conceptual -ms.date: 02/20/2018 ---- - -# Windows Defender Application Control design guide - -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -This guide covers design and planning for Windows Defender Application Control (WDAC). It's intended to help security architects, security administrators, and system administrators create a plan that addresses specific application control requirements for different departments or business groups within an organization. - -## Plan for success - -A common refrain you may hear about application control is that it is "too hard." While it's true that application control isn't as simple as flipping a switch, organizations can be successful, if they're methodical when carefully planning their approach. In reality, the issues that lead to failure with application control often arise from business issues rather than technology challenges. Organizations that have successfully deployed application control have ensured the following before starting their planning: - -- Executive sponsorship and organizational buy-in is in place. -- There's a clear **business** objective for using application control, and it's not being planned as a purely technical problem from IT. -- The organization has a plan to handle potential helpdesk support requests for users who are blocked from running some apps. -- The organization has considered where application control can be most useful (for example, securing sensitive workloads or business functions) and also where it may be difficult to achieve (for example, developer workstations). - -Once these business factors are in place, you're ready to begin planning your Windows Defender Application Control (WDAC) deployment. The following topics can help guide you through your planning process. - -## In this section - -| Topic | Description | -| - | - | -| [Plan for WDAC policy management](plan-wdac-management.md) | This topic describes the decisions you need to make to establish the processes for managing and maintaining WDAC policies. | -| [Understand WDAC policy design decisions](understand-wdac-policy-design-decisions.md) | This topic lists the design questions, possible answers, and ramifications of the decisions, when you plan a deployment of application control policies. | -| [Understand WDAC policy rules and file rules](select-types-of-rules-to-create.md) | This topic lists resources you can use when selecting your application control policy rules by using WDAC. | -| [Policy creation for common WDAC usage scenarios](common-wdac-use-cases.md) | This set of topics outlines common use case scenarios, and helps you begin to develop a plan for deploying WDAC in your organization. | -| [Policy creation using the WDAC Wizard tool](wdac-wizard.md) | This set of topics describes how to use the WDAC Wizard desktop app to easily create, edit, and merge WDAC policies. | - -After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](../deployment/wdac-deployment-guide.md) covers creating and testing policies, deploying the enforcement setting, and managing and maintaining policies. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-editing-policy.md b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-editing-policy.md deleted file mode 100644 index 95692365fc..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-editing-policy.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Editing Windows Defender Application Control Policies with the Wizard -description: Editing existing base and supplemental policies with the Microsoft WDAC Wizard. -ms.localizationpriority: medium -ms.topic: conceptual -ms.date: 10/14/2020 ---- - -# Editing existing base and supplemental WDAC policies with the Wizard - -> [!NOTE] -> Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -The Windows Defender Application Control Wizard makes editing and viewing WDAC policies easier than the PowerShell cmdlets or manually. The Wizard currently supports the following editing capabilities: - - -## Configuring Policy Rules - -The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains other policy rule options that are less common to most users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#adding-file-rules). - -![Configuring the policy rules.](../images/wdac-wizard-edit-policy-rules.png) - -A description of the policy rule is shown at the bottom of the page when the cursor is placed over the rule title. For a complete list of the policy rules and their capabilities, see the [Windows Defender Application Control policy rules table](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules). - -## Adding File Rules - -The Windows Defender Application Control Wizard allows users to add rules to their existing policy seamlessly. Previously, this rule-adding task would have involved creating a new policy with the new rules and merging it with the existing policy. - -Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more information on creating new policy file rules, see the guidelines provided in the [creating policy file rules section](wdac-wizard-create-base-policy.md#creating-custom-file-rules). - -## Removing File Rules - -The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule, or a hash rule, select the rule in the `Policy Signing Rules List` table on the left-hand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. - -![Removing file rule from policy during edit.](../images/wdac-wizard-edit-remove-file-rule.png) - -**Note:** removing a publisher rule will also remove the associated File Attribute rules. For instance, in the xml block below, removing ID_SIGNER_CONTOSO_PUBLISHER would also remove the rules ID_FILEATTRIB_LOB_APP_1 and ID_FILEATTRIB_LOB_APP_2. - -```xml - - - - - -``` - -[comment]: <> (## Editing File Rules Coming soon!) - -### Policy Creation - -Once the policy is created, the new policy will be written to the same path as the in-edit policy. The new policy file name will have the policy version appended to the end of the file name. For instance, if the in-edit policy is saved at MyDocuments\BasePolicy.xml, after edit, the new policy will be saved at MyDocuments\BasePolicy_v10.0.0.1.xml. - -## Up next - -- [Merging Windows Defender Application Control (WDAC) policies using the Wizard](wdac-wizard-merging-policies.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-merging-policies.md b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-merging-policies.md deleted file mode 100644 index 2db7264ca4..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-merging-policies.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: Windows Defender Application Control Wizard Policy Merging Operation -description: Merging multiple policies into a single application control policy with the Microsoft WDAC Wizard. -ms.localizationpriority: medium -ms.topic: conceptual -ms.date: 10/14/2020 ---- - -# Merging existing policies with the WDAC Wizard - -Beginning in Windows 10 version 1903, Windows Defender Application Control (WDAC) supports multiple policies. Before version 1903, however, Windows 10 could only have one WDAC policy. So, users were required to merge multiple WDAC policies into one. The WDAC Wizard has a simple to use user interface to allow users to merge multiple WDAC policies. The Wizard can support up to 15 policy files as input during the merge workflow. - -Select the policies you wish to merge into one policy using the `+ Add Policy` button under the table. Once added, policies will be enumerated within the table. To remove a policy from the table, if accidentally added, highlight the policy row and select the `- Remove Policy` button. Confirmation will be required before the policy is withdrawn from the table. - -> [!NOTE] -> The policy type and ID of the final output policy will be determined based on the type and ID of the **first policy** in the policy list table. For instance, if a legacy policy format policy and a multi-policy format policy are merged together, the output format of the policy will be whichever policy is specified first in the table. For more information on policy formats, visit the [Multiple Windows Defender Application Control (WDAC) Policies page](deploy-multiple-wdac-policies.md). - -Lastly, select a filepath save location for the final merged policy using the `Browse` button. If a minimum of two policies are selected, and the save location is specified, select the `Next` button to build the policy. - -![Merging WDAC policies into a final WDAC policy.](../images/wdac-wizard-merge.png) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md deleted file mode 100644 index 5fb5ff24d3..