mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 22:07:22 +00:00
Merge branch 'master' into vulnerable-devices-report
This commit is contained in:
Beth Levin
commit
38e3e68b47
@ -1,5 +1,6 @@
|
||||
# [Mobile device management](index.md)
|
||||
## [What's new in MDM enrollment and management](new-in-windows-mdm-enrollment-management.md)
|
||||
### [Change history for MDM documentation](change-history-for-mdm-documentation.md)
|
||||
## [Mobile device enrollment](mobile-device-enrollment.md)
|
||||
### [MDM enrollment of Windows devices](mdm-enrollment-of-windows-devices.md)
|
||||
#### [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md)
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -248,10 +248,10 @@ Sample syncxml to provision the firewall settings to evaluate
|
||||
<p style="margin-left: 20px">Value type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
|
||||
<a href="" id="localaddressranges"></a>**FirewallRules/*FirewallRuleName*/LocalAddressRanges**
|
||||
<p style="margin-left: 20px">Comma separated list of local addresses covered by the rule. The default value is "<em>". Valid tokens include:</p>
|
||||
<p style="margin-left: 20px">Comma separated list of local addresses covered by the rule. The default value is "*". Valid tokens include:</p>
|
||||
<ul>
|
||||
<li>"</em>" indicates any local address. If present, this must be the only token included.</li>
|
||||
<li>A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.</li>
|
||||
<li>"*" indicates any local address. If present, this must be the only token included.</li>
|
||||
<li>A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask nor a network prefix is specified, the subnet mask defaults to 255.255.255.255.</li>
|
||||
<li>A valid IPv6 address.</li>
|
||||
<li>An IPv4 address range in the format of "start address - end address" with no spaces included.</li>
|
||||
<li>An IPv6 address range in the format of "start address - end address" with no spaces included.</li>
|
||||
@ -260,9 +260,9 @@ Sample syncxml to provision the firewall settings to evaluate
|
||||
<p style="margin-left: 20px">Value type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
|
||||
<a href="" id="remoteaddressranges"></a>**FirewallRules/*FirewallRuleName*/RemoteAddressRanges**
|
||||
<p style="margin-left: 20px">List of comma separated tokens specifying the remote addresses covered by the rule. The default value is "<em>". Valid tokens include:</p>
|
||||
<p style="margin-left: 20px">List of comma separated tokens specifying the remote addresses covered by the rule. The default value is "*". Valid tokens include:</p>
|
||||
<ul>
|
||||
<li>"</em>" indicates any remote address. If present, this must be the only token included.</li>
|
||||
<li>"*" indicates any remote address. If present, this must be the only token included.</li>
|
||||
<li>"Defaultgateway"</li>
|
||||
<li>"DHCP"</li>
|
||||
<li>"DNS"</li>
|
||||
|
||||
File diff suppressed because one or more lines are too long
@ -4006,7 +4006,13 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### LocalUsersAndGroups policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-localusersandgroups.md#localusersandgroups-configure" id="localusersandgroups-configure">LocalUsersAndGroups/Configure</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### LockDown policies
|
||||
|
||||
|
||||
@ -75,12 +75,12 @@ manager: dansimp
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in Windows 10, version 2010. This policy setting allows IT admins to add, remove, or replace members of local groups on a managed device.
|
||||
Available in Windows 10, version 20H2. This policy setting allows IT admins to add, remove, or replace members of local groups on a managed device.
|
||||
|
||||
> [!NOTE]
|
||||
> The [RestrictedGroups/ConfigureGroupMembership](./policy-csp-restrictedgroups.md#restrictedgroups-configuregroupmembership) policy setting also allows you to configure members (users or AAD groups) to a Windows 10 local group. However, it allows only for a full replace of the existing groups with the new members and does not allow selective add or remove.
|
||||
>
|
||||
> Starting from Windows 10, version 2010, it is recommended to use the LocalUsersandGroups policy instead of the RestrictedGroups policy. Applying both the policies to the same device is unsupported and may yield unpredictable results.
|
||||
> Starting from Windows 10, version 20H2, it is recommended to use the LocalUsersandGroups policy instead of the RestrictedGroups policy. Applying both the policies to the same device is unsupported and may yield unpredictable results.
|
||||
|
||||
Here's an example of the policy definition XML for group configuration:
|
||||
|
||||
@ -227,6 +227,6 @@ To troubleshoot Name/SID lookup APIs:
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 9 - Available in Windows 10, version 2010.
|
||||
- 9 - Available in Windows 10, version 20H2.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
@ -308,7 +308,7 @@ The following list shows the supported values:
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 9 - Available in the next major release of Windows 10.
|
||||
- 9 - Available in Windows 10, version 20H2.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
|
||||
@ -15,7 +15,7 @@ manager: dansimp
|
||||
# Policy CSP - RestrictedGroups
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Starting from Windows 10, version 2010, it is recommended to use the [LocalUsersandGroups](policy-csp-localusersandgroups.md) policy instead of the RestrictedGroups policy to configure members (users or AAD groups) to a Windows 10 local group. Applying both the policies to the same device is unsupported and may yield unpredictable results.
|
||||
> Starting from Windows 10, version 20H2, it is recommended to use the [LocalUsersandGroups](policy-csp-localusersandgroups.md) policy instead of the RestrictedGroups policy to configure members (users or AAD groups) to a Windows 10 local group. Applying both the policies to the same device is unsupported and may yield unpredictable results.
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
@ -556,6 +556,6 @@ Footnotes:
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
- 9 - Available in Windows 10, version 2010.
