mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-18 00:07:23 +00:00
Merge pull request #4244 from MicrosoftDocs/intune-config-manager-docs-update
Intune config manager docs update
This commit is contained in:
Gary Moore
GitHub
commit
3baae7bdb0
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Enable cloud-delivered protection in Microsoft Defender Antivirus
|
||||
description: Enable cloud-delivered protection to benefit from fast and advanced protection features.
|
||||
title: Turn on cloud-delivered protection in Microsoft Defender Antivirus
|
||||
description: Turn on cloud-delivered protection to benefit from fast and advanced protection features.
|
||||
keywords: Microsoft Defender Antivirus, antimalware, security, cloud, block at first sight
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -9,16 +9,16 @@ ms.sitesec: library
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 11/13/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: nextgen
|
||||
---
|
||||
|
||||
# Enable cloud-delivered protection
|
||||
# Turn on cloud-delivered protection
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Microsoft Defender Antivirus
|
||||
@ -29,55 +29,60 @@ ms.custom: nextgen
|
||||
Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender for Endpoint next-generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/).
|
||||
|
||||
|
||||
You can enable or disable Microsoft Defender Antivirus cloud-delivered protection with Microsoft Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, or on individual clients in the Windows Security app.
|
||||
You can turn Microsoft Defender Antivirus cloud-delivered protection on or off in several ways:
|
||||
|
||||
- Microsoft Intune
|
||||
- Microsoft Endpoint Configuration Manager
|
||||
- Group Policy
|
||||
- PowerShell cmdlets.
|
||||
|
||||
You can also turn it on or off in individual clients with the Windows Security app.
|
||||
|
||||
See [Use Microsoft cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) for an overview of Microsoft Defender Antivirus cloud-delivered protection.
|
||||
|
||||
There are specific network-connectivity requirements to ensure your endpoints can connect to the cloud-delivered protection service. See [Configure and validate network connections](configure-network-connections-microsoft-defender-antivirus.md) for more details.
|
||||
For more information about the specific network-connectivity requirements to ensure your endpoints can connect to the cloud-delivered protection service, see [Configure and validate network connections](configure-network-connections-microsoft-defender-antivirus.md).
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, there is no difference between the **Basic** and **Advanced** reporting options described in this topic. This is a legacy distinction and choosing either setting will result in the same level of cloud-delivered protection. There is no difference in the type or amount of information that is shared. See the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=521839) for more information on what we collect.
|
||||
> In Windows 10, there is no difference between the **Basic** and **Advanced** reporting options described in this topic. This is a legacy distinction and choosing either setting will result in the same level of cloud-delivered protection. There is no difference in the type or amount of information that is shared. For more information on what we collect, see the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=521839).
|
||||
|
||||
## Use Intune to enable cloud-delivered protection
|
||||
## Use Intune to turn on cloud-delivered protection
|
||||
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com).
|
||||
2. Select **All services > Intune**.
|
||||
3. In the **Intune** pane, select **Device configuration > Profiles**, and then select the **Device restrictions** profile type you want to configure. If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure).
|
||||
4. Select **Properties**, select **Settings: Configure**, and then select **Microsoft Defender Antivirus**.
|
||||
1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in.
|
||||
2. On the **Home** pane, select **Device configuration > Profiles**.
|
||||
3. Select the **Device restrictions** profile type you want to configure. If you need to create a new **Device restrictions** profile type, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure).
|
||||
4. Select **Properties** > **Configuration settings: Edit** > **Microsoft Defender Antivirus**.
|
||||
5. On the **Cloud-delivered protection** switch, select **Enable**.
|
||||
6. In the **Prompt users before sample submission** dropdown, select **Send all data without prompting**.
|
||||
7. In the **Submit samples consent** dropdown, select one of the following:
|
||||
|
||||
- **Send safe samples automatically**
|
||||
- **Send all samples automatically**
|
||||
|
||||
>[!NOTE]
|
||||
> The **Send safe samples automatically** option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation.
