From 5b6bba426c4fdb739f1febd77978c6906ad3f458 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 16 Apr 2019 16:00:43 -0700 Subject: [PATCH 1/4] Update respond-file-alerts-windows-defender-advanced-threat-protection.md add hex --- ...file-alerts-windows-defender-advanced-threat-protection.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md index e5f643f908..a15f907fa2 100644 --- a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md @@ -258,6 +258,10 @@ If you encounter a problem when trying to submit a file, try each of the followi a. Change the following registry entry and values to change the policy on specific machines: ``` HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection +AllowSampleCollection (dword) 1 (hex) + + +Where: Value = 0 – block sample collection Value = 1 – allow sample collection ``` From 240c73c3916a67077a1710757d06a7ae4ca7d706 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 18 Apr 2019 16:55:13 -0700 Subject: [PATCH 2/4] update error --- ...alerts-windows-defender-advanced-threat-protection.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md index a15f907fa2..a482be899c 100644 --- a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md @@ -257,11 +257,10 @@ If you encounter a problem when trying to submit a file, try each of the followi a. Change the following registry entry and values to change the policy on specific machines: ``` -HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection -AllowSampleCollection (dword) 1 (hex) - - -Where: +Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection +Name: AllowSampleCollection +Type: DWORD +Value: Value = 0 – block sample collection Value = 1 – allow sample collection ``` From f1e7de83818af4e0c39a73c220691a877efe2200 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 18 Apr 2019 16:58:25 -0700 Subject: [PATCH 3/4] Update respond-file-alerts-windows-defender-advanced-threat-protection.md --- ...d-file-alerts-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md index a482be899c..e8a6fb62e1 100644 --- a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md @@ -260,7 +260,7 @@ If you encounter a problem when trying to submit a file, try each of the followi Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection Name: AllowSampleCollection Type: DWORD -Value: +Hexadecimal value : Value = 0 – block sample collection Value = 1 – allow sample collection ``` From 639f826369a79caabe6919e6dfe3ef6edae356e8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 18 Apr 2019 17:02:45 -0700 Subject: [PATCH 4/4] Update respond-file-alerts-windows-defender-advanced-threat-protection.md --- ...ows-defender-advanced-threat-protection.md | 21 ++++++++----------- 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md index e8a6fb62e1..544077f49b 100644 --- a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md @@ -253,22 +253,19 @@ If you encounter a problem when trying to submit a file, try each of the followi 1. Ensure that the file in question is a PE file. PE files typically have _.exe_ or _.dll_ extensions (executable programs or applications). 2. Ensure the service has access to the file, that it still exists, and has not been corrupted or modified. 3. You can wait a short while and try to submit the file again, in case the queue is full or there was a temporary connection or communication error. -4. Verify the policy setting enables sample collection and try to submit the file again. +4. If the sample collection policy is not configured, then the default behavior is to allow sample collection. If it is configured, then verify the policy setting allows sample collection before submitting the file again. When sample collection is configured, then check the following registry value: - a. Change the following registry entry and values to change the policy on specific machines: - ``` -Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection -Name: AllowSampleCollection -Type: DWORD -Hexadecimal value : - Value = 0 – block sample collection - Value = 1 – allow sample collection -``` + ``` + Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection + Name: AllowSampleCollection + Type: DWORD + Hexadecimal value : + Value = 0 – block sample collection + Value = 1 – allow sample collection + ``` 5. Change the organizational unit through the Group Policy. For more information, see [Configure with Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md). 6. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). -> [!NOTE] -> If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. ## Related topic - [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md)