|
||||
- 9 - Available in Windows 10, version 20H2.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
@ -26,6 +26,7 @@ The features described below are no longer being actively developed, and might b
|
||||
|
||||
|Feature | Details and mitigation | Announced in version |
|
||||
| ----------- | --------------------- | ---- |
|
||||
| Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 |
|
||||
| Companion Device Framework | The [Companion Device Framework](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-companion-device-framework) is no longer under active development.| 2004 |
|
||||
| Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 |
|
||||
| Dynamic Disks | The [Dynamic Disks](https://docs.microsoft.com/windows/win32/fileio/basic-and-dynamic-disks#dynamic-disks) feature is no longer being developed. This feature will be fully replaced by [Storage Spaces](https://docs.microsoft.com/windows-server/storage/storage-spaces/overview) in a future release.| 2004 |
|
||||
@ -37,12 +38,13 @@ The features described below are no longer being actively developed, and might b
|
||||
| Wi-Fi WEP and TKIP | Since the 1903 release, a warning message has appeared when connecting to Wi-Fi networks secured with WEP or TKIP (which are not as secure as those using WPA2 or WPA3). In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3. | 1903 |
|
||||
| Windows To Go | Windows To Go is no longer being developed. <br><br>The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.| 1903 |
|
||||
| Print 3D app | Going forward, 3D Builder is the recommended 3D printing app. To 3D print objects on new Windows devices, customers must first install 3D Builder from the Store.| 1903 |
|
||||
|Companion device dynamic lock APIS|The companion device framework (CDF) APIs enable wearables and other devices to unlock a PC. In Windows 10, version 1709, we introduced [Dynamic Lock](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#dynamic-lock), including an inbox method using Bluetooth to detect whether a user is present and lock or unlock the PC. Because of this, and because third party partners didn't adopt the CDF method, we're no longer developing CDF Dynamic Lock APIs.| 1809 |
|
||||
|Companion device dynamic lock APIS|The companion device framework (CDF) APIs enable wearables and other devices to unlock a PC. In Windows 10, version 1709, we introduced [Dynamic Lock](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#dynamic-lock), including an inbox method using Bluetooth to detect whether a user is present and lock or unlock the PC. Because of this, and because non-Microsoft partners didn't adopt the CDF method, we're no longer developing CDF Dynamic Lock APIs.| 1809 |
|
||||
|OneSync service|The OneSync service synchronizes data for the Mail, Calendar, and People apps. We've added a sync engine to the Outlook app that provides the same synchronization.| 1809 |
|
||||
|Snipping Tool|The Snipping Tool is an application included in Windows 10 that is used to capture screenshots, either the full screen or a smaller, custom "snip" of the screen. In Windows 10, version 1809, we're [introducing a new universal app, Snip & Sketch](https://blogs.windows.com/windowsexperience/2018/05/03/announcing-windows-10-insider-preview-build-17661/#8xbvP8vMO0lF20AM.97), that provides the same screen snipping abilities, as well as additional features. You can launch Snip & Sketch directly and start a snip from there, or just press WIN + Shift + S. Snip & Sketch can also be launched from the “Screen snip” button in the Action Center. We're no longer developing the Snipping Tool as a separate app but are instead consolidating its functionality into Snip & Sketch.| 1809 |
|
||||
|[Software Restriction Policies](https://docs.microsoft.com/windows-server/identity/software-restriction-policies/software-restriction-policies) in Group Policy|Instead of using the Software Restriction Policies through Group Policy, you can use [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview) or [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control) to control which apps users can access and what code can run in the kernel.| 1803 |
|
||||
|[Offline symbol packages](https://docs.microsoft.com/windows-hardware/drivers/debugger/debugger-download-symbols) (Debug symbol MSIs)|We're no longer making the symbol packages available as a downloadable MSI. Instead, the [Microsoft Symbol Server is moving to be an Azure-based symbol store](https://blogs.msdn.microsoft.com/windbg/2017/10/18/update-on-microsofts-symbol-server/). If you need the Windows symbols, connect to the Microsoft Symbol Server to cache your symbols locally or use a manifest file with SymChk.exe on a computer with internet access.| 1803 |
|
||||
|Windows Help Viewer (WinHlp32.exe)|All Windows help information is [available online](https://support.microsoft.com/products/windows?os=windows-10). The Windows Help Viewer is no longer supported in Windows 10. If for any reason you see an error message about "help not supported," possibly when using a non-Microsoft application, read [this support article](https://support.microsoft.com/help/917607/error-opening-help-in-windows-based-programs-feature-not-included-or-h) for additional information and any next steps.| 1803 |
|
||||
|MBAE service metadata|The MBAE app experience is replaced by an MO UWP app. For more information, see [Developer guide for creating service metadata](https://docs.microsoft.com/windows-hardware/drivers/mobilebroadband/developer-guide-for-creating-service-metadata) | 1803 |
|
||||
|Contacts feature in File Explorer|We're no longer developing the Contacts feature or the corresponding [Windows Contacts API](https://msdn.microsoft.com/library/ff800913.aspx). Instead, you can use the People app in Windows 10 to maintain your contacts.| 1803 |
|
||||
|Phone Companion|Use the **Phone** page in the Settings app. In Windows 10, version 1709, we added the new **Phone** page to help you sync your mobile phone with your PC. It includes all the Phone Companion features.| 1803 |
|
||||
|IPv4/6 Transition Technologies (6to4, ISATAP, Teredo, and Direct Tunnels)|6to4 has been disabled by default since Windows 10, version 1607 (the Anniversary Update), ISATAP has been disabled by default since Windows 10, version 1703 (the Creators Update), Teredo has been disabled since Windows 10, version 1803, and Direct Tunnels has always been disabled by default. Please use native IPv6 support instead.| 1803 |
|
||||
|
||||
@ -27,6 +27,7 @@ The following features and functionalities have been removed from the installed
|
||||
|
||||
|Feature | Details and mitigation | Removed in version |
|
||||
| ----------- | --------------------- | ------ |
|
||||
|MBAE service metadata|The MBAE app experience is replaced by an MO UWP app. Metadata for the MBAE service is removed. | 20H2 |
|
||||
| Connect app | The **Connect** app for wireless projection using Miracast is no longer installed by default, but is available as an optional feature. To install the app, click on **Settings** > **Apps** > **Optional features** > **Add a feature** and then install the **Wireless Display** app. | 2004 |
|
||||
| Rinna and Japanese Address suggestion | The Rinna and Japanese Address suggestion service for Microsoft Japanese Input Method Editor (IME) ended on August 13th, 2020. For more information, see [Rinna and Japanese Address suggestion will no longer be offered](https://support.microsoft.com/help/4576767/windows-10-rinna-and-japanese-address-suggestion) | 2004 |
|
||||
| Cortana | Cortana has been updated and enhanced in the Windows 10 May 2020 Update. With [these changes](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-2004#cortana), some previously available consumer skills such as music, connected home, and other non-Microsoft skills are no longer available. | 2004 |
|
||||
|
||||
@ -18,7 +18,7 @@ ms.topic: article
|
||||
|
||||
**Applies to**: Windows 10
|
||||
|
||||
This topic explains how to acquire and apply Dynamic Update packages to existing Windows 10 images <em>prior to deployment</em> and includes Windows PowerShell scripts you can use to automate this process.
|
||||
This topic explains how to acquire and apply Dynamic Update packages to existing Windows 10 images *prior to deployment* and includes Windows PowerShell scripts you can use to automate this process.
|
||||
|
||||
Volume-licensed media is available for each release of Windows 10 in the Volume Licensing Service Center (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. You can use Dynamic Update to ensure that Windows 10 devices have the latest feature update packages as part of an in-place upgrade while preserving language pack and Features on Demand (FODs) that might have been previously installed. Dynamic Update also eliminates the need to install a separate quality update as part of the in-place upgrade process.
|
||||
|
||||
@ -42,8 +42,7 @@ You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https
|
||||
|
||||
|
||||
|
||||
The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the updates. And you'll need to check various parts of the results to be sure you've identified the needed files. This table shows in <em>bold</em> the key items to search for or look for in the results. For example, to find the relevant "Setup Dynamic Update," you'll have to check the detailed description for the download by selecting the link in the **Title** column of the search results.
|
||||
|
||||
The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the updates. And you'll need to check various parts of the results to be sure you've identified the needed files. This table shows in **bold** the key items to search for or look for in the results. For example, to find the relevant "Setup Dynamic Update," you'll have to check the detailed description for the download by selecting the link in the **Title** column of the search results.
|
||||
|
||||
|To find this Dynamic Update packages, search for or check the results here--> |Title |Product |Description (select the **Title** link to see **Details**) |
|
||||
|---------|---------|---------|---------|
|
||||
@ -94,8 +93,7 @@ Optional Components, along with the .NET feature, can be installed offline, howe
|
||||
|
||||
## Windows PowerShell scripts to apply Dynamic Updates to an existing image
|
||||
|
||||
These examples are for illustration only, and therefore lack error handling. The script assumes that the following packages is stored locally in this folder structure:
|
||||
|
||||
These examples are for illustration only, and therefore lack error handling. The script assumes that the following packages are stored locally in this folder structure:
|
||||
|
||||
|Folder |Description |
|
||||
|---------|---------|
|
||||
@ -108,18 +106,20 @@ These examples are for illustration only, and therefore lack error handling. The
|
||||
The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there is a script error and it's necessary to start over from a known state. Also, it will provide a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they are not read-only.