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: Windows Defender Application Control Wizard WDAC Event Parsing -description: Creating WDAC policy rules from the WDAC event logs and the MDE Advanced Hunting WDAC events. -ms.localizationpriority: medium -ms.topic: conceptual -ms.date: 01/24/2024 ---- - -# Creating WDAC Policy Rules from WDAC Events in the Wizard - -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -As of [version 2.2.0.0](https://webapp-wdac-wizard.azurewebsites.net/archives.html), the WDAC Wizard supports creating WDAC policy rules from the following event log types: - -1. [WDAC event log events on the system](#wdac-event-viewer-log-parsing) -2. [Exported WDAC events (EVTX files) from any system](#wdac-event-log-file-parsing) -3. [Exported WDAC events from MDE Advanced Hunting](#mde-advanced-hunting-wdac-event-parsing) - -## WDAC Event Viewer Log Parsing - -To create rules from the WDAC event logs on the system: - -1. Select **Policy Editor** from the main page. -2. Select **Convert Event Log to a WDAC Policy**. -3. Select the **Parse Event Logs** button under the **Parse Event Logs from the System Event Viewer to Policy** header. - - The Wizard parses the relevant audit and block events from the CodeIntegrity (WDAC) Operational and AppLocker MSI and Script logs. You see a notification when the Wizard successfully finishes reading the events. - - > [!div class="mx-imgBorder"] - > [![Parse WDAC and AppLocker event log system events](../images/wdac-wizard-event-log-system.png)](../images/wdac-wizard-event-log-system-expanded.png) - -4. Select the Next button to view the audit and block events and create rules. -5. [Generate rules from the events](#creating-policy-rules-from-the-events). - -## WDAC Event Log File Parsing - -To create rules from the WDAC `.EVTX` event logs files on the system: - -1. Select **Policy Editor** from the main page. -2. Select **Convert Event Log to a WDAC Policy**. -3. Select the **Parse Log File(s)** button under the **Parse Event Log evtx Files to Policy** header. -4. Select the WDAC CodeIntegrity Event log EVTX file(s) from the disk to parse. - - The Wizard parses the relevant audit and block events from the selected log files. You see a notification when the Wizard successfully finishes reading the events. - - > [!div class="mx-imgBorder"] - > [![Parse evtx file WDAC events](../images/wdac-wizard-event-log-files.png)](../images/wdac-wizard-event-log-files-expanded.png) - -5. Select the Next button to view the audit and block events and create rules. -6. [Generate rules from the events](#creating-policy-rules-from-the-events). - -## MDE Advanced Hunting WDAC Event Parsing - -To create rules from the WDAC events in [MDE Advanced Hunting](../operations/querying-application-control-events-centrally-using-advanced-hunting.md): - -1. Navigate to the Advanced Hunting section within the MDE console and query the WDAC events. **The Wizard requires the following fields** in the Advanced Hunting csv file export: - - ```KQL - | project-keep Timestamp, DeviceId, DeviceName, ActionType, FileName, FolderPath, SHA1, SHA256, IssuerName, IssuerTBSHash, PublisherName, PublisherTBSHash, AuthenticodeHash, PolicyId, PolicyName - ``` - - The following Advanced Hunting query is recommended: - - ```KQL - DeviceEvents - // Take only WDAC events - | where ActionType startswith 'AppControlCodeIntegrity' - // SigningInfo Fields - | extend IssuerName = parsejson(AdditionalFields).IssuerName - | extend IssuerTBSHash = parsejson(AdditionalFields).IssuerTBSHash - | extend PublisherName = parsejson(AdditionalFields).PublisherName - | extend PublisherTBSHash = parsejson(AdditionalFields).PublisherTBSHash - // Audit/Block Fields - | extend AuthenticodeHash = parsejson(AdditionalFields).AuthenticodeHash - | extend PolicyId = parsejson(AdditionalFields).PolicyID - | extend PolicyName = parsejson(AdditionalFields).PolicyName - // Keep only required fields for the WDAC Wizard - | project-keep Timestamp,DeviceId,DeviceName,ActionType,FileName,FolderPath,SHA1,SHA256,IssuerName,IssuerTBSHash,PublisherName,PublisherTBSHash,AuthenticodeHash,PolicyId,PolicyName - ``` - -2. Export the WDAC event results by selecting the **Export** button in the results view. - - > [!div class="mx-imgBorder"] - > [![Export the MDE Advanced Hunting results to CSV](../images/wdac-wizard-event-log-mde-ah-export.png)](../images/wdac-wizard-event-log-mde-ah-export-expanded.png) - -3. Select **Policy Editor** from the main page. -4. Select **Convert Event Log to a WDAC Policy**. -5. Select the **Parse Log File(s)** button under the "Parse MDE Advanced Hunting Events to Policy" header. -6. Select the WDAC MDE Advanced Hunting export CSV files from the disk to parse. - - The Wizard will parse the relevant audit and block events from the selected Advanced Hunting log files. You see a notification when the Wizard successfully finishes reading the events. - - > [!div class="mx-imgBorder"] - > [![Parse the Advanced Hunting CSV WDAC event files](../images/wdac-wizard-event-log-mde-ah-parsing.png)](../images/wdac-wizard-event-log-mde-ah-parsing-expanded.png) - -7. Select the Next button to view the audit and block events and create rules. -8. [Generate rules from the events](#creating-policy-rules-from-the-events). - -## Creating Policy Rules from the Events - -On the "Configure Event Log Rules" page, the unique WDAC log events are shown in the table. Event Ids, filenames, product names, the policy name that audited or blocked the file, and the file publisher are all shown in the table. The table can be sorted alphabetically by clicking on any of the headers. - -To create a rule and add it to the WDAC policy: - -1. Select an audit or block event in the table by selecting the row of interest. -2. Select a rule type from the dropdown. The Wizard supports creating Publisher, Path, File Attribute, Packaged App and Hash rules. -3. Select the attributes and fields that should be added to the policy rules using the checkboxes provided for the rule type. -4. Select the **Add Allow Rule** button to add the configured rule to the policy generated by the Wizard. The "Added to policy" label is shown in the selected row confirming that the rule will be generated. - - > [!div class="mx-imgBorder"] - > [![Adding a publisher rule to the WDAC policy](../images/wdac-wizard-event-rule-creation.png)](../images/wdac-wizard-event-rule-creation-expanded.png) - -5. Select the **Next** button to output the policy. Once generated, the event log policy should be merged with your base or supplemental policies. - -> [!WARNING] -> It is not recommended to deploy the event log policy on its own, as it likely lacks rules to authorize Windows and may cause blue screens. - -## Up next - -- [Merging Windows Defender Application Control (WDAC) policies using the Wizard](wdac-wizard-merging-policies.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard.md b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard.md deleted file mode 100644 index 2f67ee3ad7..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Windows Defender Application Control Wizard -description: The Windows Defender Application Control policy wizard tool allows you to create, edit, and merge application control policies in a simple to use Windows application. -ms.localizationpriority: medium -ms.topic: conceptual -ms.date: 05/24/2022 ---- - -# Windows Defender Application Control Wizard - -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -The Windows Defender Application Control policy wizard is an open-source Windows desktop application written in C# and bundled as an MSIX package. It was built to provide security architects with security, and system administrators with a more user-friendly means to create, edit, and merge Application Control policies. This tool uses the [ConfigCI PowerShell cmdlets](/powershell/module/configci) in the backend so the output policy of the tool and PowerShell cmdlets is identical. - -## Downloading the application - -Download the tool from the official [Windows Defender Application Control Policy Wizard website](https://webapp-wdac-wizard.azurewebsites.net/) as an MSIX packaged application. The tool's source code is available as part of Microsoft's Open Source Software offerings on GitHub at the [Windows Defender Application Control (WDAC) Policy Wizard repository](https://github.com/MicrosoftDocs/WDAC-Toolkit). - -### Supported clients - -As the tool uses the cmdlets in the background, it's functional on clients only where the cmdlets are supported. For more information, see [Application Control feature availability](../feature-availability.md). Specifically, the tool verifies that the client meets one of the following requirements: - -- Windows 10, version 1909 or later -- For pre-1909 builds, the Enterprise SKU of Windows is installed - -If neither requirement is satisfied, it throws an error as the cmdlets aren't available. - -## Resources to learn more - -| Article | Description | -| - | - | -| [Creating a new base policy](wdac-wizard-create-base-policy.md) | This article describes how to create a new base policy using one of the supplied policy templates. | -| [Creating a new supplemental policy](wdac-wizard-create-supplemental-policy.md) | This article describes the steps necessary to create a supplemental policy, from one of the supplied templates, for an existing base policy. | -| [Editing a base or supplemental policy](wdac-wizard-editing-policy.md) | This article demonstrates how to modify an existing policy and the tool's editing capabilities. | -| [Merging policies](wdac-wizard-merging-policies.md) | This article describes how to merge policies into a single application control policy. | diff --git a/windows/security/application-security/application-control/windows-defender-application-control/feature-availability.md b/windows/security/application-security/application-control/windows-defender-application-control/feature-availability.md deleted file mode 100644 index 264f3589f8..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/feature-availability.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: Windows Defender Application Control feature availability -description: Compare Windows Defender Application Control (WDAC) and AppLocker feature availability. -ms.localizationpriority: medium -ms.date: 12/21/2023 -ms.topic: overview ---- - -# Windows Defender Application Control and AppLocker feature availability - -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Review the following table to learn more. - -| Capability | Windows Defender Application Control | AppLocker | -|-------------|------|-------------| -| Platform support | Available on Windows 10, Windows 11, and Windows Server 2016 or later. | Available on Windows 8 or later. | -| Edition availability | Available on Windows 10, Windows 11, and Windows Server 2016 or later.
