mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-19 12:23:37 +00:00
Merge branch 'master' of https://github.com/Microsoft/win-cpub-itpro-docs into v-jak-sec01
This commit is contained in:
JanKeller1
@ -31,6 +31,7 @@
|
||||
##### [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md)
|
||||
#### [Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md)
|
||||
#### [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md)
|
||||
#### [Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md)
|
||||
### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md)
|
||||
### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md)
|
||||
### [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md)
|
||||
@ -196,7 +197,7 @@
|
||||
###### [Monitor claim types](monitor-claim-types.md)
|
||||
##### [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)
|
||||
###### [Audit Credential Validation](audit-credential-validation.md)
|
||||
####### [Event 4774 S: An account was mapped for logon.](event-4774.md)
|
||||
####### [Event 4774 S, F: An account was mapped for logon.](event-4774.md)
|
||||
####### [Event 4775 F: An account could not be mapped for logon.](event-4775.md)
|
||||
####### [Event 4776 S, F: The computer attempted to validate the credentials for an account.](event-4776.md)
|
||||
####### [Event 4777 F: The domain controller failed to validate the credentials for an account.](event-4777.md)
|
||||
|
||||
@ -42,7 +42,7 @@ The main reason to enable this auditing subcategory is to handle local accounts
|
||||
|
||||
**Events List:**
|
||||
|
||||
- [4774](event-4774.md)(S): An account was mapped for logon.
|
||||
- [4774](event-4774.md)(S, F): An account was mapped for logon.
|
||||
|
||||
- [4775](event-4775.md)(F): An account could not be mapped for logon.
|
||||
|
||||
|
||||
@ -53,7 +53,7 @@ Using the digital signature, UEFI verifies that the bootloader was signed using
|
||||
|
||||
If the bootloader passes these two tests, UEFI knows that the bootloader isn’t a bootkit and starts it. At this point, Trusted Boot takes over, and the Windows bootloader, using the same cryptographic technologies that UEFI used to verify the bootloader, then verifies that the Windows system files haven’t been changed.
|
||||
|
||||
All Windows 8–certified devices must meet several requirements related to UEFI-based Secure Boot:
|
||||
Starting with Windows 8, certified devices must meet several requirements related to UEFI-based Secure Boot:
|
||||
|
||||
- They must have Secure Boot enabled by default.
|
||||
- They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed).
|
||||
|
||||
@ -15,6 +15,8 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md
|
||||
## January 2017
|
||||
|New or changed topic |Description |
|
||||
|---------------------|------------|
|
||||
|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |New |
|
||||
|[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Updated to include info about USB drives and Azure RMS (Windows Insider Program only) and to add more info about Work Folders and Offline files. |
|
||||
|[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |New |
|
||||
|[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |New |
|
||||
|
||||
|
||||
@ -17,20 +17,105 @@ author: brianlic-msft
|
||||
This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks.
|
||||
You can use BitLocker to protect your Windows 10 PCs. Whichever operating system you’re using, Microsoft and Windows-certified devices provide countermeasures to address attacks and improve your data security. In most cases, this protection can be implemented without the need for pre-boot authentication.
|
||||
|
||||
Figures 2, 3, and 4 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default
|
||||
settings.
|
||||
Tables 1 and 2 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default settings.
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="25%" />
|
||||
<col width="55%" />
|
||||
</colgroup>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td BGCOLOR="#01BCF3">
|
||||
<p><font color="#FFFFFF"><strong>Windows 8.1<br>without TPM</strong></font></p></td>
|
||||
<td BGCOLOR="#01BCF3">
|
||||
<p><font color="#FFFFFF"><strong>Windows 8.1 Certified<br>(with TPM)</strong></font></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">Bootkits and<br>Rootkits</p></font></td>
|
||||
<td BGCOLOR="#FED198"><p>Without TPM, boot integrity checking is not available</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default when UEFI-based Secure Boot is enabled and a firmware password is required to change settings</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td BGCOLOR="FF8C01">
|
||||
<p><font color="#FFFFFF">Brute Force<br>Sign-in</font></p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default, and can be improved with account lockout Group Policy</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default, and can be improved with account lockout and device lockout Group Policy settings</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">DMA<br>Attacks</p></font></td>
|
||||
<td BGCOLOR="#99E4FB"><p>If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td BGCOLOR="FF8C01">
|
||||
<p><font color="#FFFFFF">Hyberfil.sys<br>Attacks</font></p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default; hyberfil.sys secured on encrypted volume</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default; hyberfil.sys secured on encrypted volume</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">Memory<br>Remanence<br>Attacks</p></font></td>
|
||||
<td BGCOLOR="#FED198"><p>Password protect the firmware and disable booting from external media. If an attack is viable, consider pre-boot authentication</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Password protect the firmware and ensure Secure Boot is enabled. If an attack is viable, consider pre-boot authentication</p></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
**Figure 2.** How to choose the best countermeasures for Windows 7
|
||||
**Table 1.** How to choose the best countermeasures for Windows 8.1<br><br>
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="25%" />
|
||||
<col width="55%" />
|
||||