|
||||
|
||||
```powershell
|
||||
function Get-TS { return "{0:HH:mm:ss}" -f (Get-Date) }
|
||||
#Requires -RunAsAdministrator
|
||||
|
||||
Write-Host "$(Get-TS): Starting media refresh"
|
||||
function Get-TS { return "{0:HH:mm:ss}" -f [DateTime]::Now }
|
||||
|
||||
# Declare media for FOD and LPs
|
||||
$FOD_ISO_PATH = "C:\mediaRefresh\packages\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso"
|
||||
$LP_ISO_PATH = "C:\mediaRefresh\packages\CLIENTLANGPACKDVD_OEM_MULTI.iso"
|
||||
Write-Output "$(Get-TS): Starting media refresh"
|
||||
|
||||
# Declare language for showcasing adding optional localized components
|
||||
$LANG = "ja-jp"
|
||||
$LANG_FONT_CAPABILITY = "jpan"
|
||||
|
||||
# Declare media for FOD and LPs
|
||||
$FOD_ISO_PATH = "C:\mediaRefresh\packages\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso"
|
||||
$LP_ISO_PATH = "C:\mediaRefresh\packages\CLIENTLANGPACKDVD_OEM_MULTI.iso"
|
||||
|
||||
# Declare Dynamic Update packages
|
||||
$LCU_PATH = "C:\mediaRefresh\packages\LCU.msu"
|
||||
$SSU_PATH = "C:\mediaRefresh\packages\SSU_DU.msu"
|
||||
@ -128,29 +128,29 @@ $SAFE_OS_DU_PATH = "C:\mediaRefresh\packages\SafeOS_DU.cab"
|
||||
$DOTNET_CU_PATH = "C:\mediaRefresh\packages\DotNet_CU.msu"
|
||||
|
||||
# Declare folders for mounted images and temp files
|
||||
$WORKING_PATH = "C:\mediaRefresh\temp"
|
||||
$MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia"
|
||||
$MEDIA_NEW_PATH = "C:\mediaRefresh\newMedia"
|
||||
$MAIN_OS_MOUNT = $WORKING_PATH + "\MainOSMount"
|
||||
$WINRE_MOUNT = $WORKING_PATH + "\WinREMount"
|
||||
$WINPE_MOUNT = $WORKING_PATH + "\WinPEMount"
|
||||
$WORKING_PATH = "C:\mediaRefresh\temp"
|
||||
$MAIN_OS_MOUNT = "C:\mediaRefresh\temp\MainOSMount"
|
||||
$WINRE_MOUNT = "C:\mediaRefresh\temp\WinREMount"
|
||||
$WINPE_MOUNT = "C:\mediaRefresh\temp\WinPEMount"
|
||||
|
||||
# Mount the language pack ISO
|
||||
Write-Host "$(Get-TS): Mounting LP ISO"
|
||||
Write-Output "$(Get-TS): Mounting LP ISO"
|
||||
$LP_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter
|
||||
|
||||
# Declare language related cabs
|
||||
$WINPE_OC_PATH = Join-Path $LP_ISO_DRIVE_LETTER":" -ChildPath "Windows Preinstallation Environment" | Join-Path -ChildPath "x64" | Join-Path -ChildPath "WinPE_OCs"
|
||||
$WINPE_OC_LANG_PATH = Join-Path $WINPE_OC_PATH $LANG
|
||||
$WINPE_OC_LANG_CABS = Get-ChildItem $WINPE_OC_LANG_PATH -name
|
||||
$WINPE_OC_LP_PATH = Join-Path $WINPE_OC_LANG_PATH "lp.cab"
|
||||
$WINPE_FONT_SUPPORT_PATH = Join-Path $WINPE_OC_PATH "WinPE-FontSupport-$LANG.cab"
|
||||
$WINPE_SPEECH_TTS_PATH = Join-Path $WINPE_OC_PATH "WinPE-Speech-TTS.cab"
|
||||
$WINPE_SPEECH_TTS_LANG_PATH = Join-Path $WINPE_OC_PATH "WinPE-Speech-TTS-$LANG.cab"
|
||||
$OS_LP_PATH = $LP_ISO_DRIVE_LETTER + ":\x64\langpacks\" + "Microsoft-Windows-Client-Language-Pack_x64_" + $LANG + ".cab"
|
||||
$WINPE_OC_PATH = "$LP_ISO_DRIVE_LETTER`:\Windows Preinstallation Environment\x64\WinPE_OCs"
|
||||
$WINPE_OC_LANG_PATH = "$WINPE_OC_PATH\$LANG"
|
||||
$WINPE_OC_LANG_CABS = Get-ChildItem $WINPE_OC_LANG_PATH -Name
|
||||
$WINPE_OC_LP_PATH = "$WINPE_OC_LANG_PATH\lp.cab"
|
||||
$WINPE_FONT_SUPPORT_PATH = "$WINPE_OC_PATH\WinPE-FontSupport-$LANG.cab"
|
||||
$WINPE_SPEECH_TTS_PATH = "$WINPE_OC_PATH\WinPE-Speech-TTS.cab"
|
||||
$WINPE_SPEECH_TTS_LANG_PATH = "$WINPE_OC_PATH\WinPE-Speech-TTS-$LANG.cab"
|
||||
$OS_LP_PATH = "$LP_ISO_DRIVE_LETTER`:\x64\langpacks\Microsoft-Windows-Client-Language-Pack_x64_$LANG.cab"
|
||||
|
||||
# Mount the Features on Demand ISO
|
||||
Write-Host "$(Get-TS): Mounting FOD ISO"
|
||||
Write-Output "$(Get-TS): Mounting FOD ISO"
|
||||
$FOD_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter
|
||||
$FOD_PATH = $FOD_ISO_DRIVE_LETTER + ":\"
|
||||
|
||||
@ -161,10 +161,11 @@ New-Item -ItemType directory -Path $WINRE_MOUNT -ErrorAction stop | Out-Null
|
||||
New-Item -ItemType directory -Path $WINPE_MOUNT -ErrorAction stop | Out-Null
|
||||
|
||||
# Keep the original media, make a copy of it for the new, updated media.
|
||||
Write-Host "$(Get-TS): Copying original media to new media path"
|
||||
Write-Output "$(Get-TS): Copying original media to new media path"
|
||||
Copy-Item -Path $MEDIA_OLD_PATH"\*" -Destination $MEDIA_NEW_PATH -Force -Recurse -ErrorAction stop | Out-Null
|
||||
Get-ChildItem -Path $MEDIA_NEW_PATH -Recurse | Where-Object { -not $_.PSIsContainer -and $_.IsReadOnly } | ForEach-Object { $_.IsReadOnly = $false }
|
||||
```
|
||||
|
||||
### Update WinRE
|
||||
|
||||
The script assumes that only a single edition is being updated, indicated by Index = 1 (Windows 10 Education Edition). Then the script mounts the image, saves Winre.wim to the working folder, and mounts it. It then applies servicing stack Dynamic Update, since its components are used for updating other components. Since the script is optionally adding Japanese, it adds the language pack to the image, and installs the Japanese versions of all optional packages already installed in Winre.wim. Then, it applies the Safe OS Dynamic Update package.
|
||||
@ -176,25 +177,25 @@ It finishes by cleaning and exporting the image to reduce the image size.