WDAC PowerShell cmdlets aren't available on Home edition, but policies are effective on all editions. | Policies are supported on all editions Windows 10 version 2004 and newer with [KB 5024351](https://support.microsoft.com/help/5024351).

Windows versions older than version 2004, including Windows Server 2019:
  • Policies deployed through GP are only supported on Enterprise and Server editions.
  • Policies deployed through MDM are supported on all editions.
| -| Management solutions |
  • [Intune](deployment/deploy-wdac-policies-using-intune.md)
  • [Microsoft Configuration Manager](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) (limited built-in policies or custom policy deployment via software distribution)
  • [Group policy](deployment/deploy-wdac-policies-using-group-policy.md)
  • [Script](/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script)
|
  • [Intune](/windows/client-management/mdm/applocker-csp) (custom policy deployment via OMA-URI only)
  • Configuration Manager (custom policy deployment via software distribution only)
  • [Group Policy](applocker/determine-group-policy-structure-and-rule-enforcement.md)
  • PowerShell
      • | -| Per-user and Per-user group rules | Not available (policies are device-wide). | Available on Windows 8+. | -| Kernel mode policies | Available on Windows 10, Windows 11, and Windows Server 2016 or later. | Not available. | -| [Rule option 11 - Disabled:Script Enforcement](/windows/security/threat-protection/windows-defender-application-control/design/script-enforcement) | Available on all versions of Windows 10 except 1607 LTSB, Windows 11, and Windows Server 2019 and above. **Disabled:Script Enforcement** isn't supported on **Windows Server 2016** or on **Windows 10 1607 LTSB** and shouldn't be used on those platforms. Doing so results in unexpected script enforcement behaviors. | MSI and Script rule collection is separately configurable. | -| [Per-app rules](/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules) | Available on Windows 10, Windows 11, and Windows Server 2019 or later. | Not available. | -| [Managed Installer (MI)](/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer) | Available on Windows 10, Windows 11, and Windows Server 2019 or later. | Not available. | -| [Reputation-Based intelligence](/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph) | Available on Windows 10, Windows 11, and Windows Server 2019 or later. | Not available. | -| [Multiple policy support](/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies) | Available on Windows 10, version 1903 and above, Windows 11, and Windows Server 2022. | Not available. | -| [Path-based rules](/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create) | Available on Windows 10, version 1903 and above, Windows 11, and Windows Server 2022 or later. Exclusions aren't supported. Runtime user-writeability checks enforced by default. | Available on Windows 8+. Exclusions are supported. No runtime user-writeability check. | -| [COM object allowlisting](/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy) | Available on Windows 10, Windows 11, and Windows Server 2019 or later. | Not available. | -| [Packaged app rules](/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control) | Available on Windows 10, Windows 11, and Windows Server 2019 or later. | Available on Windows 8+. | -| Enforceable file types |
      • Driver files: .sys
      • Executable files: .exe and .com
      • DLLs: .dll, .rll and .ocx
      • Windows Installer files: .msi, .mst, and .msp
      • Scripts: .ps1, .vbs, and .js
      • Packaged apps and packaged app installers: .appx
      |
      • Executable files: .exe and .com
      • [Optional] DLLs: .dll, .rll and .ocx
      • Windows Installer files: .msi, .mst, and .msp
      • Scripts: .ps1, .bat, .cmd, .vbs, and .js
      • Packaged apps and packaged app installers: .appx
      | -| [Application ID (AppId) Tagging](/windows/security/threat-protection/windows-defender-application-control/AppIdTagging/windows-defender-application-control-appid-tagging-guide) | Available on Windows 10, version 20H1 and later, and Windows 11. | Not available. | diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations.md deleted file mode 100644 index a100e1a2c0..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations.md +++ /dev/null @@ -1,161 +0,0 @@ ---- -title: Understanding Application Control event IDs -description: Learn what different Windows Defender Application Control event IDs signify. -ms.localizationpriority: medium -ms.date: 03/24/2023 -ms.topic: reference ---- - -# Understanding Application Control events - -## WDAC Events Overview - -WDAC logs events when a policy is loaded, when a file is blocked, or when a file would be blocked if in audit mode. These block events include information that identifies the policy and gives more details about the block. WDAC doesn't generate events when a binary is allowed. However, you can turn on allow audit events for files authorized by a managed installer or the Intelligent Security Graph (ISG) as described later in this article. - -### Core WDAC event logs - -WDAC events are generated under two locations in the Windows Event Viewer: - -- **Applications and Services logs - Microsoft - Windows - CodeIntegrity - Operational** includes events about Application Control policy activation and the control of executables, dlls, and drivers. -- **Applications and Services logs - Microsoft - Windows - AppLocker - MSI and Script** includes events about the control of MSI installers, scripts, and COM objects. - -Most app and script failures that occur when WDAC is active can be diagnosed using these two event logs. This article describes in greater detail the events that exist in these logs. To understand the meaning of different data elements, or tags, found in the details of these events, see [Understanding Application Control event tags](event-tag-explanations.md). - -> [!NOTE] -> **Applications and Services logs - Microsoft - Windows - AppLocker - MSI and Script** events are not included on Windows Server Core edition. - -## WDAC block events for executables, dlls, and drivers - -These events are found in the **CodeIntegrity - Operational** event log. - -| Event ID | Explanation | -|--------|-----------| -| 3004 | This event isn't common and may occur with or without an Application Control policy present. It typically indicates a kernel driver tried to load with an invalid signature. For example, the file may not be WHQL-signed on a system where WHQL is required.

      This event is also seen for kernel- or user-mode code that the developer opted-in to [/INTEGRITYCHECK](/cpp/build/reference/integritycheck-require-signature-check) but isn't signed correctly. | -| 3033 | This event may occur with or without an Application Control policy present and should occur alongside a 3077 event if caused by WDAC policy. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. Presence of the Lifetime Signing EKU is the only case where WDAC blocks files due to an expired signature. Try using option `20 Enabled:Revoked Expired As Unsigned` in your policy along with a rule (for example, hash) that doesn't rely on the revoked or expired cert.