|
||||
|
||||
> [!WARNING]
|
||||
> Setting to **Always Prompt** will lower the protection state of the device. Setting to **Never send** means the [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) feature of Microsoft Defender for Endpoint won't work.
|
||||
|
||||
8. Click **OK** to exit the **Microsoft Defender Antivirus** settings pane, click **OK** to exit the **Device restrictions** pane, and then click **Save** to save the changes to your **Device restrictions** profile.
|
||||
6. In the **Prompt users before sample submission** dropdown, select **Send all data automatically**.
|
||||
|
||||
For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/intune/device-profiles)
|
||||
|
||||
## Use Configuration Manager to enable cloud-delivered protection
|
||||
## Use Microsoft Endpoint Configuration Manager to turn on cloud-delivered protection
|
||||
|
||||
See [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) for details on configuring Microsoft Endpoint Configuration Manager (current branch).
|
||||
1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in.
|
||||
2. Choose **Endpoint security** > **Antivirus**.
|
||||
3. Select an antivirus profile. (If you don't have one yet, or if you want to create a new profile, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure).
|
||||
4. Select **Properties**. Then, next to **Configuration settings**, choose **Edit**.
|
||||
5. Expand **Cloud protection**, and then in the **Cloud-delivered protection level** list, select one of the following:
|
||||
1. **High**: Applies a strong level of detection.
|
||||
2. **High plus**: Uses the **High** level and applies additional protection measures (may impact client performance).
|
||||
3. **Zero tolerance**: Blocks all unknown executables.
|
||||
6. Select **Review + save**, then choose **Save**.
|
||||
|
||||
## Use Group Policy to enable cloud-delivered protection
|
||||
For more information about configuring Microsoft Endpoint Configuration Manager, see [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service).
|
||||
|
||||
1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
## Use Group Policy to turn on cloud-delivered protection
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration**.
|
||||
1. On your Group Policy management device, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**.
|
||||
|
||||
2. In the **Group Policy Management Editor**, go to **Computer configuration**.
|
||||
|
||||
3. Select **Administrative templates**.
|
||||
|
||||
4. Expand the tree to **Windows components > Microsoft Defender Antivirus > MAPS**
|
||||
|
||||
5. Double-click **Join Microsoft MAPS**. Ensure the option is enabled and set to **Basic MAPS** or **Advanced MAPS**. Select **OK**.
|
||||
5. Double-click **Join Microsoft MAPS**. Ensure the option is turned on and set to **Basic MAPS** or **Advanced MAPS**. Select **OK**.
|
||||
|
||||
6. Double-click **Send file samples when further analysis is required**. Ensure that the option is set to **Enabled** and that the other options are either of the following:
|
||||
6. Double-click **Send file samples when further analysis is required**. Ensure that the first option is set to **Enabled** and that the other options are set to either:
|
||||
|
||||
1. **Send safe samples** (1)
|
||||
2. **Send all samples** (3)
|
||||
@ -88,18 +93,18 @@ See [How to create and deploy antimalware policies: Cloud-protection service](ht
|
||||
> [!WARNING]
|
||||
> Setting the option to **Always Prompt** (0) will lower the protection state of the device. Setting it to **Never send** (2) means that the [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) feature of Microsoft Defender for Endpoint won't work.
|
||||
|
||||
7. Click **OK**.
|
||||
7. Select **OK**.
|
||||
|
||||
## Use PowerShell cmdlets to enable cloud-delivered protection
|
||||
## Use PowerShell cmdlets to turn on cloud-delivered protection
|
||||
|
||||
Use the following cmdlets to enable cloud-delivered protection:
|
||||
The following cmdlets can turn on cloud-delivered protection:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -MAPSReporting Advanced
|
||||
Set-MpPreference -SubmitSamplesConsent SendAllSamples
|
||||
```
|
||||
|
||||
See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Microsoft Defender Antivirus. [Policy CSP - Defender](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) also has more information specifically on [-SubmitSamplesConsent](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent).