</colgroup>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td BGCOLOR="#01BCF3">
|
||||
<p><font color="#FFFFFF"><strong>Windows 10<br>without TPM</strong></font></p></td>
|
||||
<td BGCOLOR="#01BCF3">
|
||||
<p><font color="#FFFFFF"><strong>Windows 10 Certified<br>(with TPM)</strong></font></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">Bootkits and<br>Rootkits</p></font></td>
|
||||
<td BGCOLOR="#FED198"><p>Without TPM, boot integrity checking is not available</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default when UEFI-based Secure Boot is enabled and a firmware password is required to change settings</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td BGCOLOR="FF8C01">
|
||||
<p><font color="#FFFFFF">Brute Force<br>Sign-in</font></p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default, and can be improved with account lockout Group Policy</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default, and can be improved with account lockout and device lockout Group Policy settings</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">DMA<br>Attacks</p></font></td>
|
||||
<td BGCOLOR="#99E4FB"><p>If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default; certified devices do not expose vulnerable DMA busses.<br>Can be additionally secured by deploying policy to restrict DMA devices:</p>
|
||||
<ul>
|
||||
<li><p><a href="https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#DataProtection_AllowDirectMemoryAccess">DataProtection/AllowDirectMemoryAccess</a></p></li>
|
||||
<li><p><a href="https://support.microsoft.com/en-us/kb/2516445">Block 1394 and Thunderbolt</a></p></li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td BGCOLOR="FF8C01">
|
||||
<p><font color="#FFFFFF">Hyberfil.sys<br>Attacks</font></p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default; hyberfil.sys secured on encrypted volume</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default; hyberfil.sys secured on encrypted volume</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">Memory<br>Remanence<br>Attacks</p></font></td>
|
||||
<td BGCOLOR="#FED198"><p>Password protect the firmware and disable booting from external media. If an attack is viable, consider pre-boot authentication</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Password protect the firmware and ensure Secure Boot is enabled.<br>The most effective mitigation, which we advise for high-security devices, is to configure a TPM+PIN protector, disable Standby power management, and shut down or hibernate the device before it leaves the control of an authorized user.</p></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
**Figure 3.** How to choose the best countermeasures for Windows 8
|
||||
|
||||
|
||||
|
||||
**Figure 4.** How to choose the best countermeasures for Windows 8.1
|
||||
**Table 2.** How to choose the best countermeasures for Windows 10
|
||||
|
||||
The latest InstantGo devices, primarily tablets, are designed to be secure by default against all attacks that might compromise the BitLocker encryption key. Other Windows devices can be, too. DMA port–based attacks, which represent the attack vector of choice, are not possible on InstantGo devices, because these port types are prohibited. The inclusion of DMA ports on even non-InstantGo devices is extremely rare on recent devices, particularly on mobile ones. This could change if Thunderbolt is broadly adopted, so IT should consider this when purchasing new devices. In any case DMA ports can be disabled entirely, which is an increasingly popular option because the use of
|
||||
DMA ports is infrequent in the non-developer space.
|
||||
|
||||
@ -24,7 +24,7 @@ localizationpriority: high
|
||||
|
||||
You need to add an application in your Azure Active Directory (AAD) tenant then authorize the Windows Defender ATP Alerts Export application to communicate with it so that your security information and events management (SIEM) tool can consume alerts from Windows Defender ATP portal.
|
||||
|
||||
1. Login to the [Azure management portal](https://manage.windowsazure.com).
|
||||
1. Login to the [Azure management portal](https://ms.portal.azure.com).
|
||||
|
||||
2. Select **Active Directory**.
|
||||
|
||||
@ -53,14 +53,12 @@ You need to add an application in your Azure Active Directory (AAD) tenant then
|
||||
|
||||
13. Click **Save** and copy the key in a safe place. You'll need this key to authenticate the client application on Azure Active Directory.
|
||||
|
||||
14. Open a web browser and connect to the following URL: <br>
|
||||
```text
|
||||
https://DataAccess-PRD.trafficmanager.net:444/api/FetchToken?clientId=f7c1acd8-0458-48a0-a662-dba6de049d1c&tenantId=<tenant ID>&clientSecret=1234
|
||||
```
|
||||
An Azure login page appears.
|
||||
> [!NOTE]
|
||||
> - Replace *tenant ID* with your actual tenant ID.
|
||||
> - Keep the client secret as is. This is a dummy value, but the parameter must appear.
|
||||
14. Open a web browser and connect to the following URL: `https://DataAccess-PRD.trafficmanager.net:444/api/FetchToken?clientId=f7c1acd8-0458-48a0-a662-dba6de049d1c&tenantId=<tenant ID>&clientSecret=1234`<br>
|
||||
|
||||
An Azure login page appears.
|
||||
> [!NOTE]
|
||||
> - Replace *tenant ID* with your actual tenant ID.
|
||||
> - Keep the *clientSecret* as is. This is a dummy value, but the parameter must appear.
|
||||
|
||||
15. Sign in with the credentials of a user from your tenant.
|
||||
|
||||
@ -80,7 +78,37 @@ An Azure login page appears.
|
||||
|
||||
23. Save the application changes.
|
||||
|
||||
After configuring the application in AAD, you can continue to configure the SIEM tool that you want to use.
|
||||
After configuring the application in AAD, you'll need to obtain a refresh token. You'll need to use the token when you configure the connector for your SIEM tool in the next steps. The token lets the connector access Windows Defender ATP events to be consumed by your SIEM.
|
||||
|
||||
## Obtain a refresh token using an events URL
|
||||
Obtain a refresh token used to retrieve the Windows Defender Advanced Threat Protection events to your SIEM. This section provides information on how you can use an events URL to obtain the required refresh token.