      This event also occurs if code compiled with [Code Integrity Guard (CIG)](/microsoft-365/security/defender-endpoint/exploit-protection-reference#code-integrity-guard) tries to load other code that doesn't meet the CIG requirements. | -| 3034 | This event isn't common. It's the audit mode equivalent of event 3033. | -| 3076 | This event is the main Application Control block event for audit mode policies. It indicates that the file would have been blocked if the policy was enforced. | -| 3077 | This event is the main Application Control block event for enforced policies. It indicates that the file didn't pass your policy and was blocked. | -| 3089 | This event contains signature information for files that were blocked or audit blocked by Application Control. One of these events is created for each signature of a file. Each event shows the total number of signatures found and an index value to identify the current signature. Unsigned files generate a single one of these events with TotalSignatureCount of 0. These events are correlated with 3004, 3033, 3034, 3076 and 3077 events. You can match the events using the `Correlation ActivityID` found in the **System** portion of the event. | - -## WDAC block events for packaged apps, MSI installers, scripts, and COM objects - -These events are found in the **AppLocker - MSI and Script** event log. - -| Event ID | Explanation | -|--------|-----------| -| 8028 | This event indicates that a script host, such as PowerShell, queried Application Control about a file the script host was about to run. Since the policy was in audit mode, the script or MSI file should have run, but wouldn't have passed the WDAC policy if it was enforced. Some script hosts may have additional information in their logs. Note: Most third-party script hosts don't integrate with Application Control. Consider the risks from unverified scripts when choosing which script hosts you allow to run. | -| 8029 | This event is the enforcement mode equivalent of event 8028. Note: While this event says that a script was blocked, the script hosts control the actual script enforcement behavior. The script host may allow the file to run with restrictions and not block the file outright. For example, PowerShell runs script not allowed by your WDAC policy in [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). | -| 8036| COM object was blocked. To learn more about COM object authorization, see [Allow COM object registration in a Windows Defender Application Control policy](../design/allow-com-object-registration-in-wdac-policy.md). | -| 8037 | This event indicates that a script host checked whether to allow a script to run, and the file passed the WDAC policy. | -| 8038 | Signing information event correlated with either an 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files generate a single 8038 event with TotalSignatureCount 0. These events are correlated with 8028 and 8029 events and can be matched using the `Correlation ActivityID` found in the **System** portion of the event. | -| 8039 | This event indicates that a packaged app (MSIX/AppX) was allowed to install or run because the WDAC policy is in audit mode. But, it would have been blocked if the policy was enforced. | -| 8040 | This event indicates that a packaged app was prevented from installing or running due to the WDAC policy. | - -## WDAC policy activation events - -These events are found in the **CodeIntegrity - Operational** event log. - -| Event ID | Explanation | -|--------|-----------| -| 3095 | The Application Control policy can't be refreshed and must be rebooted instead. | -| 3096 | The Application Control policy wasn't refreshed since it's already up-to-date. This event's Details includes useful information about the policy, such as its policy options. | -| 3097 | The Application Control policy can't be refreshed. | -| 3099 | Indicates that a policy has been loaded. This event's Details includes useful information about the Application Control policy, such as its policy options. | -| 3100 | The application control policy was refreshed but was unsuccessfully activated. Retry. | -| 3101 | Application Control policy refresh started for *N* policies. | -| 3102 | Application Control policy refresh finished for *N* policies. | -| 3103 | The system is ignoring the Application Control policy refresh. For example, an inbox Windows policy that doesn't meet the conditions for activation. | -| 3105 | The system is attempting to refresh the Application Control policy with the specified ID. | - -## Diagnostic events for Intelligent Security Graph (ISG) and Managed Installer (MI) - -> [!NOTE] -> When Managed Installer is enabled, customers using LogAnalytics should be aware that Managed Installer may fire many 3091 events. Customers may need to filter out these events to avoid high LogAnalytics costs. - -The following events provide helpful diagnostic information when a WDAC policy includes the ISG or MI option. These events can help you debug why something was allowed/denied based on managed installer or ISG. Events 3090, 3091, and 3092 don't necessarily indicate a problem but should be reviewed in context with other events like 3076 or 3077. - -Unless otherwise noted, these events are found in either the **CodeIntegrity - Operational** event log or the **CodeIntegrity - Verbose** event log depending on your version of Windows. - -| Event ID | Explanation | -|--------|---------| -| 3090 | *Optional* This event indicates that a file was allowed to run based purely on ISG or managed installer. | -| 3091 | This event indicates that a file didn't have ISG or managed installer authorization and the Application Control policy is in audit mode. | -| 3092 | This event is the enforcement mode equivalent of 3091. | -| 8002 | This event is found in the **AppLocker - EXE and DLL** event log. When a process launches that matches a managed installer rule, this event is raised with PolicyName = MANAGEDINSTALLER found in the event Details. Events with PolicyName = EXE or DLL aren't related to WDAC. | - -Events 3090, 3091, and 3092 are reported per active policy on the system, so you may see multiple events for the same file. - -### ISG and MI diagnostic event details - -The following information is found in the details for 3090, 3091, and 3092 events. - -| Name | Explanation | -|------|------| -| ManagedInstallerEnabled | Indicates whether the specified policy enables managed installer trust | -| PassesManagedInstaller | Indicates whether the file originated from a MI | -| SmartlockerEnabled | Indicates whether the specified policy enables ISG trust | -| PassesSmartlocker | Indicates whether the file had positive reputation according to the ISG | -| AuditEnabled | True if the Application Control policy is in audit mode, otherwise it is in enforce mode | -| PolicyName | The name of the Application Control policy to which the event applies | - -### Enabling ISG and MI diagnostic events - -To enable 3090 allow events, create a TestFlags regkey with a value of 0x300 as shown in the following PowerShell command. Then restart your computer. - -```powershell -reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x300 -``` - -Events 3091 and 3092 are inactive on some versions of Windows and are turned on by the preceding command. - -## Appendix - -A list of other relevant event IDs and their corresponding description. - -| Event ID | Description | -|-------|------| -| 3001 | An unsigned driver was attempted to load on the system. | -| 3002 | Code Integrity couldn't verify the boot image as the page hash couldn't be found. | -| 3004 | Code Integrity couldn't verify the file as the page hash couldn't be found. | -| 3010 | The catalog containing the signature for the file under validation is invalid. | -| 3011 | Code Integrity finished loading the signature catalog. | -| 3012 | Code Integrity started loading the signature catalog. | -| 3023 | The driver file under validation didn't meet the requirements to pass the application control policy. | -| 3024 | Windows application control was unable to refresh the boot catalog file. | -| 3026 | Microsoft or the certificate issuing authority revoked the certificate that signed the catalog. | -| 3032 | The file under validation is revoked or the file has a signature that is revoked. -| 3033 | The file under validation didn't meet the requirements to pass the application control policy. | -| 3034 | The file under validation wouldn't meet the requirements to pass the Application Control policy if it was enforced. The file was allowed since the policy is in audit mode. | -| 3036 | Microsoft or the certificate issuing authority revoked the certificate that signed the file being validated. | -| 3064 | If the Application Control policy was enforced, a user mode DLL under validation wouldn't meet the requirements to pass the application control policy. The DLL was allowed since the policy is in audit mode. | -| 3065 | If the Application Control policy was enforced, a user mode DLL under validation wouldn't meet the requirements to pass the application control policy. | -| 3074 | Page hash failure while hypervisor-protected code integrity was enabled. | -| 3075 | This event measures the performance of the Application Control policy check during file validation. | -| 3076 | This event is the main Application Control block event for audit mode policies. It indicates that the file would have been blocked if the policy was enforced. | -| 3077 | This event is the main Application Control block event for enforced policies. It indicates that the file didn't pass your policy and was blocked. | -| 3079 | The file under validation didn't meet the requirements to pass the application control policy. | -| 3080 | If the Application Control policy was in enforced mode, the file under validation wouldn't have met the requirements to pass the application control policy. | -| 3081 | The file under validation didn't meet the requirements to pass the application control policy. | -| 3082 | If the Application Control policy was enforced, the policy would have blocked this non-WHQL driver. | -| 3084 | Code Integrity is enforcing WHQL driver signing