|
||||
For more information on how to use PowerShell with Microsoft Defender Antivirus, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx). [Policy CSP - Defender](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) also has more information specifically on [-SubmitSamplesConsent](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent).
|
||||
|
||||
>[!NOTE]
|
||||
> You can also set **-SubmitSamplesConsent** to `SendSafeSamples` (the default setting), `NeverSend`, or `AlwaysPrompt`. The `SendSafeSamples` setting means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation.
|
||||
@ -107,7 +112,7 @@ See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](u
|
||||
>[!WARNING]
|
||||
> Setting **-SubmitSamplesConsent** to `NeverSend` or `AlwaysPrompt` will lower the protection level of the device. In addition, setting it to `NeverSend` means that the [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) feature of Microsoft Defender for Endpoint won't work.
|
||||
|
||||
## Use Windows Management Instruction (WMI) to enable cloud-delivered protection
|
||||
## Use Windows Management Instruction (WMI) to turn on cloud-delivered protection
|
||||
|
||||
Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn439474(v=vs.85).aspx) class for the following properties:
|
||||
|
||||
@ -116,33 +121,31 @@ MAPSReporting
|
||||
SubmitSamplesConsent
|
||||
```
|
||||
|
||||
See the following for more information and allowed parameters:
|
||||
For more information about allowed parameters, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx)
|
||||
|
||||
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx)
|
||||
|
||||
## Enable cloud-delivered protection on individual clients with the Windows Security app
|
||||
## Turn on cloud-delivered protection on individual clients with the Windows Security app
|
||||
|
||||
> [!NOTE]
|
||||
> If the **Configure local setting override for reporting Microsoft MAPS** Group Policy setting is set to **Disabled**, then the **Cloud-based protection** setting in Windows Settings will be greyed-out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings.
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
1. Open the Windows Security app by selecting the shield icon in the task bar, or by searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label:
|
||||
2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label:
|
||||
|
||||
|
||||
|
||||
3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**.
|
||||
|
||||
>[!NOTE]
|
||||
>If automatic sample submission has been configured with Group Policy then the setting will be greyed-out and unavailable.
|
||||
> [!NOTE]
|
||||
> If automatic sample submission has been configured with Group Policy then the setting will be greyed-out and unavailable.
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [Configure the cloud block timeout period](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md)
|
||||
- [Configure block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md)
|
||||
- [Use PowerShell cmdlets to manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md)
|
||||
- [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune)]
|
||||
- [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx)
|
||||
- [Utilize Microsoft cloud-delivered protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md)
|
||||
- [Use Microsoft cloud-delivered protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md)
|
||||
- [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service)
|
||||
- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 64 KiB |
@ -11,7 +11,7 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 09/03/2018
|
||||
ms.date: 11/13/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -20,14 +20,12 @@ manager: dansimp
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
You can run an on-demand scan on individual endpoints. These scans will start immediately, and you can define parameters for the scan, such as the location or type.
|
||||
|
||||
|
||||
## Quick scan versus full scan
|
||||
|
||||
Quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders.
|
||||
@ -35,34 +33,42 @@ Quick scan looks at all the locations where there could be malware registered to
|
||||
> [!IMPORTANT]
|
||||
> Microsoft Defender Antivirus runs in the context of the [LocalSystem](https://docs.microsoft.com/windows/win32/services/localsystem-account) account when performing a local scan. For network scans, it uses the context of the device account. If the domain device account doesn't have appropriate permissions to access the share, the scan won't work. Ensure that the device has permissions to the access network share.
|
||||
|
||||
Combined with [always-on real-time protection capability](configure-real-time-protection-microsoft-defender-antivirus.md)--which reviews files when they are opened and closed, and whenever a user navigates to a folder--a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware.
|
||||
Combined with [always-on real-time protection capability](configure-real-time-protection-microsoft-defender-antivirus.md)--which reviews files when they're opened and closed, and whenever a user navigates to a folder--a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware.
|
||||
|
||||
In most instances, this means a quick scan is adequate to find malware that wasn't picked up by real-time protection.