|
||||
>[!NOTE]
|
||||
>For HP ArcSight, you can obtain a refresh token using the restutil tool. For more information, see [Configure HP ArcSight to consume alerts](configure-arcsight-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
### Before you begin
|
||||
Get the following information from your Azure Active Directory (AAD) application by selecting the **View Endpoint** on the application configuration page:
|
||||
|
||||
- OAuth 2 Client ID
|
||||
- OAuth 2 Client secret
|
||||
|
||||
You'll use these values to obtain a refresh token.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Before using the OAuth 2 Client secret described in the next steps, you **must** encode it. Use a URL encoder to transform the OAuth 2 client secret.
|
||||
|
||||
### Obtain a refresh token
|
||||
1. Open a web browser and connect to the following URL: `https://DataAccess-PRD.trafficmanager.net:444/api/FetchToken?clientId=<client ID>&tenantId=<tenant ID>&clientSecret=<client secret>`
|
||||
|
||||
>[!NOTE]
|
||||
>- Replace the *client ID* value with the one you got from your AAD application.
|
||||
>- Replace *tenant ID* with your actual tenant ID.
|
||||
>- Replace *client secret* with your encoded client secret. The client secret **must** be pasted encoded.
|
||||
|
||||
2. Click **Accept**. When you authenticate, a web page opens with your refresh token.
|
||||
|
||||
3. Save the refresh token which you'll find it the `<RefreshToken></RefreshToken>`value. You'll need this value when configuring your SIEM tool.
|
||||
|
||||
After configuring your AAD application and generating a refresh token, you can proceed to configure your SIEM tool.
|
||||
|
||||
## Related topics
|
||||
- [Configure security information and events management (SIEM) tools to consume alerts](configure-siem-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -25,26 +25,36 @@ You'll need to configure HP ArcSight so that it can consume Windows Defender ATP
|
||||
|
||||
## Before you begin
|
||||
|
||||
- Get the following information from your Azure Active Directory (AAD) application by selecting the **View Endpoint** on the application configuration page:
|
||||
- Get the following information from your Azure Active Directory (AAD) application by selecting **View Endpoint** on the application configuration page:
|
||||
- OAuth 2 Token refresh URL
|
||||
- OAuth 2 Client ID
|
||||
- OAuth 2 Client secret
|
||||
- Create your OAUth 2 Client properties file or get it from your Windows Defender ATP contact. For more information, see the ArcSight FlexConnector Developer's guide.
|
||||
- Download the [WDATP-connector.properties](http://download.microsoft.com/download/3/9/C/39C703C2-487C-4C3E-AFD8-14C2253C2F12/WDATP-connector.properties) file and update the following values:
|
||||
|
||||
> [!NOTE]
|
||||
> **For the authorization URL**: Append the following to the value you got from the AAD app: ```?resource=https%3A%2F%2FWDATPAlertExport.Seville.onmicrosoft.com``` <br>
|
||||
> **For the redirect_uri value use**: ```https://localhost:44300/wdatpconnector```
|
||||
>
|
||||
- Get the *wdatp-connector.properties* file from your Windows Defender ATP contact. This file is used to parse the information from Windows Defender ATP to HP ArcSight consumable format.
|
||||
- Install the HP ArcSight REST FlexConnector package on a server that has access to the Internet.
|
||||
- Contact the Windows Defender ATP team to get your refresh token or follow the steps in the section "Run restutil to Obtain a Refresh Token for Connector Appliance/ArcSight Management Center" in the ArcSight FlexConnector Developer's guide.
|
||||
- **client_ID**: OAuth 2 Client ID
|
||||
- **client_secret**: OAuth 2 Client secret
|
||||
- **auth_url**: ```https://login.microsoftonline.com/<tenantID>?resource=https%3A%2F%2FWDATPAlertExport.Seville.onmicrosoft.com ```
|
||||
|
||||
>[!NOTE]
|
||||
>Replace *tenantID* with your tenant ID.
|
||||
|
||||
- **token_url**: `https://login.microsoftonline.com/<tenantID>/oauth2/token`
|
||||
|
||||
>[!NOTE]
|
||||
>Replace the *tenantID* value with your tenant ID.
|
||||
|
||||
- **redirect_uri**: ```https://localhost:44300/wdatpconnector```
|
||||
- **scope**: Leave the value blank
|
||||
|
||||
- Download the [WDATP-connector.jsonparser.properties](http://download.microsoft.com/download/0/8/A/08A4957D-0923-4353-B25F-395EAE363E8C/WDATP-connector.jsonparser.properties) file. This file is used to parse the information from Windows Defender ATP to HP ArcSight consumable format.
|
||||
- Install the HP ArcSight REST FlexConnector package. You can find this in the HPE Software center. Install the package on a server that has access to the Internet.
|
||||
|
||||
## Configure HP ArcSight
|
||||
The following steps assume that you have completed all the required steps in [Before you begin](#before-you-begin).
|
||||
The following steps assume that you have completed all the required steps in [Before you begin](#before-you-begin). For more information, see the ArcSight FlexConnector Developer's guide.
|
||||
|
||||
1. Copy the *wdatp-connector.jsonparser.properties* file into the `<root>\current\user\agent\flexagent` folder of the connector installation folder.
|
||||
1. Save the [WDATP-connector.jsonparser.properties file](http://download.microsoft.com/download/0/8/A/08A4957D-0923-4353-B25F-395EAE363E8C/WDATP-connector.jsonparser.properties) file into the connector installation folder. The
|
||||
|
||||
2. Save the *wdatp-connector.properties* file into a folder of your choosing.
|
||||
2. Save the [WDATP-connector.properties](http://download.microsoft.com/download/3/9/C/39C703C2-487C-4C3E-AFD8-14C2253C2F12/WDATP-connector.properties) file into the `<root>\current\user\agent\flexagent` folder of the connector installation folder.