requirements on this boot session. | -| 3085 | Code Integrity isn't enforcing WHQL driver signing requirements on this boot session. | -| 3086 | The file under validation doesn't meet the signing requirements for an isolated user mode (IUM) process. | -| 3089 | This event contains signature information for files that were blocked or audit blocked by Application Control. One 3089 event is created for each signature of a file. | -| 3090 | *Optional* This event indicates that a file was allowed to run based purely on ISG or managed installer. | -| 3091 | This event indicates that a file didn't have ISG or managed installer authorization and the Application Control policy is in audit mode. | -| 3092 | This event is the enforcement mode equivalent of 3091. | -| 3095 | The Application Control policy can't be refreshed and must be rebooted instead. | -| 3096 | The Application Control policy wasn't refreshed since it's already up-to-date. | -| 3097 | The Application Control policy can't be refreshed. | -| 3099 | Indicates that a policy has been loaded. This event also includes information about the options set by the Application Control policy. | -| 3100 | The application control policy was refreshed but was unsuccessfully activated. Retry. | -| 3101 | The system started refreshing the Application Control policy. | -| 3102 | The system finished refreshing the Application Control policy. | -| 3103 | The system is ignoring the Application Control policy refresh. | -| 3104 | The file under validation doesn't meet the signing requirements for a PPL (protected process light) process. | -| 3105 | The system is attempting to refresh the Application Control policy. | -| 3108 | Windows mode change event was successful. | -| 3110 | Windows mode change event was unsuccessful. | -| 3111 | The file under validation didn't meet the hypervisor-protected code integrity (HVCI) policy. | -| 3112 | Windows has revoked the certificate that signed the file being validated. | -| 3114 | Dynamic Code Security opted the .NET app or DLL into Application Control policy validation. The file under validation didn't pass your policy and was blocked. | diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md deleted file mode 100644 index f33e99121c..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: WDAC Admin Tips & Known Issues -description: WDAC Known Issues -ms.manager: jsuther -ms.date: 04/15/2024 -ms.topic: troubleshooting -ms.localizationpriority: medium ---- - -# WDAC Admin Tips & Known Issues - -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -This article covers tips and tricks for admins and known issues with Windows Defender Application Control (WDAC). Test this configuration in your lab before enabling it in production. - -## WDAC policy file locations - -**Multiple policy format WDAC policies** are found in the following locations depending on whether the policy is signed or not, and the method of policy deployment that was used. - -- <OS Volume>\\Windows\\System32\\CodeIntegrity\\CiPolicies\Active\\*\{PolicyId GUID\}*.cip -- <EFI System Partition>\\Microsoft\\Boot\\CiPolicies\Active\\*\{PolicyId GUID\}*.cip - -The *\{PolicyId GUID\}* value is unique by policy and defined in the policy XML with the <PolicyId> element. - -For **single policy format WDAC policies**, in addition to the two preceding locations, also look for a file called SiPolicy.p7b in the following locations: - -- <EFI System Partition>\\Microsoft\\Boot\\SiPolicy.p7b -- <OS Volume>\\Windows\\System32\\CodeIntegrity\\SiPolicy.p7b - -> [!NOTE] -> A multiple policy format WDAC policy using the single policy format GUID `{A244370E-44C9-4C06-B551-F6016E563076}` may exist under any of the policy file locations. - -## File Rule Precedence Order - -When the WDAC engine evaluates files against the active set of policies on the device, rules are applied in the following order. Once a file encounters a match, WDAC stops further processing. - -1. Explicit deny rules - a file is blocked if any explicit deny rule exists for it, even if other rules are created to try to allow it. Deny rules can use any [rule level](/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create#windows-defender-application-control-file-rule-levels). Use the most specific rule level practical when creating deny rules to avoid blocking more than you intend. - -2. Explicit allow rules - if any explicit allow rule exists for the file, the file runs. - -3. WDAC then checks for the [Managed Installer extended attribute (EA)](/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer) or the [Intelligent Security Graph (ISG) EA](/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph) on the file. If either EA exists and the policy enables the corresponding option, then the file is allowed. - -4. Lastly, WDAC makes a cloud call to the ISG to get reputation about the file, if the policy enables the ISG option. - -5. Any file not allowed by an explicit rule or based on ISG or MI is blocked implicitly. - -## Known issues - -### Boot stop failure (blue screen) occurs if more than 32 policies are active - -Until you apply the Windows security update released on or after April 9, 2024, your device is limited to 32 active policies. If the maximum number of policies is exceeded, the device bluescreens referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit. To remove the maximum policy limit, install the Windows security update released on, or after, April 9, 2024 and then restart the device. Otherwise, reduce the number of policies on the device to remain below 32 policies. - -**Note:** The policy limit was not removed on Windows 11 21H2, and will remain limited to 32 policies. - -### Audit mode policies can change the behavior for some apps or cause app crashes - -Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that turns on user mode code integrity (UMCI) with the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode: - -- Some script hosts might block code or run code with fewer privileges even in audit mode. See [Script enforcement with WDAC](/windows/security/application-security/application-control/windows-defender-application-control/design/script-enforcement) for information about individual script host behaviors. -- Option **19 Enabled:Dynamic Code Security** is always enforced if any UMCI policy includes that option. See [WDAC and .NET](/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet#wdac-and-net-hardening). - -### .NET native images may generate false positive block events - -In some cases, the code integrity logs where Windows Defender Application Control errors and warnings are written include error events for native images generated for .NET assemblies. Typically, native image blocks are functionally benign as a blocked native image falls back to its corresponding assembly and .NET regenerates the native image at its next scheduled maintenance window. - -### Signatures using elliptical curve cryptography (ECC) aren't supported - -WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If WDAC blocks a file based on ECC signatures, the corresponding 3089 signature information events show VerificationError = 23. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA. - -### MSI installers are treated as user writeable on Windows 10 when allowed by FilePath rule - -MSI installer files are always detected as user writeable on Windows 10, and on Windows Server 2022 and earlier. If you need to allow MSI files using FilePath rules, you must set option **18 Disabled:Runtime FilePath Rule Protection** in your WDAC policy. - -### MSI Installations launched directly from the internet are blocked by WDAC - -Installing .msi files directly from the internet to a computer protected by WDAC fails. -For example, this command fails: - -```console -msiexec -i https://download.microsoft.com/download/2/E/3/2E3A1E42-8F50-4396-9E7E-76209EA4F429/Windows10_Version_1511_ADMX.msi -``` - -As a workaround, download the MSI file and run it locally: - -```console -msiexec -i c:\temp\Windows10_Version_1511_ADMX.msi -``` - -### Slow boot and performance with custom policies - -WDAC evaluates all processes that run, including inbox Windows processes. You can cause slower boot times, degraded performance, and possibly boot issues if your policies don't build upon the WDAC templates or don't trust the Windows signers. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies. - -#### AppId Tagging policy considerations - -AppId Tagging policies that aren't built upon the WDAC base templates or don't allow the Windows in-box signers might cause a significant increase in boot times (~2 minutes). - -If you can't allowlist the Windows signers or build off the WDAC base templates, add the following rule to your policies to improve the performance: - -:::image type="content" source="../images/known-issue-appid-dll-rule.png" alt-text="Allow all dlls in the policy."::: - -:::image type="content" source="../images/known-issue-appid-dll-rule-xml.png" alt-text="Allow all dll files in the xml policy."::: - -Since AppId Tagging policies evaluate but can't tag dll files, this rule short circuits dll evaluation and improve evaluation performance. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/wdac-operational-guide.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/wdac-operational-guide.md deleted file mode 100644 index 71c48fb256..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/operations/wdac-operational-guide.