|
||||
In most instances, a quick scan is adequate to find malware that wasn't picked up by real-time protection.
|
||||
|
||||
A full scan can be useful on endpoints that have encountered a malware threat to identify if there are any inactive components that require a more thorough clean-up, and can be ideal when running on-demand scans.
|
||||
A full scan can be useful on endpoints that have reported a malware threat. The scan can identify if there are any inactive components that require a more thorough clean-up. This is ideal if your organization is running on-demand scans.
|
||||
|
||||
>[!NOTE]
|
||||
>By default, quick scans run on mounted removable devices, such as USB drives.
|
||||
> [!NOTE]
|
||||
> By default, quick scans run on mounted removable devices, such as USB drives.
|
||||
|
||||
## Use Configuration Manager to run a scan
|
||||
## Use Microsoft Endpoint Configuration Manager to run a scan
|
||||
|
||||
See [Antimalware and firewall tasks: How to perform an on-demand scan](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-firewall#how-to-perform-an-on-demand-scan-of-computers) for details on using Microsoft Endpoint Configuration Manager (current branch) to run a scan.
|
||||
1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in.
|
||||
2. Choose **Endpoint security** > **Antivirus**.
|
||||
3. In the list of tabs, select **Windows 10 unhealthy endpoints**.
|
||||
4. From the list of actions provided, select **Quick Scan** or **Full Scan**.
|
||||
|
||||
[  ](images/mem-antivirus-scan-on-demand.png#lightbox)
|
||||
|
||||
> [!TIP]
|
||||
> For more information about using Microsoft Endpoint Manager to run a scan, see [Antimalware and firewall tasks: How to perform an on-demand scan](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-firewall#how-to-perform-an-on-demand-scan-of-computers).
|
||||
|
||||
## Use the mpcmdrun.exe command-line utility to run a scan
|
||||
|
||||
Use the following `-scan` parameter:
|
||||
|
||||
```DOS
|
||||
```console
|
||||
mpcmdrun.exe -scan -scantype 1
|
||||
```
|
||||
See [Use the mpcmdrun.exe commandline tool to configure and manage Microsoft Defender Antivirus](command-line-arguments-microsoft-defender-antivirus.md) for more information on how to use the tool and additional parameters, including starting a full scan or defining paths.
|
||||
|
||||
For more information about how to use the tool and additional parameters, including starting a full scan, or defining paths, see [Use the mpcmdrun.exe commandline tool to configure and manage Microsoft Defender Antivirus](command-line-arguments-microsoft-defender-antivirus.md).
|
||||
|
||||
## Use Microsoft Intune to run a scan
|
||||
|
||||
1. In Intune, go to **Devices > All Devices** and select the device you want to scan.
|
||||
|
||||
2. Select **...More** and then select **Quick Scan** or **Full Scan**.
|
||||
|
||||
1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in.
|
||||
2. From the sidebar, select **Devices > All Devices** and choose the device you want to scan.
|
||||
3. Select **...More**. From the options, select **Quick Scan** or **Full Scan**.
|
||||
|
||||
## Use the Windows Security app to run a scan
|
||||
|
||||
@ -75,15 +81,14 @@ Use the following cmdlet:
|
||||
```PowerShell
|
||||
Start-MpScan
|
||||
```
|
||||
See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus.
|
||||
|
||||
For more information on how to use PowerShell with Microsoft Defender Antivirus, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index).
|
||||
|
||||
## Use Windows Management Instruction (WMI) to run a scan
|
||||
|
||||
Use the [**Start** method of the **MSFT_MpScan**](https://msdn.microsoft.com/library/dn455324(v=vs.85).aspx#methods) class.
|
||||
|
||||
See the following for more information and allowed parameters:
|
||||
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx)
|
||||
Use the [**Start** method](https://docs.microsoft.com/previous-versions/windows/desktop/defender/start-msft-mpscan) of the **MSFT_MpScan** class.
|
||||
|
||||
For more information about which parameters are allowed, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx)
|
||||
|
||||
## Related articles
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user