|
||||
|
||||
3. Open an elevated command-line:
|
||||
|
||||
@ -69,7 +79,8 @@ The following steps assume that you have completed all the required steps in [Be
|
||||
<td>Type in the name of the client property file. It must match the client property file.</td>
|
||||
</tr>
|
||||
<td>Events URL</td>
|
||||
<td>`https://DataAccess-PRD.trafficmanager.net:444/api/alerts`</td>
|
||||
<td>Depending on the location of your datacenter, select either the EU or the US URL: </br></br> **For EU**: https://<i></i>wdatp-alertexporter-eu.windows.com/api/alerts/?sinceTimeUtc=$START_AT_TIME
|
||||
</br>**For US:** https://<i></i>wdatp-alertexporter-us.windows.com/api/alerts/?sinceTimeUtc=$START_AT_TIME</td>
|
||||
<tr>
|
||||
<td>Authentication Type</td>
|
||||
<td>OAuth 2</td>
|
||||
@ -78,7 +89,8 @@ The following steps assume that you have completed all the required steps in [Be
|
||||
<td>Select *wdatp-connector.properties*.</td>
|
||||
<tr>
|
||||
<td>Refresh Token</td>
|
||||
<td>Paste the refresh token that your Windows Defender ATP contact provided, or run the `restutil` tool to get it.</td>
|
||||
<td>You can use the Windows Defender ATP events URL or the restutil tool to get obtain a refresh token. <br> For more information on getting your refresh token using the events URL, see [Obtain a refresh token](configure-aad-windows-defender-advanced-threat-protection.md#obtain-a-refresh-token). </br> </br>**To get your refresh token using the restutil tool:** </br> a. Open a command prompt. Navigate to `C:\ArcSightSmartConnectors\<descriptive_name>\current\bin`. </br></br> b. Type: `arcsight restutil token -config C:\ArcSightSmartConnectors_Prod\WDATP\WDATP-connector.properties`. A Web browser window will open. </br> </br>c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials. </br> </br>d. A refresh token is shown in the command prompt. </br></br> e. Paste the value in the form.
|
||||
</td>
|
||||
</tr>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -37,14 +37,14 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre
|
||||
|
||||
b. Select **Mobile Device Management/Microsoft Intune** > **Download package** and save the .zip file.
|
||||
|
||||
|
||||
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP.onboarding*.
|
||||
|
||||
3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune).
|
||||
|
||||
a. Select **Policy** > **Configuration Policies** > **Add**.
|
||||
|
||||
|
||||
|
||||
b. Under **Windows**, select **Custom Configuration (Windows 10 Desktop and Mobile and later)** > **Create and Deploy a Custom Policy** > **Create Policy**.
|
||||
|
||||
@ -56,7 +56,7 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre
|
||||
|
||||
|
||||
e. Type the following values then select **OK**:
|
||||
|
||||
|
||||
|
||||
|
||||
- **Setting name**: Type a name for the setting.
|
||||
|
||||
@ -25,9 +25,9 @@ You'll need to configure Splunk so that it can consume Windows Defender ATP aler
|
||||
|
||||
## Before you begin
|
||||
|
||||
- Install the [REST API Modular Input app](https://splunkbase.splunk.com/app/1546/) in Splunk
|
||||
- Contact the Windows Defender ATP team to get your refresh token
|
||||
- Get the following information from your Azure Active Directory (AAD) application by selecting the **View Endpoint** on the application configuration page:
|
||||
- Install the [REST API Modular Input app](https://splunkbase.splunk.com/app/1546/) in Splunk.
|
||||
- Obtain your refresh token. For more information, see [Obtain a refresh token](configure-aad-windows-defender-advanced-threat-protection.md#obtain-a-refresh-token).
|
||||
- Get the following information from your Azure Active Directory (AAD) application by selecting **View Endpoint** on the application configuration page:
|
||||
- OAuth 2 Token refresh URL
|
||||
- OAuth 2 Client ID
|
||||
- OAuth 2 Client secret
|
||||
@ -56,7 +56,8 @@ You'll need to configure Splunk so that it can consume Windows Defender ATP aler
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Endpoint URL</td>
|
||||
<td> https://<i></i>DataAccess-PRD.trafficmanager.net:444/api/alerts</td>
|
||||
<td>Depending on the location of your datacenter, select either the EU or the US URL: </br></br> **For EU**: https://<i></i>wdatp-alertexporter-eu.windows.com/api/alerts </br>**For US:** https://<i></i>wdatp-alertexporter-us.windows.com/api/alerts
|
||||
|
||||
</tr>
|
||||
<tr>
|
||||
<td>HTTP Method</td>
|
||||
|
||||
@ -436,11 +436,11 @@ There are no default locations included with WIP, you must add each of your netw
|
||||
|
||||
|
||||
|
||||
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. Not configured is the default option.
|
||||
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. Not configured is the default option.
|
||||
|
||||
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option.
|
||||
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option.
|
||||
|
||||
- **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option.
|
||||
- **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option.
|
||||
|
||||
5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy.