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Managing and troubleshooting Windows Defender Application Control policies -description: Gather information about how your deployed Windows Defender Application Control policies are behaving. -ms.localizationpriority: medium -ms.date: 03/30/2023 -ms.topic: how-to ---- - -# Windows Defender Application Control operational guide - -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). - -You now understand how to design and deploy your Windows Defender Application Control (WDAC) policies. This guide explains how to understand the effects your policies have and how to troubleshoot when they aren't behaving as expected. It contains information on where to find events and what they mean, and also querying these events with Microsoft Defender for Endpoint Advanced Hunting feature. - -## In this section - -| Article | Description | -| - | - | -| [Debugging and troubleshooting](/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting) | This article explains how to debug app and script failures with WDAC. | -| [Understanding Application Control event IDs](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations) | This article explains the meaning of different WDAC event IDs. | -| [Understanding Application Control event tags](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations) | This article explains the meaning of different WDAC event tags. | -| [Query WDAC events with Advanced hunting](/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting) | This article covers how to view WDAC events centrally from all systems that are connected to Microsoft Defender for Endpoint. | -| [Admin Tips & Known Issues](/windows/security/threat-protection/windows-defender-application-control/operations/known-issues) | This article describes some WDAC Admin Tips & Known Issues. | -| [Managed installer and ISG technical reference and troubleshooting guide](/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer) | This article provides technical details and debugging steps for managed installer and ISG. | -| [CITool.exe technical reference](/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands) | This article explains how to use CITool.exe. | -| [Inbox WDAC policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) | This article describes the WDAC policies that ship with Windows and when they're active. | diff --git a/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview.md b/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview.md deleted file mode 100644 index 81042f2926..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: WDAC and AppLocker Overview -description: Compare Windows application control technologies. -ms.localizationpriority: medium -ms.date: 01/03/2024 -ms.topic: conceptual ---- - -# Windows Defender Application Control and AppLocker Overview - -> [!NOTE] -> Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [WDAC feature availability](feature-availability.md). - -Windows 10 and Windows 11 include two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: Windows Defender Application Control (WDAC) and AppLocker. - -## Windows Defender Application Control - -WDAC was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows clients. It was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria), defined by the Microsoft Security Response Center (MSRC). - -WDAC policies apply to the managed computer as a whole and affects all users of the device. WDAC rules can be defined based on: - -- Attributes of the codesigning certificate(s) used to sign an app and its binaries -- Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file -- The reputation of the app as determined by Microsoft's [Intelligent Security Graph](design/use-wdac-with-intelligent-security-graph.md) -- The identity of the process that initiated the installation of the app and its binaries ([managed installer](design/configure-authorized-apps-deployed-with-a-managed-installer.md)) -- The [path from which the app or file is launched](design/select-types-of-rules-to-create.md#more-information-about-filepath-rules) (beginning with Windows 10 version 1903) -- The process that launched the app or binary - -> [!NOTE] -> WDAC was originally released as part of Device Guard and called configurable code integrity. Device Guard and configurable code integrity are no longer used except to find where to deploy WDAC policy via Group Policy. - -### WDAC System Requirements - -WDAC policies can be created and applied on any client edition of Windows 10 or Windows 11, or on Windows Server 2016 and higher. WDAC policies can be deployed via a Mobile Device Management (MDM) solution, for example, Intune; a management interface such as Configuration Manager; or a script host such as PowerShell. Group Policy can also be used to deploy WDAC policies, but is limited to single-policy format policies that work on Windows Server 2016 and 2019. - -For more information on which individual WDAC features are available on specific WDAC builds, see [WDAC feature availability](feature-availability.md). - -## AppLocker - -AppLocker was introduced with Windows 7, and allows organizations to control which applications are allowed to run on their Windows clients. AppLocker helps to prevent end-users from running unapproved software on their computers but doesn't meet the servicing criteria for being a security feature. - -AppLocker policies can apply to all users on a computer, or to individual users and groups. AppLocker rules can be defined based on: - -- Attributes of the codesigning certificate(s) used to sign an app and its binaries. -- Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file. -- The path from which the app or file is launched. - -AppLocker is also used by some features of WDAC, including [managed installer](/windows/security/application-security/application-control/windows-defender-application-control/design/configure-authorized-apps-deployed-with-a-managed-installer) and the [Intelligent Security Graph](/windows/security/application-security/application-control/windows-defender-application-control/design/use-wdac-with-intelligent-security-graph). - -### AppLocker System Requirements - -AppLocker policies can only be configured on and applied to devices that are running on the supported versions and editions of the Windows operating system. For more info, see [Requirements to Use AppLocker](applocker/requirements-to-use-applocker.md). -AppLocker policies can be deployed using Group Policy or MDM. - -## Choose when to use WDAC or AppLocker - -Generally, customers who are able to implement application control using WDAC, rather than AppLocker, should do so. WDAC is undergoing continual improvements, and is getting added support from Microsoft management platforms. Although AppLocker continues to receive security fixes, it isn't getting new feature improvements. - -However, in some cases, AppLocker might be the more appropriate technology for your organization. AppLocker is best when: - -- You have a mixed Windows operating system (OS) environment and need to apply the same policy controls to Windows 10 and earlier versions of the OS. -- You need to apply different policies for different users or groups on shared computers. -- You don't want to enforce application control on application files such as DLLs or drivers. - -AppLocker can also be deployed as a complement to WDAC to add user or group-specific rules for shared device scenarios, where it's important to prevent some users from running specific apps. As a best practice, you should enforce WDAC at the most restrictive level possible for your organization, and then you can use AppLocker to further fine-tune the restrictions. diff --git a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md index b686fb205c..22b8f3245f 100644 --- a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md @@ -54,7 +54,9 @@ Use the **Virtualization Based Technology** > **Hypervisor Enforced Code Integri 1. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**. 1. Double-click **Turn on Virtualization Based Security**. 1. Select **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled without UEFI lock**. Only select **Enabled with UEFI lock** if you want to prevent memory integrity from being disabled remotely or by policy update. Once enabled with UEFI lock, you must have access to the UEFI BIOS menu to turn off Secure Boot if you want to turn off memory integrity. + ![Enable memory integrity using Group Policy.](images/enable-hvci-gp.png) + 1. Select **Ok** to close the editor. To apply the new policy on a domain-joined computer, either restart or run `gpupdate /force` in an elevated Command Prompt. @@ -73,7 +75,7 @@ Set the following registry keys to enable memory integrity. These keys provide s Recommended settings (to enable memory integrity without UEFI Lock): -```console +```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f @@ -85,55 +87,55 @@ If you want to customize the preceding recommended settings, use the following r **To enable VBS only (no memory integrity)** -```console +```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f ``` **To enable VBS and require Secure boot only (value 1)** -```console +```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f ``` **To enable VBS with Secure Boot and DMA protection (value 3)** -```console +```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 3 /f ``` **To enable VBS without UEFI lock (value 0)** -```console +```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f ``` **To enable VBS with UEFI lock (value 1)** -```console +```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 1 /f ``` **To enable memory integrity** -```console +```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f ``` **To enable memory integrity without UEFI lock (value 0)** -```console +```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f ``` **To enable memory integrity with UEFI lock (value 1)** -```console +```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 1 /f ``` **To enable VBS (and memory integrity) in mandatory mode** -```console +```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Mandatory" /t REG_DWORD /d 1 /f ``` @@ -143,25 +145,25 @@ The **Mandatory** setting prevents the OS loader from continuing to boot in case > Special care should be used before enabling this mode, since, in case of any failure of the virtualization modules, the system will refuse to boot. **To gray out the memory integrity UI and display the message "This setting is managed by your administrator"** -```console +```cmd reg delete HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v "WasEnabledBy" /f ``` **To let memory integrity UI behave normally (Not grayed out)** -```console +```cmd reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v "WasEnabledBy" /t REG_DWORD /d 2 /f ``` -### Enable memory integrity using Windows Defender Application Control (WDAC) +### Enable memory integrity using App Control for Business -You can use WDAC policy to turn on memory integrity using any of the following techniques: +You can use App Control policy to turn on memory integrity using any of the following techniques: -1. Use the [WDAC Wizard](https://aka.ms/wdacwizard) to create or edit your WDAC policy and select the option **Hypervisor-protected Code Integrity** on the **Policy Rules** page of the Wizard. +1. Use the [App Control Wizard](https://aka.ms/wdacwizard) to create or edit your App Control policy and select the option **Hypervisor-protected Code Integrity** on the **Policy Rules** page of the Wizard. 