|
||||
|
||||
```powershell
|
||||
# Mount the main operating system, used throughout the script
|
||||
Write-Host "$(Get-TS): Mounting main OS"
|
||||
Write-Output "$(Get-TS): Mounting main OS"
|
||||
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim" -Index 1 -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null
|
||||
|
||||
#
|
||||
# update Windows Recovery Environment (WinRE)
|
||||
#
|
||||
Copy-Item -Path $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim" -Destination $WORKING_PATH"\winre.wim" -Force -Recurse -ErrorAction stop | Out-Null
|
||||
Write-Host "$(Get-TS): Mounting WinRE"
|
||||
Write-Output "$(Get-TS): Mounting WinRE"
|
||||
Mount-WindowsImage -ImagePath $WORKING_PATH"\winre.wim" -Index 1 -Path $WINRE_MOUNT -ErrorAction stop | Out-Null
|
||||
|
||||
# Add servicing stack update
|
||||
Write-Host "$(Get-TS): Adding package $SSU_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $SSU_PATH"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
#
|
||||
# Optional: Add the language to recovery environment
|
||||
#
|
||||
# Install lp.cab cab
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_OC_LP_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Install language cabs for each optional package installed
|
||||
@ -210,7 +211,7 @@ Foreach ($PACKAGE in $WINRE_INSTALLED_OC) {
|
||||
$OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab"
|
||||
if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) {
|
||||
$OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB
|
||||
Write-Host "$(Get-TS): Adding package $OC_CAB_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $OC_CAB_PATH"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
}
|
||||
@ -219,7 +220,7 @@ Foreach ($PACKAGE in $WINRE_INSTALLED_OC) {
|
||||
|
||||
# Add font support for the new language
|
||||
if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) {
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
|
||||
@ -227,30 +228,31 @@ if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) {
|
||||
if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) {
|
||||
if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) {
|
||||
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
}
|
||||
|
||||
# Add Safe OS
|
||||
Write-Host "$(Get-TS): Adding package $SAFE_OS_DU_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $SAFE_OS_DU_PATH"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SAFE_OS_DU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Perform image cleanup
|
||||
Write-Host "$(Get-TS): Performing image cleanup on WinRE"
|
||||
Write-Output "$(Get-TS): Performing image cleanup on WinRE"
|
||||
DISM /image:$WINRE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null
|
||||
|
||||
# Dismount
|
||||
Dismount-WindowsImage -Path $WINRE_MOUNT -Save -ErrorAction stop | Out-Null
|
||||
|
||||
# Export
|
||||
Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\winre2.wim"
|
||||
Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\winre2.wim"
|
||||
Export-WindowsImage -SourceImagePath $WORKING_PATH"\winre.wim" -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\winre2.wim" -ErrorAction stop | Out-Null
|
||||
Move-Item -Path $WORKING_PATH"\winre2.wim" -Destination $WORKING_PATH"\winre.wim" -Force -ErrorAction stop | Out-Null
|
||||
```
|
||||
|
||||
### Update WinPE
|
||||
|
||||
This script is similar to the one that updates WinRE, but instead it mounts Boot.wim, applies the packages with the latest cumulative update last, and saves. It repeats this for all images inside of Boot.wim, typically two images. It starts by applying the servicing stack Dynamic Update. Since the script is customizing this media with Japanese, it installs the language pack from the WinPE folder on the language pack ISO. Additionally, add font support and text to speech (TTS) support. Since the script is adding a new language, it rebuilds lang.ini, used to identify languages installed in the image. Finally, it cleans and exports Boot.wim, and copies it back to the new media.
|
||||
@ -266,15 +268,15 @@ $WINPE_IMAGES = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim"
|
||||
Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
|
||||
# update WinPE
|
||||
Write-Host "$(Get-TS): Mounting WinPE"
|
||||
Write-Output "$(Get-TS): Mounting WinPE"
|
||||
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null
|
||||
|
||||
# Add SSU
|
||||
Write-Host "$(Get-TS): Adding package $SSU_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $SSU_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Install lp.cab cab
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_OC_LP_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Install language cabs for each optional package installed
|
||||
@ -291,7 +293,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
$OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab"
|
||||
if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) {
|
||||
$OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB
|
||||
Write-Host "$(Get-TS): Adding package $OC_CAB_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $OC_CAB_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
}
|
||||
@ -300,7 +302,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
|
||||
# Add font support for the new language
|
||||
if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) {
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
|
||||
@ -308,39 +310,40 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) {
|
||||
if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) {
|
||||
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
}
|
||||
|
||||
# Generates a new Lang.ini file which is used to define the language packs inside the image
|
||||
if ( (Test-Path -Path $WINPE_MOUNT"\sources\lang.ini") ) {
|
||||
Write-Host "$(Get-TS): Updating lang.ini"
|
||||
Write-Output "$(Get-TS): Updating lang.ini"
|
||||
DISM /image:$WINPE_MOUNT /Gen-LangINI /distribution:$WINPE_MOUNT | Out-Null
|
||||
}
|
||||
|
||||
# Add latest cumulative update
|
||||
Write-Host "$(Get-TS): Adding package $LCU_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $LCU_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Perform image cleanup
|
||||
Write-Host "$(Get-TS): Performing image cleanup on WinPE"
|
||||
Write-Output "$(Get-TS): Performing image cleanup on WinPE"
|
||||
DISM /image:$WINPE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null
|
||||
|
||||
# Dismount
|
||||
Dismount-WindowsImage -Path $WINPE_MOUNT -Save -ErrorAction stop | Out-Null
|
||||
|
||||
#Export WinPE
|
||||
Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\boot2.wim"
|
||||
Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\boot2.wim"
|
||||
Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -SourceIndex $IMAGE.ImageIndex -DestinationImagePath $WORKING_PATH"\boot2.wim" -ErrorAction stop | Out-Null
|
||||
|
||||
}
|
||||
|
||||
Move-Item -Path $WORKING_PATH"\boot2.wim" -Destination $MEDIA_NEW_PATH"\sources\boot.wim" -Force -ErrorAction stop | Out-Null
|
||||
```
|
||||
|
||||
### Update the main operating system
|
||||
|
||||
For this next phase, there is no need to mount the main operating system, since it was already mounted in the previous scripts. This script starts by applying the servicing stack Dynamic Update. Then, it adds Japanese language support and then the Japanese language features. Unlike the Dynamic Update packages, it leverages `Add-WindowsCapability` to add these features. For a full list of such features, and their associated capability name, see [Available Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod).
|
||||
@ -355,36 +358,36 @@ You can install Optional Components, along with the .NET feature, offline, but t
|
||||
#
|
||||
|
||||
# Add servicing stack update
|
||||
Write-Host "$(Get-TS): Adding package $SSU_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $SSU_PATH"
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Optional: Add language to main OS
|
||||
Write-Host "$(Get-TS): Adding package $OS_LP_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $OS_LP_PATH"
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $OS_LP_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Optional: Add a Features on Demand to the image
|
||||
Write-Host "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0"
|
||||
Add-WindowsCapability -Name "Language.Fonts.$LANG_FONT_CAPABILITY~~~und-$LANG_FONT_CAPABILITY~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Host "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0"
|
||||
Add-WindowsCapability -Name "Language.Basic~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Host "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0"
|
||||
Add-WindowsCapability -Name "Language.OCR~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Host "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0"
|
||||
Add-WindowsCapability -Name "Language.Handwriting~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Host "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0"
|
||||
Add-WindowsCapability -Name "Language.TextToSpeech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Host "$(Get-TS): Adding language FOD:Language.Speech~~~$LANG~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD:Language.Speech~~~$LANG~0.0.1.0"
|
||||
Add-WindowsCapability -Name "Language.Speech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Note: If I wanted to enable additional Features on Demand, I'd add these here.