|
||||
|
||||
|
||||
@ -48,7 +48,7 @@ The following tables provide more information about the hardware, firmware, and
|
||||
|
||||
> [!NOTE]
|
||||
> For new computers running Windows 10, Trusted Platform Module (TPM 2.0) must be enabled by default. This requirement is not restated in the tables that follow.<br>
|
||||
> If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx).<br>
|
||||
> If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).<br>
|
||||
> Starting in Widows 10, 1607, TPM 2.0 is required.
|
||||
|
||||
|
||||
@ -61,7 +61,7 @@ The following tables provide more information about the hardware, firmware, and
|
||||
| Hardware: **Trusted Platform Module (TPM)** | **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.<br><br>**Security benefits**: A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. |
|
||||
| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)<br><br>**Security benefits**: UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
|
||||
| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).<br><br>**Security benefits**: UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT<br><br>**! Important**:<br>Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.<br><br>**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT<br><blockquote><p><strong>Important:</strong><br> Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.</p></blockquote><br>**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. |
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Credential Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Credential Guard can provide.
|
||||
@ -917,6 +917,7 @@ write-host $tmp -Foreground Red
|
||||
- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](http://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel)
|
||||
- [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert)
|
||||
- [Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode)
|
||||
- [Protecting network passwords with Windows 10 Credential Guard](https://www.microsoft.com/itshowcase/Article/Content/831/Protecting-network-passwords-with-Windows-10-Credential-Guard)
|
||||
- [Enabling Strict KDC Validation in Windows Kerberos](http://www.microsoft.com/download/details.aspx?id=6382)
|
||||
- [What's New in Kerberos Authentication for Windows Server 2012](http://technet.microsoft.com/library/hh831747.aspx)
|
||||
- [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](http://technet.microsoft.com/library/dd378897.aspx)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 4774(S) An account was mapped for logon. (Windows 10)
|
||||
description: Describes security event 4774(S) An account was mapped for logon.
|
||||
description: Describes security event 4774(S, F) An account was mapped for logon.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -8,14 +8,13 @@ ms.sitesec: library
|
||||
author: Mir0sh
|
||||
---
|
||||
|
||||
# 4774(S): An account was mapped for logon.
|
||||
# 4774(S, F): An account was mapped for logon.
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
It appears that this event never occurs.
|
||||
Success events do not appear to occur. Failure event [has been reported](http://forum.ultimatewindowssecurity.com/Topic7313-282-1.aspx).
|
||||
|
||||
***Subcategory:*** [Audit Credential Validation](audit-credential-validation.md)
|
||||
|
||||
@ -23,7 +22,7 @@ It appears that this event never occurs.
|
||||
|
||||
*An account was mapped for logon.*
|
||||
|
||||
*Authentication Package:%1*
|
||||
*Authentication Package:Schannel*
|
||||
|
||||
*Account UPN:%2*
|
||||
|
||||
|
||||
@ -31,9 +31,9 @@ When a local setting is inaccessible, it indicates that a GPO currently controls
|
||||
3. When you find the policy setting in the details pane, double-click the security policy that you want to modify.
|
||||
4. Modify the security policy setting, and then click **OK**.
|
||||
|
||||
**Note**
|
||||
- Some security policy settings require that the device be restarted before the setting takes effect.
|
||||
- Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on.
|
||||
> [!NOTE]
|
||||
> - Some security policy settings require that the device be restarted before the setting takes effect.
|
||||
> - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on.
|
||||
|
||||
## <a href="" id="bkmk-domain"></a>To configure a security policy setting using the Local Group Policy Editor console
|
||||
|
||||
@ -48,11 +48,13 @@ You must have the appropriate permissions to install and use the Microsoft Manag
|
||||
|
||||
4. In the details pane, double-click the security policy setting that you want to modify.
|
||||
|
||||
>**Note:** If this security policy has not yet been defined, select the **Define these policy settings** check box.
|
||||
> [!NOTE]
|
||||
> If this security policy has not yet been defined, select the **Define these policy settings** check box.
|
||||
|
||||
5. Modify the security policy setting, and then click **OK**.
|
||||
|
||||
>**Note:** If you want to configure security settings for many devices on your network, you can use the Group Policy Management Console.
|
||||
> [!NOTE]
|
||||
> If you want to configure security settings for many devices on your network, you can use the Group Policy Management Console.
|
||||
|
||||
## <a href="" id="bkmk-dc"></a>To configure a setting for a domain controller
|
||||
|
||||
@ -65,13 +67,15 @@ The following procedure describes how to configure a security policy setting for
|
||||
- Click **Local Policies** to edit the **Audit Policy**, a **User Rights Assignment**, or **Security Options**.
|
||||
|
||||
3. In the details pane, double-click the security policy that you want to modify.
|
||||
>**Note** If this security policy has not yet been defined, select the **Define these policy settings** check box.
|
||||
|
||||
> [!NOTE]
|
||||
> If this security policy has not yet been defined, select the **Define these policy settings** check box.
|
||||
|
||||
4. Modify the security policy setting, and then click **OK**.
|
||||
|
||||
**Important**
|
||||
- Always test a newly created policy in a test organizational unit before you apply it to your network.
|
||||
- When you change a security setting through a GPO and click **OK**, that setting will take effect the next time you refresh the settings.
|
||||
> [!IMPORTANT]
|
||||
> - Always test a newly created policy in a test organizational unit before you apply it to your network.
|
||||
> - When you change a security setting through a GPO and click **OK**, that setting will take effect the next time you refresh the settings.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -22,17 +22,18 @@ Credential Manager is a place where credentials in the OS are can be stored for
|
||||
For VPN, the VPN stack saves its credential as the session default.