2. Use the [Set-HVCIOptions](/powershell/module/configci/set-hvcioptions) PowerShell cmdlet. -3. Edit your WDAC policy XML and modify the value set for the `` element. +3. Edit your App Control policy XML and modify the value set for the `` element. > [!NOTE] -> If your WDAC policy is set to turn memory integrity on, it will be turned on even if the policy is in audit mode. +> If your App Control policy is set to turn memory integrity on, it will be turned on even if the policy is in audit mode. ### Validate enabled VBS and memory integrity features @@ -269,7 +271,7 @@ Another method to determine the available and enabled VBS features is to run msi 2. Then, boot to Windows RE on the affected computer, see [Windows RE Technical Reference](/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference). 3. After logging in to Windows RE, set the memory integrity registry key to off: - ```console + ```cmd reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f ``` diff --git a/windows/security/hardware-security/system-guard-secure-launch-and-smm-protection.md b/windows/security/hardware-security/system-guard-secure-launch-and-smm-protection.md index 153871eba2..af01702227 100644 --- a/windows/security/hardware-security/system-guard-secure-launch-and-smm-protection.md +++ b/windows/security/hardware-security/system-guard-secure-launch-and-smm-protection.md @@ -30,7 +30,7 @@ System Guard Secure Launch can be configured for Mobile Device Management (MDM) 1. Select **Start** > type and then select **Edit group policy**. 1. Select **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn On Virtualization Based Security** > **Secure Launch Configuration**. - ![Secure Launch Configuration.](images/secure-launch-group-policy.png) + :::image type="content" alt-text="Secure Launch Configuration." source="images/secure-launch-group-policy.png" lightbox="images/secure-launch-group-policy.png"::: ### Windows Security @@ -52,10 +52,10 @@ Select **Start** > **Settings** > **Update & Security** > **Windows Security** > To verify that Secure Launch is running, use System Information (MSInfo32). Select **Start**, search for **System Information**, and look under **Virtualization-based Security Services Running** and **Virtualization-based Security Services Configured**. -![Verifying Secure Launch is running in the Windows Security settings.](images/secure-launch-msinfo.png) +:::image type="content" alt-text="Verifying Secure Launch is running in the Windows Security settings." source="images/secure-launch-msinfo.png" lightbox="images/secure-launch-msinfo.png"::: > [!NOTE] -> To enable System Guard Secure launch, the platform must meet all the baseline requirements for [System Guard](how-hardware-based-root-of-trust-helps-protect-windows.md), [Device Guard](../application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md), [Credential Guard](../identity-protection/credential-guard/index.md), and [Virtualization Based Security](/windows-hardware/design/device-experiences/oem-vbs). +> To enable System Guard Secure launch, the platform must meet all the baseline requirements for [System Guard](how-hardware-based-root-of-trust-helps-protect-windows.md), [Device Guard](../application-security/application-control/introduction-to-virtualization-based-security-and-appcontrol.md), [Credential Guard](../identity-protection/credential-guard/index.md), and [Virtualization Based Security](/windows-hardware/design/device-experiences/oem-vbs). > [!NOTE] > For more information around AMD processors, see [Microsoft Security Blog: Force firmware code to be measured and attested by Secure Launch on Windows 10](https://www.microsoft.com/security/blog/2020/09/01/force-firmware-code-to-be-measured-and-attested-by-secure-launch-on-windows-10/). diff --git a/windows/security/hardware-security/tpm/tpm-recommendations.md b/windows/security/hardware-security/tpm/tpm-recommendations.md index ae731d1f10..ff2f368320 100644 --- a/windows/security/hardware-security/tpm/tpm-recommendations.md +++ b/windows/security/hardware-security/tpm/tpm-recommendations.md @@ -87,7 +87,7 @@ The following table defines which Windows features require TPM support. | Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot. TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm, which is being deprecated. | | BitLocker | No | Yes | Yes | TPM 1.2 or 2.0 are supported but TPM 2.0 is recommended. [Device Encryption requires Modern Standby](../../operating-system-security/data-protection/bitlocker/index.md#device-encryption) including TPM 2.0 support | | Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. | -| Windows Defender Application Control (Device Guard) | No | Yes | Yes | +| App Control for Business | No | Yes | Yes | | System Guard (DRTM) | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | | Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. Paired with System Guard, TPM 2.0 provides enhanced security for Credential Guard. Windows 11 requires TPM 2.0 by default to facilitate easier enablement of this enhanced security for customers. | | Device Health Attestation | Yes | Yes | Yes | TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm, which is being deprecated. | diff --git a/windows/security/includes/sections/application.md b/windows/security/includes/sections/application.md index 8b6b510ef4..75e29b9470 100644 --- a/windows/security/includes/sections/application.md +++ b/windows/security/includes/sections/application.md @@ -9,8 +9,8 @@ ms.topic: include | Feature name | Description | |:---|:---| -| **[Smart App Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections, by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run that are predicted to be safe based on existing and new intelligence processed daily. Smart App Control builds on top of the same cloud-based AI used in Windows Defender Application Control (WDAC) to predict the safety of an application, so people can be confident they're using safe and reliable applications on their new Windows 11 devices, or Windows 11 devices that have been reset. | -| **[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Your organization is only as secure as the applications that run on your devices. With application control, apps must earn trust to run, in contrast to an application trust model where all code is assumed trustworthy. By helping prevent unwanted or malicious code from running, application control is an important part of an effective security strategy. Many organizations cite application control as one of the most effective means for addressing the threat of executable file-based malware.

      Windows 10 and above include Windows Defender Application Control (WDAC) and AppLocker. WDAC is the next generation app control solution for Windows and provides powerful control over what runs in your environment. Customers who were using AppLocker on previous versions of Windows can continue to use the feature as they consider whether to switch to WDAC for the stronger protection. | +| **[Smart App Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections, by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run that are predicted to be safe based on existing and new intelligence processed daily. Smart App Control builds on top of the same cloud-based AI used in App Control for Business to predict the safety of an application, so people can be confident they're using safe and reliable applications on their new Windows 11 devices, or Windows 11 devices that have been reset. | +| **[App Control for Business](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Your organization is only as secure as the applications that run on your devices. With application control, apps must earn trust to run, in contrast to an application trust model where all code is assumed trustworthy. By helping prevent unwanted or malicious code from running, application control is an important part of an effective security strategy. Many organizations cite application control as one of the most effective means for addressing the threat of executable file-based malware.

      Windows 10 and above include App Control for Business and AppLocker. App Control is the next generation app control solution for Windows and provides powerful control over what runs in your environment. Customers who were using AppLocker on previous versions of Windows can continue to use the feature as they consider whether to switch to App Control for the stronger protection. | | **[AppLocker](/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview)** | | | **[User Account Control (UAC)](/windows/security/application-security/application-control/user-account-control/)** | User Account Control (UAC) helps prevent malware from damaging a device. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevents inadvertent changes to system settings. Enabling UAC helps to prevent malware from altering device settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. | | **[Microsoft vulnerable driver blocklist](/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules)** | The Windows kernel is the most privileged software and is therefore a compelling target for malware authors. Since Windows has strict requirements for code running in the kernel, cybercriminals commonly exploit vulnerabilities in kernel drivers to get access. Microsoft works with the ecosystem partners to constantly identify and respond to potentially vulnerable kernel drivers.