|
||||
|
||||
# Add latest cumulative update
|
||||
Write-Host "$(Get-TS): Adding package $LCU_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $LCU_PATH"
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Copy our updated recovery image from earlier into the main OS
|
||||
@ -393,7 +396,7 @@ Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop
|
||||
Copy-Item -Path $WORKING_PATH"\winre.wim" -Destination $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim" -Force -Recurse -ErrorAction stop | Out-Null
|
||||
|
||||
# Perform image cleanup
|
||||
Write-Host "$(Get-TS): Performing image cleanup on main OS"
|
||||
Write-Output "$(Get-TS): Performing image cleanup on main OS"
|
||||
DISM /image:$MAIN_OS_MOUNT /cleanup-image /StartComponentCleanup | Out-Null
|
||||
|
||||
#
|
||||
@ -402,18 +405,18 @@ DISM /image:$MAIN_OS_MOUNT /cleanup-image /StartComponentCleanup | Out-Null
|
||||
# the image to be booted, and thus if we tried to cleanup after installation, it would fail.
|
||||
#
|
||||
|
||||
Write-Host "$(Get-TS): Adding NetFX3~~~~"
|
||||
Write-Output "$(Get-TS): Adding NetFX3~~~~"
|
||||
Add-WindowsCapability -Name "NetFX3~~~~" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Add .NET Cumulative Update
|
||||
Write-Host "$(Get-TS): Adding package $DOTNET_CU_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $DOTNET_CU_PATH"
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $DOTNET_CU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Dismount
|
||||
Dismount-WindowsImage -Path $MAIN_OS_MOUNT -Save -ErrorAction stop | Out-Null
|
||||
|
||||
# Export
|
||||
Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\install2.wim"
|
||||
Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\install2.wim"
|
||||
Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\install.wim" -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\install2.wim" -ErrorAction stop | Out-Null
|
||||
Move-Item -Path $WORKING_PATH"\install2.wim" -Destination $MEDIA_NEW_PATH"\sources\install.wim" -Force -ErrorAction stop | Out-Null
|
||||
```
|
||||
@ -428,9 +431,10 @@ This part of the script updates the Setup files. It simply copies the individual
|
||||
#
|
||||
|
||||
# Add Setup DU by copy the files from the package into the newMedia
|
||||
Write-Host "$(Get-TS): Adding package $SETUP_DU_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $SETUP_DU_PATH"
|
||||
cmd.exe /c $env:SystemRoot\System32\expand.exe $SETUP_DU_PATH -F:* $MEDIA_NEW_PATH"\sources" | Out-Null
|
||||
```
|
||||
|
||||
### Finish up
|
||||
|
||||
As a last step, the script removes the working folder of temporary files, and unmounts our language pack and Features on Demand ISOs.
|
||||
@ -444,9 +448,9 @@ As a last step, the script removes the working folder of temporary files, and un
|
||||
Remove-Item -Path $WORKING_PATH -Recurse -Force -ErrorAction stop | Out-Null
|
||||
|
||||
# Dismount ISO images
|
||||
Write-Host "$(Get-TS): Dismounting ISO images"
|
||||
Write-Output "$(Get-TS): Dismounting ISO images"
|
||||
Dismount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Out-Null
|
||||
Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Host "$(Get-TS): Media refresh completed!"
|
||||
Write-Output "$(Get-TS): Media refresh completed!"
|
||||
```
|
||||
|
||||
@ -28,6 +28,8 @@ Servicing stack updates provide fixes to the servicing stack, the component that
|
||||
|
||||
Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.
|
||||
|
||||
For information about some changes to servicing stack updates, see [Simplifing Deployment of Servicing Stack Updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039) on the Windows IT Pro blog.
|
||||
|
||||
## When are they released?
|
||||
|
||||
Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical."
|
||||
|
||||
@ -21,6 +21,7 @@
|
||||
"_op_documentIdPathDepotMapping": {
|
||||
"./": {
|
||||
"depot_name": "Win.windows"
|
||||
}
|
||||
},
|
||||
"contributors_to_exclude": [
|
||||
"rjagiewich",
|
||||
|
||||
@ -13,7 +13,7 @@ metadata:
|
||||
ms.collection: windows-10
|
||||
author: greg-lindsay #Required; your GitHub user alias, with correct capitalization.
|
||||
ms.author: greglin #Required; microsoft alias of author; optional team alias.
|
||||
ms.date: 09/23/2020 #Required; mm/dd/yyyy format.
|
||||
ms.date: 10/20/2020 #Required; mm/dd/yyyy format.
|
||||
localization_priority: medium
|
||||
|
||||
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new
|
||||
@ -26,12 +26,12 @@ landingContent:
|
||||
linkLists:
|
||||
- linkListType: overview
|
||||
links:
|
||||
- text: What's new in Windows 10, version 20H2
|
||||
url: /windows/whats-new/whats-new-windows-10-version-20H2
|
||||
- text: What's new in Windows 10, version 2004
|
||||
url: /windows/whats-new/whats-new-windows-10-version-2004
|
||||
- text: What's new in Windows 10, version 1909
|
||||
url: /windows/whats-new/whats-new-windows-10-version-1909
|
||||
- text: What's new in Windows 10, version 1903
|
||||
url: /windows/whats-new/whats-new-windows-10-version-1903
|
||||
- text: Windows 10 release information
|
||||
url: https://docs.microsoft.com/windows/release-information/
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -1,6 +1,6 @@
|
||||
---
|
||||
description: Use this article to learn more about what required Windows diagnostic data is gathered.
|
||||
title: Windows 10, version 2004 required diagnostic events and fields (Windows 10)
|
||||
title: Windows 10, version 20H2 and Windows 10, version 2004 required diagnostic events and fields (Windows 10)
|
||||
keywords: privacy, telemetry
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
@ -13,11 +13,11 @@ manager: dansimp
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
audience: ITPro
|
||||
ms.date: 08/31/2020
|
||||
ms.date: 09/30/2020
|
||||
---
|
||||
|
||||
|
||||
# Windows 10, version 2004 required Windows diagnostic events and fields
|
||||
# Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic events and fields
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
@ -26,6 +26,7 @@ ms.date: 08/31/2020
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, version 20H2
|
||||
- Windows 10, version 2004
|
||||
|
||||
|
||||
@ -37,7 +38,6 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
||||
|
||||
You can learn more about Windows functional and diagnostic data through these articles:
|
||||
|
||||
|
||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||
- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
|
||||
@ -1166,14 +1166,6 @@ The following fields are available:
|
||||
- **PrefetchWSupport** Does the processor support PrefetchW?
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWEndSync
|
||||
|
||||
Deprecated in RS3. This event indicates that a full set of SystemProcessorPrefetchWAdd events has been sent. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync
|
||||
|
||||
This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date.
|
||||
@ -1257,14 +1249,6 @@ The following fields are available:
|
||||
- **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemWimEndSync
|
||||
|
||||
Deprecated in RS3. This event indicates that a full set of SystemWimAdd events has been sent. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemWimStartSync
|
||||
|
||||
This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date.
|
||||
@ -1411,7 +1395,7 @@ The following fields are available:
|
||||
|
||||
### MicArrayGeometry
|
||||
|
||||
This event provides information about the layout of the individual microphone elements in the microphone array.
|
||||
This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -2005,7 +1989,6 @@ The following fields are available:
|
||||
- **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp).
|
||||
- **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer).
|
||||
- **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice).
|
||||
- **ext_m365a** Describes the Microsoft 365-related fields. See [Common Data Extensions.m365a](#common-data-extensionsm365a).
|
||||
- **ext_mscv** Describes the correlation vector-related fields. See [Common Data Extensions.mscv](#common-data-extensionsmscv).
|
||||
- **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos).
|
||||
- **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk).
|
||||
@ -2017,14 +2000,6 @@ The following fields are available:
|
||||
- **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format.
|
||||
- **ver** Represents the major and minor version of the extension.
|
||||
|
||||
### Common Data Extensions.m365a
|
||||
|
||||
Describes the Microsoft 365-related fields.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **enrolledTenantId** The enrolled tenant ID.
|
||||
- **msp** A bitmask that lists the active programs.
|
||||
|
||||
### Common Data Extensions.mscv
|
||||
|
||||
@ -2123,7 +2098,7 @@ The following fields are available:
|
||||
- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts.
|
||||
- **xid** A list of base10-encoded XBOX User IDs.
|
||||
|
||||
## Common Data Fields
|
||||
## Common data fields
|
||||
|
||||
### Ms.Device.DeviceInventoryChange
|
||||
|
||||
@ -2135,7 +2110,6 @@ The following fields are available:
|
||||
- **inventoryId** Device ID used for Compatibility testing
|
||||
- **objectInstanceId** Object identity which is unique within the device scope.
|
||||
- **objectType** Indicates the object type that the event applies to.
|
||||
- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object.
|
||||
|
||||
## Component-based servicing events
|
||||
|
||||
@ -3167,6 +3141,7 @@ The following fields are available:
|
||||
- **Categories** A comma separated list of functional categories in which the container belongs.
|
||||
- **DiscoveryMethod** The discovery method for the device container.
|
||||
- **FriendlyName** The name of the device container.
|
||||
- **Icon** Deprecated in RS3. The path or index to the icon file.
|
||||
- **InventoryVersion** The version of the inventory file generating the events.
|
||||
- **IsActive** Is the device connected, or has it been seen in the last 14 days?
|
||||
- **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link.
|
||||
@ -3851,6 +3826,14 @@ The following fields are available:
|
||||
- **IndicatorValue** The indicator value.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove
|
||||
|
||||
This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync
|
||||
|
||||
This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly.
|
||||
@ -4378,32 +4361,6 @@ The following fields are available:
|
||||
- **totalRuns** Total number of running/evaluation from last time.
|
||||
|
||||
|
||||
## Windows Admin Center events
|
||||
|
||||
### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus
|
||||
|
||||
A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID.
|
||||
- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID.
|
||||
- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS.
|
||||
- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory.
|
||||
- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory.
|
||||
- **friendlyOsName** A user-friendly name describing the OS version.
|
||||
- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS.
|
||||
- **gatewayVersion** The version string for this currently running Gateway application.
|
||||
- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process.
|
||||
- **installationType** Identifies if the gateway was installed as a VM extension.
|
||||
- **installedDate** The date on which this gateway was installed.
|
||||
- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has.
|
||||
- **otherProperties** This is an empty string, but may be used for another purpose in the future.
|
||||
- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID.
|
||||
- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID..
|
||||
- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway.
|
||||
|
||||
|
||||
## Privacy consent logging events
|
||||
|
||||
### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted
|
||||
@ -5238,6 +5195,18 @@ The following fields are available:
|
||||
- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU.
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsCachedNotificationRetrieved
|
||||
|
||||
This event is sent when a notification is received. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CV** A correlation vector.
|
||||
- **GlobalEventCounter** This is a client side counter that indicates ordering of events sent by the user.
|
||||
- **PackageVersion** The package version of the label.
|
||||
- **UpdateHealthToolsBlobNotificationNotEmpty** A boolean that is true if the blob notification has valid content.
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded
|
||||
|
||||
This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
@ -5308,6 +5277,24 @@ The following fields are available:
|
||||
- **UpdateHealthToolsPushCurrentStep** The current step for the push notification
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails
|
||||
|
||||
The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CV** A correlation vector.
|
||||
- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user.
|
||||
- **PackageVersion** The package version of the label.
|
||||
- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file.
|
||||
- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer.
|
||||
- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash.
|
||||
- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer.
|
||||
- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash.
|
||||
- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id.
|
||||
- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id.
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin
|
||||
|
||||
This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
@ -5319,6 +5306,17 @@ The following fields are available:
|
||||
- **PackageVersion** Current package version of UpdateHealthTools.
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin
|
||||
|
||||
This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CV** A correlation vector.
|
||||
- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user.
|
||||
- **PackageVersion** The package version of the label.
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted
|
||||
|
||||
This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
@ -5955,6 +5953,32 @@ The following fields are available:
|
||||
- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
|
||||
|
||||
|
||||
## Windows Admin Center events
|
||||
|
||||
### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus
|
||||
|
||||
A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID.
|
||||
- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID.
|
||||
- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS.
|
||||
- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory.
|
||||
- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory.
|
||||
- **friendlyOsName** A user-friendly name describing the OS version.
|
||||
- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS.
|
||||
- **gatewayVersion** The version string for this currently running Gateway application.
|
||||
- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process.
|
||||
- **installationType** Identifies if the gateway was installed as a VM extension.
|
||||
- **installedDate** The date on which this gateway was installed.
|
||||
- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has.
|
||||
- **otherProperties** This is an empty string, but may be used for another purpose in the future.
|
||||
- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID.
|
||||
- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID.
|
||||
- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway.
|
||||
|
||||
|
||||
## Windows as a Service diagnostic events
|
||||
|
||||
### Microsoft.Windows.WaaSMedic.DetectionFailed
|
||||
@ -6929,29 +6953,6 @@ The following fields are available:
|
||||
- **updateId** ID of the update that is getting installed with this restart.
|
||||
- **wuDeviceid** Unique device ID used by Windows Update.
|
||||
|
||||
### wilActivity
|
||||
|
||||
This event provides a Windows Internal Library context used for Product and Service diagnostics.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **callContext** The function where the failure occurred.
|
||||
- **currentContextId** The ID of the current call context where the failure occurred.
|
||||
- **currentContextMessage** The message of the current call context where the failure occurred.
|
||||
- **currentContextName** The name of the current call context where the failure occurred.
|
||||
- **failureCount** The number of failures for this failure ID.
|
||||
- **failureId** The ID of the failure that occurred.
|
||||
- **failureType** The type of the failure that occurred.
|
||||
- **fileName** The file name where the failure occurred.
|
||||
- **function** The function where the failure occurred.
|
||||
- **hresult** The HResult of the overall activity.
|
||||
- **lineNumber** The line number where the failure occurred.
|
||||
- **message** The message of the failure that occurred.
|
||||
- **module** The module where the failure occurred.
|
||||
- **originatingContextId** The ID of the originating call context that resulted in the failure.
|
||||
- **originatingContextMessage** The message of the originating call context that resulted in the failure.
|
||||
- **originatingContextName** The name of the originating call context that resulted in the failure.
|
||||
- **threadId** The ID of the thread on which the activity is executing.
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.ActivityError
|
||||
|
||||
@ -7358,6 +7359,29 @@ The following fields are available:
|
||||
- **UpdateId** Unique ID for each Update.
|
||||
- **WuId** Unique ID for the Windows Update client.
|
||||
|
||||
### wilActivity
|
||||
|
||||
This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **callContext** The function where the failure occurred.
|
||||
- **currentContextId** The ID of the current call context where the failure occurred.
|
||||
- **currentContextMessage** The message of the current call context where the failure occurred.
|
||||
- **currentContextName** The name of the current call context where the failure occurred.
|
||||
- **failureCount** The number of failures for this failure ID.
|
||||
- **failureId** The ID of the failure that occurred.
|
||||
- **failureType** The type of the failure that occurred.
|
||||
- **fileName** The file name where the failure occurred.
|
||||
- **function** The function where the failure occurred.
|
||||
- **hresult** The HResult of the overall activity.
|
||||
- **lineNumber** The line number where the failure occurred.
|
||||
- **message** The message of the failure that occurred.
|
||||
- **module** The module where the failure occurred.
|
||||
- **originatingContextId** The ID of the originating call context that resulted in the failure.
|
||||
- **originatingContextMessage** The message of the originating call context that resulted in the failure.
|
||||
- **originatingContextName** The name of the originating call context that resulted in the failure.
|
||||
- **threadId** The ID of the thread on which the activity is executing.
|
||||
|
||||
## Windows Update Reserve Manager events
|
||||
|
||||
@ -7532,8 +7556,6 @@ The following fields are available:
|
||||
|
||||
This event signals the completion of the setup process. It happens only once during the first logon.
|
||||
|
||||
|
||||
|
||||
## XDE events
|
||||
|
||||
### Microsoft.Emulator.Xde.RunTime.SystemReady
|
||||
@ -7584,3 +7606,6 @@ The following fields are available:
|
||||
- **virtualMachineName** VM name.
|
||||
- **waitForClientConnection** True if we should wait for client connection.
|
||||
- **wp81NetworkStackDisabled** WP 8.1 networking stack disabled.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -15,9 +15,9 @@
|
||||
href: Microsoft-DiagnosticDataViewer.md
|
||||
- name: Required Windows diagnostic data events and fields
|
||||
items:
|
||||
- name: Windows 10, version 2004 required Windows diagnostic data events and fields
|
||||
- name: Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic data events and fields
|
||||
href: required-windows-diagnostic-data-events-and-fields-2004.md
|
||||
- name: Windows 10, version 1903 and Windows 10, version 1909 required level Windows diagnostic events and fields
|
||||
- name: Windows 10, version 1909 and Windows 10, version 1903 required level Windows diagnostic events and fields
|
||||
href: basic-level-windows-diagnostic-events-and-fields-1903.md
|
||||
- name: Windows 10, version 1809 required Windows diagnostic events and fields
|
||||
href: basic-level-windows-diagnostic-events-and-fields-1809.md
|
||||
|
||||
@ -12,20 +12,21 @@ ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 12/04/2019
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Windows 10, version 1709 and newer optional diagnostic data
|
||||
|
||||
Applies to:
|
||||
- Windows 10, version 20H2
|
||||
- Windows 10, version 2004
|
||||
- Windows 10, version 1909
|
||||
- Windows 10, version 1903
|
||||
- Windows 10, version 1809
|
||||
- Windows 10, version 1803
|
||||
- Windows 10, version 1709
|
||||
|
||||
Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 2004 required diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields).
|
||||
Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 20H2 required diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields).
|
||||
|
||||
In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology -- Cloud computing -- Cloud services and devices: Data flow, data categories and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard.
|
||||
|
||||
|
||||
@ -49,18 +49,27 @@
|
||||
#### [PowerShell, WMI, and MPCmdRun.exe](microsoft-defender-atp/manage-atp-post-migration-other-tools.md)
|
||||
|
||||
## [Security administration]()
|
||||
### [Threat & Vulnerability Management]()
|
||||
#### [Overview of Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
|
||||
#### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md)
|
||||
#### [Dashboard insights](microsoft-defender-atp/tvm-dashboard-insights.md)
|
||||
#### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md)
|
||||
#### [Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md)
|
||||
#### [Security recommendations](microsoft-defender-atp/tvm-security-recommendation.md)
|
||||
#### [Remediation and exception](microsoft-defender-atp/tvm-remediation.md)
|
||||
#### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md)
|
||||
#### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md)
|
||||
#### [Event timeline](microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md)
|
||||
#### [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md)
|
||||
### [Threat & vulnerability management]()
|
||||
#### [Overview](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
|
||||
#### [Get started]()
|
||||
##### [Permissions & prerequisites](microsoft-defender-atp/tvm-prerequisites.md)
|
||||
##### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md)
|
||||
##### [Assign device value](microsoft-defender-atp/tvm-assign-device-value.md)
|
||||
#### [Assess your security posture]()
|
||||
##### [Dashboard insights](microsoft-defender-atp/tvm-dashboard-insights.md)
|
||||
##### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md)
|
||||
##### [Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md)
|
||||
#### [Improve your security posture & reduce risk]()
|
||||
##### [Address security recommendations](microsoft-defender-atp/tvm-security-recommendation.md)
|
||||
##### [Remediate vulnerabilities](microsoft-defender-atp/tvm-remediation.md)
|
||||
##### [Exceptions for security recommendations](microsoft-defender-atp/tvm-exception.md)
|
||||
##### [Plan for end-of-support software](microsoft-defender-atp/tvm-end-of-support-software.md)
|
||||
#### [Understand vulnerabilities on your devices]()
|
||||
##### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md)
|
||||
##### [Vulnerabilities in my organization](microsoft-defender-atp/tvm-weaknesses.md)
|
||||
##### [Event timeline](microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md)
|
||||
##### [Hunt for exposed devices](microsoft-defender-atp/tvm-hunt-exposed-devices.md)
|
||||
|
||||
|
||||
### [Attack surface reduction]()
|
||||
#### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md)
|
||||
|
||||
@ -17,7 +17,7 @@ ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Threat Protection
|
||||
[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Microsoft Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture.
|
||||
[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Microsoft Defender ATP protects endpoints from cyber threats, detects advanced attacks and data breaches, automates security incidents, and improves security posture.
|
||||
|
||||
> [!TIP]
|
||||
> Enable your users to access cloud services and on-premises applications with ease and enable modern management capabilities for all devices. For more information, see [Secure your remote workforce](https://docs.microsoft.com/enterprise-mobility-security/remote-work/).
|
||||
@ -25,12 +25,12 @@ ms.topic: conceptual
|
||||
<center><h2>Microsoft Defender ATP</center></h2>
|
||||
<table>
|
||||
<tr>
|
||||
<td><a href="#tvm"><center><img src="images/TVM_icon.png"> <br><b>Threat & Vulnerability Management</b></center></a></td>
|
||||
<td><a href="#asr"><center><img src="images/asr-icon.png"> <br><b>Attack surface reduction</b></center></a></td>
|
||||
<td><center><a href="#ngp"><img src="images/ngp-icon.png"><br> <b>Next-generation protection</b></a></center></td>
|
||||
<td><center><a href="#edr"><img src="images/edr-icon.png"><br> <b>Endpoint detection and response</b></a></center></td>
|
||||
<td><center><a href="#ai"><img src="images/air-icon.png"><br> <b>Automated investigation and remediation</b></a></center></td>
|
||||
<td><center><a href="#mte"><img src="images/mte-icon.png"><br> <b>Microsoft Threat Experts</b></a></center></td>
|
||||
<td><a href="#tvm"><center><img src="images/TVM_icon.png" alt="threat and vulnerability icon"> <br><b>Threat & vulnerability management</b></center></a></td>
|
||||
<td><a href="#asr"><center><img src="images/asr-icon.png" alt="attack surface reduction icon"> <br><b>Attack surface reduction</b></center></a></td>
|
||||
<td><center><a href="#ngp"><img src="images/ngp-icon.png" alt="next generation protection icon"><br> <b>Next-generation protection</b></a></center></td>
|
||||
<td><center><a href="#edr"><img src="images/edr-icon.png" alt="endpoint detection and response icon"><br> <b>Endpoint detection and response</b></a></center></td>
|
||||
<td><center><a href="#ai"><img src="images/air-icon.png" alt="automated investigation and remediation icon"><br> <b>Automated investigation and remediation</b></a></center></td>
|
||||
<td><center><a href="#mte"><img src="images/mte-icon.png" alt="microsoft threat experts icon"><br> <b>Microsoft Threat Experts</b></a></center></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="7">
|
||||
@ -47,19 +47,14 @@ ms.topic: conceptual
|
||||
|
||||
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4obJq]
|
||||
|
||||
**[Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)**<br>
|
||||
**[Threat & vulnerability management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)**<br>
|
||||
This built-in capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.
|
||||
|
||||
- [Risk-based Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
|
||||
- [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md)
|
||||
- [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md)
|
||||
- [Exposure score](microsoft-defender-atp/tvm-exposure-score.md)
|
||||
- [Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md)
|
||||
- [Security recommendations](microsoft-defender-atp/tvm-security-recommendation.md)
|
||||
- [Remediation](microsoft-defender-atp/tvm-remediation.md)
|
||||
- [Software inventory](microsoft-defender-atp/tvm-software-inventory.md)
|
||||
- [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md)
|
||||
- [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md)
|
||||
- [Threat & vulnerability management overview](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
|
||||
- [Get started](microsoft-defender-atp/tvm-prerequisites.md)
|
||||
- [Access your security posture](microsoft-defender-atp/tvm-dashboard-insights.md)
|
||||
- [Improve your security posture and reduce risk](microsoft-defender-atp/tvm-security-recommendation.md)
|
||||
- [Understand vulnerabilities on your devices](microsoft-defender-atp/tvm-software-inventory.md)
|
||||
|
||||
<a name="asr"></a>
|
||||
|
||||
@ -103,25 +98,16 @@ Endpoint detection and response capabilities are put in place to detect, investi
|
||||
<a name="ai"></a>
|
||||
|
||||
**[Automated investigation and remediation](microsoft-defender-atp/automated-investigations.md)**<br>
|
||||
In conjunction with being able to quickly respond to advanced attacks, Microsoft Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
|
||||
In addition to quickly responding to advanced attacks, Microsoft Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
|
||||
|
||||
- [Automated investigation and remediation](microsoft-defender-atp/automated-investigations.md)
|
||||
- [View details and results of automated investigations](microsoft-defender-atp/auto-investigation-action-center.md)
|
||||
- [View and approve remediation actions](microsoft-defender-atp/manage-auto-investigation.md)
|
||||
|
||||
<a name="ss"></a>
|
||||
|
||||
**[Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md)**<br>
|
||||
|
||||
Microsoft Defender ATP includes a Microsoft Secure Score for Devices to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security of your organization.
|
||||
|
||||
- [Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md)
|
||||
- [Threat analytics](microsoft-defender-atp/threat-analytics.md)
|
||||
|
||||
<a name="mte"></a>
|
||||
|
||||
**[Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md)**<br>
|
||||
Microsoft Defender ATP's new managed threat hunting service provides proactive hunting, prioritization and additional context and insights that further empower Security Operation Centers (SOCs) to identify and respond to threats quickly and accurately.
|
||||
Microsoft Defender ATP's new managed threat hunting service provides proactive hunting, prioritization, and additional context and insights. Microsoft Threat Experts further empowers Security Operation Centers (SOCs) to identify and respond to threats quickly and accurately.
|
||||
|
||||
- [Targeted attack notification](microsoft-defender-atp/microsoft-threat-experts.md)
|
||||
- [Experts-on-demand](microsoft-defender-atp/microsoft-threat-experts.md)
|
||||
@ -149,4 +135,4 @@ Integrate Microsoft Defender Advanced Threat Protection into your existing workf
|
||||
|
||||
<a name="mtp"></a>
|
||||
**[Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection)**<br>
|
||||
With Microsoft Threat Protection, Microsoft Defender ATP and various Microsoft security solutions form a unified pre- and post-breach enterprise defense suite that natively integrates across endpoint, identity, email, and applications to detect, prevent, investigate and automatically respond to sophisticated attacks.
|
||||
With Microsoft Threat Protection, Microsoft Defender ATP and various Microsoft security solutions form a unified pre- and post-breach enterprise defense suite that natively integrates across endpoint, identity, email, and applications to detect, prevent, investigate, and automatically respond to sophisticated attacks.
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 09/20/2020
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
Use the `AssignedIPAddresses()` function in your advanced hunting queries to quickly obtain the latest IP addresses that have been assigned to a device. If you specify a timestamp argument, this function obtains the most recent IP addresses at the specified time.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.date: 01/22/2020
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.date: 01/14/2020
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 10/10/2020
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
[Advanced hunting](advanced-hunting-overview.md) relies on data coming from across your organization. To get the most comprehensive data possible, ensure that you have the correct settings in the corresponding data sources.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/20/2020
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
The `FileProfile()` function is an enrichment function in [advanced hunting](advanced-hunting-overview.md) that adds the following data to files found by the query.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: article
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
With the *go hunt* action, you can quickly investigate events and various entity types using powerful query-based [advanced hunting](advanced-hunting-overview.md) capabilities. This action automatically runs an advanced hunting query to find relevant information about the selected event or entity.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: article
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 01/14/2020
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: article
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ ms.date: 09/20/2020
|
||||
# Take action on advanced hunting query results
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.date: 03/27/2020
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-alertsq-abovefoldlink)
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.topic: conceptual
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
The Microsoft Defender ATP API Explorer is a tool that helps you explore various Microsoft Defender ATP APIs interactively.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink)
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: conceptual
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.date: 11/28/2018
|
||||
**Applies to:**
|
||||
- Azure Active Directory
|
||||
- Office 365
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.date: 11/20/2018
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.custom: asr
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
## Is attack surface reduction (ASR) part of Windows?
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 10/08/2020
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
Your attack surface is the total number of places where an attacker could compromise your organization's devices or networks. Reducing your attack surface means offering attackers fewer ways to perform attacks.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ manager: dansimp
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
You can enable attack surface reduction rules, exploit protection, network protection, and controlled folder access in audit mode. Audit mode lets you see a record of what *would* have happened if you had enabled the feature.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
|
||||
- Azure Active Directory
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-basicaccess-abovefoldlink)
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@ ms.collection:
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
## Overview
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 04/24/2018
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-checksensor-abovefoldlink)
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@ ms.collection:
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
## Overview
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: conceptual
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for US Government Community Cloud High (GCC High) customers, built in the US Azure Government environment, uses the same underlying technologies as Microsoft Defender ATP in Azure Commercial.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.date: 04/24/2018
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: article
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@ ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs
|
||||
|
||||
**Applies to**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
If your organization is using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/) (Microsoft Defender ATP), [automated investigation and remediation capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) can save your security operations team time and effort. As outlined in [this blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/enhance-your-soc-with-microsoft-defender-atp-automatic/ba-p/848946), these capabilities mimic the ideal steps that a security analyst takes to investigate and remediate threats. [Learn more about automated investigation and remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations).
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
This section guides you through all the steps you need to take to properly implement Conditional Access.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: article
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-emailconfig-abovefoldlink)
|
||||
|
||||
@ -27,7 +27,7 @@ ms.date: 04/24/2018
|
||||
|
||||
- Group Policy
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.topic: article
|
||||
|
||||
- macOS
|
||||
- Linux
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-nonwindows-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.date: 02/07/2020
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- Microsoft Endpoint Configuration Manager current branch
|
||||
- System Center 2012 R2 Configuration Manager
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.topic: conceptual
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Endpoint data loss prevention (DLP)](/microsoft-365/compliance/endpoint-dlp-learn-about)
|
||||
|
||||
Devices in your organization must be configured so that the Microsoft Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the devices in your organization.
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink).
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: article
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: article
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: conceptual
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
## Before you begin
|
||||
> [!NOTE]
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink)
|
||||
|
||||
|
||||
@ -30,7 +30,7 @@ ms.topic: article
|
||||
- Windows Server (SAC) version 1803 and later
|
||||
- Windows Server 2019 and later
|
||||
- Windows Server 2019 core edition
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: conceptual
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
|
||||
Connected applications integrates with the Microsoft Defender ATP platform using APIs.
|
||||
|
||||
@ -24,7 +24,7 @@ ms.custom: asr
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
## What is controlled folder access?
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user