|
||||
For WiFi, EAP does it.
|
||||
|
||||
The credentials are put in Credential Manager as a "`*Session`" credential.
|
||||
A "`*Session`" credential implies that it is valid for the current user session.
|
||||
The credentials are put in Credential Manager as a "\*Session" credential.
|
||||
A "\*Session" credential implies that it is valid for the current user session.
|
||||
The credentials are also cleaned up when the WiFi or VPN connection is disconnected.
|
||||
|
||||
When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so WinInit.exe can release the credentials that it gets from the Credential Manager to the SSP that is requesting it.
|
||||
When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so [WinInet](https://msdn.microsoft.com/library/windows/desktop/aa385483.aspx) can release the credentials that it gets from the Credential Manager to the SSP that is requesting it.
|
||||
For more information about the Enterprise Authentication capability, see [App capability declarations](https://msdn.microsoft.com/windows/uwp/packaging/app-capability-declarations).
|
||||
|
||||
WinInit.exe will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability.
|
||||
The local security authority will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability.
|
||||
If the app is not UWP, it does not matter.
|
||||
But if it is a UWP app, it will look at the device capability for Enterprise Authentication.
|
||||
If it does have that capability and if the resource that you are trying to access is in the Intranet zone in the Internet Options (ZoneMap), then the credential will be released.
|
||||
If it does have that capability and if the resource that you are trying to access is in the Intranet zone in the Internet Options (ZoneMap), then the credential will be released.
|
||||
This behavior helps prevent credentials from being misused by untrusted third parties.
|
||||
|
||||
## Intranet zone
|
||||
|
||||
@ -68,9 +69,26 @@ The username should also include a domain that can be reached over the connectio
|
||||
|
||||
If the credentials are certificate-based, then the elements in the following table need to be configured for the certificate templates to ensure they can also be used for Kerberos client authentication.
|
||||
|
||||
| TEmplate element | Configuration |
|
||||
| Template element | Configuration |
|
||||
|------------------|---------------|
|
||||
| SubjectName | The user’s distinguished name (DN) where the domain components of the distinguished name reflects the internal DNS namespace when the SubjectAlternativeName does not have the fully qualified UPN required to find the domain controller. </br>This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located. |
|
||||
| SubjectAlternativeName | The user’s fully qualified UPN where a domain name component of the user’s UPN matches the organizations internal domain’s DNS namespace.</br>This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located when the SubjectName does not have the DN required to find the domain controller. |
|
||||
| Key Storage Provider (KSP) | If the device is joined to Azure AD, a discrete SSO certificate is used. This certificate must be issued using the PassportForWork CSP. |
|
||||
| EnhancedKeyUsage | One or more of the following EKUs is required: </br>- Client Authentication (for the VPN) </br>- EAP Filtering OID (for PassportForWork)</br>- SmartCardLogon (for Azure AD joined devices)</br>If the domain controllers require smart card EKU either:</br>- SmartCardLogon</br>- id-pkinit-KPClientAuth (1.3.6.1.5.2.3.4)</br>Otherwise:</br>- TLS/SSL Client Authentication (1.3.6.1.5.5.7.3.2) |
|
||||
| Key Storage Provider (KSP) | If the device is joined to Azure AD, a discrete SSO certificate is used. |
|
||||
| EnhancedKeyUsage | One or more of the following EKUs is required: </br>- Client Authentication (for the VPN) </br>- EAP Filtering OID (for Windows Hello for Business)</br>- SmartCardLogon (for Azure AD joined devices)</br>If the domain controllers require smart card EKU either:</br>- SmartCardLogon</br>- id-pkinit-KPClientAuth (1.3.6.1.5.2.3.4)</br>Otherwise:</br>- TLS/SSL Client Authentication (1.3.6.1.5.5.7.3.2) |
|
||||
|
||||
## NDES server configuration
|
||||
|
||||
The NDES server is required to be configured so that incoming SCEP requests can be mapped to the correct template to be used.
|
||||
For more information, see [Configure certificate infrastructure for SCEP](https://docs.microsoft.com/en-us/intune/deploy-use/Configure-certificate-infrastructure-for-scep).
|
||||
|
||||
## Active Directory requirements
|
||||
|
||||
You need IP connectivity to a DNS server and domain controller over the network interface so that authentication can succeed as well.
|
||||
|
||||
The domain controllers will need to have appropriate KDC certificates for the client to trust them as domain controllers, and since phones are not domain-joined, the root CA of the KDC’s certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store.
|
||||
|
||||
The domain controllers must be using certificates based on the updated KDC certificate template Kerberos Authentication.
|
||||
This is because Windows 10 Mobile requires strict KDC validation to be enabled.
|
||||
This requires that all authenticating domain controllers run Windows Server 2016, or you'll need to enable strict KDC validation on domain controllers that run previous versions of Windows Server.
|
||||
For more information, see [Enabling Strict KDC Validation in Windows Kerberos](https://www.microsoft.com/download/details.aspx?id=6382).
|
||||
|
||||
|
||||
BIN
windows/keep-secure/images/atp-add-intune-policy.png
Normal file
BIN
windows/keep-secure/images/atp-add-intune-policy.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 66 KiB |
BIN
windows/keep-secure/images/atp-mdm-onboarding-package.png
Normal file
BIN
windows/keep-secure/images/atp-mdm-onboarding-package.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 75 KiB |
BIN
windows/keep-secure/images/atp-refresh-token.png
Normal file
BIN
windows/keep-secure/images/atp-refresh-token.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 224 KiB |
BIN
windows/keep-secure/images/wip-select-column.png
Normal file
BIN
windows/keep-secure/images/wip-select-column.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 5.7 KiB |
BIN
windows/keep-secure/images/wip-taskmgr.png
Normal file
BIN
windows/keep-secure/images/wip-taskmgr.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 43 KiB |
@ -6,6 +6,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
localizationpriority: high
|
||||
author: brianlic-msft
|
||||
---
|
||||
# Keep Windows 10 secure
|
||||
|
||||
@ -25,8 +25,8 @@ This table provides info about the most common problems you might encounter whil
|
||||
<th>Workaround</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise data on USB drives is tied to the device it was protected on.</td>
|
||||
<td>Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text.</td>
|
||||
<td>Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration.</td>
|
||||
<td><strong>If you’re using Azure RMS:</strong> Authenticated users can open enterprise data on USB drives, on computers running the latest build from the Windows Insider Program.<p><strong>If you’re not using Azure RMS:</strong> Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text.</td>
|
||||
<td>Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.<p>We strongly recommend educating employees about how to limit or eliminate the need for this decryption.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
@ -67,7 +67,7 @@ This table provides info about the most common problems you might encounter whil
|
||||
<tr>
|
||||
<td>Redirected folders with Client Side Caching are not compatible with WIP.</td>
|
||||
<td>Apps might encounter access errors while attempting to read a cached, offline file.</td>
|
||||
<td>Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.</td>
|
||||
<td>Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.<p><strong>Note</strong><br>For more info about Work Folders and Offline Files, see the blog, [Work Folders and Offline Files support for Windows Information Protection](https://blogs.technet.microsoft.com/filecab/2016/08/29/work-folders-and-offline-files-support-for-windows-information-protection/). If you're having trouble opening files offline while using Offline Files and WIP, see the support article, [Can't open files offline when you use Offline Files and Windows Information Protection](https://support.microsoft.com/en-us/kb/3187045).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer.</td>
|
||||
|
||||
@ -24,6 +24,7 @@ Microsoft Intune and System Center Configuration Manager helps you create and de
|
||||
|[Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Intune helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. |
|
||||
|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |System Center Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. |
|
||||
|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. |
|
||||
|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). |
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -54,7 +54,7 @@ The following tables provide more information about the hardware, firmware, and
|
||||
| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)<br><br>**Security benefits**: UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
|
||||
| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).<br><br>**Security benefits**: UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
|
||||
| Software: **HVCI compatible drivers** | **Requirements**: See the Windows Hardware Compatibility Program requirements under [Filter.Driver.DeviceGuard.DriverCompatibility](https://msdn.microsoft.com/library/windows/hardware/mt589732(v=vs.85).aspx).<br><br>**Security benefits**: [HVCI Compatible](https://blogs.msdn.microsoft.com/windows_hardware_certification/2015/05/22/driver-compatibility-with-device-guard-in-windows-10/) drivers help ensure that VBS can maintain appropriate memory permissions. This increases resistance to bypassing vulnerable kernel drivers and helps ensure that malware cannot run in kernel. Only code verified through code integrity can run in kernel mode. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT<br><br>**! Important*:*<br>Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.<br><br>**Security benefits**: Support for VBS and for management features that simplify configuration of Device Guard. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT<br><blockquote><p><strong>Important:</strong><br> Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.</p></blockquote><br>**Security benefits**: Support for VBS and for management features that simplify configuration of Device Guard. |
|
||||
|
||||
> **Important** The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Device Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Device Guard can provide.
|
||||
|
||||
|
||||
@ -2223,6 +2223,19 @@ Description of the error. </dt>
|
||||
<p>The support for your operating system has expired. Windows Defender is no longer supported on your operating system, has stopped functioning, and is not protecting against malware threats.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><th rowspan="3">Event ID: 2050</th><td><p>Symbolic name:</p></td><td colspan="2"><p><b>MALWAREPROTECTION_SAMPLESUBMISSION_UPLOAD</b></p></td></tr><tr><td><p>Message:</p></td><td colspan="2"><p><b>The antimalware engine has uploaded a file for further analysis.<br />Filename <uploaded filename><br />Sha256: <file SHA></b></p></td></tr><tr><td><p>Description:</p></td><td colspan="2"><p>A file was uploaded to the Windows Defender Antimalware cloud for further analysis or processing.</p></td></tr>
|
||||
|
||||
<tr><th rowspan="4">Event ID: 2051</th><td><p>Symbolic name:</p></td><td colspan="2"><p><b>MALWAREPROTECTION_SAMPLESUBMISSION_UPLOADED_FAILED</b></p></td></tr><tr><td><p>Message:</p></td><td colspan="2"><p><b>The antimalware engine has encountered an error trying to upload a suspicious file for further analysis.<br />
|
||||
Filename: <uploaded filename><br />
|
||||
Sha256: <file SHA><br />
|
||||
Current Signature Version: <signature version number><br/>
|
||||
Current Engine Version: <engine version number><br />
|
||||
Error code: <error code></b></p></td></tr><tr><td><p>Description:</p></td><td colspan="2"><p>A file could not be uploaded to the Windows Defender Antimalware cloud.</p></td></tr><tr><td><p>User action:</p></td><td colspan="2"><p>You can attempt to manually submit the file.</p></td></tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tr>
|
||||
<th rowspan="4">Event ID: 3002</th>
|
||||
<td>
|
||||
|
||||
@ -23,7 +23,6 @@ Because Outlook Web Access (OWA) can be used both personally and as part of your
|
||||
|-------|-------------|
|
||||
|Disable OWA. Employees can only use Microsoft Outlook 2016 or the Office 365 Mail app. | Disabled. |
|
||||
|Don't configure outlook.office.com in any of your networking settings. |All mailboxes are automatically marked as personal. This means employees attempting to copy work content into OWA receive prompts and that files downloaded from OWA aren't automatically protected as corporate data. |
|
||||
|Do all of the following:<ul><li>Create a domain (such as mail.contoso.com, redirecting to outlook.office.com) that can be used by your employees to access work email.</li><li>Add the new domain to the Enterprise Cloud Resources network element in your WIP policy.</li><li>Add the following URLs to the Neutral Resources network element in your WIP policy:<ul><li>outlook.office365.com</li><li>outlook.office.com</li><li>outlook-sdf.office.com</li><li>attachment.outlook.office.net</li></ul></li></ul> |Inbox content accessed through the new domain is automatically marked as corporate data, while content accessed through personal email is automatically marked as personal. |
|
||||
|Add outlook.office.com to the Enterprise Cloud Resources network element in your WIP policy. |All mailboxes are automatically marked as corporate. This means any personal inboxes hosted on Office 365 are also automatically marked as corporate data. |
|
||||
|
||||
>[!NOTE]
|
||||
|
||||
@ -93,3 +93,6 @@ Topic | Description
|
||||
[Troubleshoot Windows Defender Advanced Threat Protection](troubleshoot-windows-defender-advanced-threat-protection.md) | This topic contains information to help IT Pros find workarounds for the known issues and troubleshoot issues in Windows Defender ATP.
|
||||
[Review events and errors on endpoints with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md)| Review events and errors associated with event IDs to determine if further troubleshooting steps are required.
|
||||
[Windows Defender compatibility](defender-compatibility-windows-defender-advanced-threat-protection.md) | Learn about how Windows Defender works in conjunction with Windows Defender ATP.
|
||||
|
||||
## Related topic
|
||||
[Windows Defender ATP helps detect sophisticated threats](https://www.microsoft.com/itshowcase/Article/Content/854/Windows-Defender-ATP-helps-detect-sophisticated-threats)
|
||||
|
||||
@ -18,7 +18,7 @@ author: jasesso
|
||||
Windows Defender in Windows 10 is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers.
|
||||
This topic provides an overview of Windows Defender, including a list of system requirements and new features.
|
||||
|
||||
For more important information about running Windows Defender on a server platform, see [Windows Defender Overview for Windows Server Technical Preview](https://technet.microsoft.com/library/dn765478.aspx).
|
||||
For more important information about running Windows Defender on a server platform, see [Windows Defender Overview for Windows Server](https://technet.microsoft.com/windows-server-docs/security/windows-defender/windows-defender-overview-windows-server).
|
||||
|
||||
Take advantage of Windows Defender by configuring settings and definitions using the following tools:
|
||||
- Microsoft Active Directory *Group Policy* for settings
|
||||
|
||||
55
windows/keep-secure/wip-app-enterprise-context.md
Normal file
55
windows/keep-secure/wip-app-enterprise-context.md
Normal file
@ -0,0 +1,55 @@
|
||||
---
|
||||
title: Determine the Enterprise Context of an app running in Windows Information Protection (WIP) (Windows 10)
|
||||
description: Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP).
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Task Manager, app context, enterprise context
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
localizationpriority: high
|
||||
---
|
||||
|
||||
# Determine the Enterprise Context of an app running in Windows Information Protection (WIP)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607
|
||||
- Windows 10 Mobile
|
||||
|
||||
>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare).
|
||||
|
||||
Use Task Manager to check the context of your apps while running in Windows Information Protection (WIP) to make sure that your organization's policies are applied and running correctly.
|
||||
|
||||
## Viewing the Enterprise Context column in Task Manager
|
||||
You need to add the Enterprise Context column to the **Details** tab of the Task Manager.
|
||||
|
||||
1. Make sure that you have an active WIP policy deployed and turned on in your organization.
|
||||
|
||||
2. Open the Task Manager (taskmgr.exe), click the **Details** tab, right-click in the column heading area, and click **Select columns**.
|
||||
|
||||
The **Select columns** box appears.
|
||||
|
||||
|
||||
|
||||
3. Scroll down and check the **Enterprise Context** option, and then click **OK** to close the box.
|
||||
|
||||
The **Enterprise Context** column should now be available in Task Manager.
|
||||
|
||||
|
||||
|
||||
## Review the Enterprise Context
|
||||
The **Enterprise Context** column shows you what each app can do with your enterprise data:
|
||||
|
||||
- **Domain.** Shows the employee's work domain (such as, corp.contoso.com). This app is considered work-related and can freely touch and open work data and resources.
|
||||
|
||||
- **Personal.** Shows the text, *Personal*. This app is considered non-work-related and can't touch any work data or resources.
|
||||
|
||||
- **Exempt.** Shows the text, *Exempt*. WIP policies don't apply to these apps (such as, system components).
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Enlightened apps can change between Work and Personal, depending on the data being touched. For example, Microsoft Word 2016 shows as **Personal** when an employee opens a personal letter, but changes to **Work** when that same employee opens the company financials.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user