      Prior to Windows 11, version 22H2, the operating system enforced a block policy when HVCI is enabled to prevent vulnerable versions of drivers from running. Starting in Windows 11, version 22H2, the block policy is enabled by default for all new Windows devices, and users can opt-in to enforce the policy from the Windows Security app. | diff --git a/windows/security/includes/sections/security-foundations.md b/windows/security/includes/sections/security-foundations.md index 7a85af0543..905fb63998 100644 --- a/windows/security/includes/sections/security-foundations.md +++ b/windows/security/includes/sections/security-foundations.md @@ -25,5 +25,5 @@ ms.topic: include | Feature name | Description | |:---|:---| | **Software Bill of Materials (SBOM)** | SBOMs are leveraged to provide the transparency and provenance of the content as it moves through various stages of the Windows supply chain. This enables trust between each supply chain segment, ensures that tampering has not taken place during ingestion and along the way, and provides a provable chain of custody for the product that we ship to customers. | -| **[Azure Code Signing](/windows/security/application-security/application-control/windows-defender-application-control/deployment/use-code-signing-for-better-control-and-protection)** | Windows Defender Application Control (WDAC) enables customers to define policies for controlling what is allowed to run on their devices. WDAC policies can be remotely applied to devices using an MDM solution like Microsoft Intune.

      To simplify WDAC enablement, organizations can take advantage of Azure Code Signing, a secure and fully managed service for signing WDAC policies and apps.

      Azure Code Signing minimizes the complexity of code signing with a turnkey service backed by a Microsoft managed certificate authority, eliminating the need to procure and self-manage any signing certificates. The service is managed just as any other Azure resource and integrates easily with the leading development and CI/CD toolsets. | +| **[Azure Code Signing](/windows/security/application-security/application-control/windows-defender-application-control/deployment/use-code-signing-for-better-control-and-protection)** | App Control for Business enables customers to define policies for controlling what is allowed to run on their devices. App Control policies can be remotely applied to devices using an MDM solution like Microsoft Intune.

      To simplify App Control enablement, organizations can take advantage of Azure Code Signing, a secure and fully managed service for signing App Control policies and apps.

      Azure Code Signing minimizes the complexity of code signing with a turnkey service backed by a Microsoft managed certificate authority, eliminating the need to procure and self-manage any signing certificates. The service is managed just as any other Azure resource and integrates easily with the leading development and CI/CD toolsets. | | **[Windows application software development kit (SDK)](https://developer.microsoft.com/windows/downloads/windows-sdk/)** | Developers have an opportunity to design highly secure applications that benefit from the latest Windows safeguards. The Windows App SDK provides a unified set of APIs and tools for developing secure desktop apps for Windows. To help create apps that are up-to-date and protected, the SDK follows the same security standards, protocols, and compliance as the core Windows operating system. | diff --git a/windows/security/index.yml b/windows/security/index.yml index 9553388f93..9738ace595 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -101,7 +101,7 @@ landingContent: linkLists: - linkListType: overview links: - - text: Windows Defender Application Control (WDAC) + - text: App Control for Business url: /windows/security/application-security/application-control/windows-defender-application-control/ - text: User Account Control (UAC) url: /windows/security/application-security/application-control/user-account-control diff --git a/windows/security/operating-system-security/network-security/windows-firewall/rules.md b/windows/security/operating-system-security/network-security/windows-firewall/rules.md index 4729ae6e10..3daf29314e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/rules.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/rules.md @@ -46,11 +46,11 @@ In either of these scenarios, once the rules are added, they must be deleted to > [!NOTE] > The firewall's default settings are designed for security. Allowing all inbound connections by default introduces the network to various threats. Therefore, creating exceptions for inbound connections from non-Microsoft software should be determined by trusted app developers, the user, or the admin on behalf of the user. -### WDAC tagging policies +### App Control tagging policies -Windows Firewall supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: +Windows Firewall supports the use of App Control for Business Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: -1. Deploy *WDAC AppId tagging policies*: a Windows Defender Application Control policy must be deployed, which specifies individual applications or groups of applications to apply a *PolicyAppId tag* to the process token(s). Then, the admin can define firewall rules that are scoped to all processes tagged with the matching *PolicyAppId*. For more information, see the [WDAC AppId tagging guide](../../../application-security/application-control/windows-defender-application-control/AppIdTagging/wdac-appid-tagging-guide.md) to create, deploy, and test an AppID policy to tag applications. +1. Deploy *App Control AppId tagging policies*: an App Control for Business policy must be deployed, which specifies individual applications or groups of applications to apply a *PolicyAppId tag* to the process token(s). Then, the admin can define firewall rules that are scoped to all processes tagged with the matching *PolicyAppId*. For more information, see the [App Control AppId tagging guide](../../../application-security/application-control/app-control-for-business/AppIdTagging/appcontrol-appid-tagging-guide.md) to create, deploy, and test an AppID policy to tag applications. 1. Configure firewall rules using *PolicyAppId tags* using one of the two methods: - Using the [PolicyAppId node of the Firewall CSP](/windows/client-management/mdm/firewall-csp#mdmstorefirewallrulesfirewallrulenamepolicyappid) with an MDM solution like Microsoft Intune. If you use Microsoft Intune, you can deploy the rules from Microsoft Intune Admin center, under the path **Endpoint security** > **Firewall** > **Create policy** > **Windows 10, Windows 11, and Windows Server** > **Windows Firewall Rules**. When creating the rules, provide the *AppId tag* in the **Policy App ID** setting - Create local firewall rules with PowerShell: use the [`New-NetFirewallRule`](/powershell/module/netsecurity/new-netfirewallrule) cmdlet and specify the `-PolicyAppId` parameter. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 5dd0c7c3f0..68fce9d079 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -19,7 +19,7 @@ See the following articles to learn more about the different areas of Windows th - [Controlled Folder Access](/microsoft-365/security/defender-endpoint/controlled-folders) - [Exploit Protection](/microsoft-365/security/defender-endpoint/exploit-protection) - [Microsoft Defender Application Guard](../application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md) -- [Microsoft Defender Device Guard](../application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) +- [Microsoft Defender Device Guard](../application-security/application-control/introduction-to-virtualization-based-security-and-appcontrol.md) - [Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/) - [Network Protection](/microsoft-365/security/defender-endpoint/network-protection) - [Virtualization-Based Protection of Code Integrity](../hardware-security/enable-virtualization-based-protection-of-code-integrity.md) diff --git a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md index 564b83b498..5b5fb3e06e 100644 --- a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md +++ b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md @@ -386,7 +386,7 @@ Examples: Set-ProcessMitigation -Name notepad.exe -Enable SEHOP -Disable MandatoryASLR,DEPATL ``` -- **Convert Attack surface reduction (ASR) settings to a Code Integrity policy file**: If the input file contains any settings for EMET's Attack surface reduction (ASR) mitigation, the converter will also create a Code Integrity policy file. In this case, you can complete the merging, auditing, and deployment process for the Code Integrity policy. For more information, see [Deploying Windows Defender Application Control (WDAC) policies](../application-security/application-control/windows-defender-application-control/deployment/wdac-deployment-guide.md). This completion will enable protections on Windows 10 equivalent to EMET's ASR protections. +- **Convert Attack surface reduction (ASR) settings to a Code Integrity policy file**: If the input file contains any settings for EMET's Attack surface reduction (ASR) mitigation, the converter will also create a Code Integrity policy file. In this case, you can complete the merging, auditing, and deployment process for the Code Integrity policy. For more information, see [Deploying App Control for Business policies](../application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide.md). This completion will enable protections on Windows 10 equivalent to EMET's ASR protections. - **Convert Certificate Trust settings to enterprise certificate pinning rules**: If you have an EMET "Certificate Trust" XML file (pinning rules file), you can also use ConvertTo-ProcessMitigationPolicy to convert the pinning rules file into an enterprise certificate pinning rules file. Then you can finish enabling that file as described in [Enterprise Certificate Pinning](/windows/access-protection/enterprise-certificate-pinning). For example: