mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 07:17:24 +00:00
Merge pull request #3568 from MicrosoftDocs/master
Publish 8/18/2020 10:30 AM PT
This commit is contained in:
Tina Burden
GitHub
commit
3c311adc6f
@ -1,161 +1,93 @@
|
||||
### YamlMime:YamlDocument
|
||||
### YamlMime:Landing
|
||||
|
||||
documentType: LandingData
|
||||
|
||||
title: Microsoft Edge Legacy Group Policy configuration options
|
||||
title: Microsoft Edge Group Legacy Policy configuration options # < 60 chars
|
||||
summary: Learn how to deploy and configure group policies in Microsoft Edge Legacy on Windows 10. Some of the features coming to Microsoft Edge Legacy gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. # < 160 chars
|
||||
|
||||
metadata:
|
||||
|
||||
title: Microsoft Edge Group Legacy Policy configuration options
|
||||
|
||||
description:
|
||||
|
||||
text: (Note - You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).) Learn how to deploy and configure group policies in Microsoft Edge Legacy on Windows 10. Some of the features coming to Microsoft Edge Legacy gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar.
|
||||
|
||||
title: Microsoft Edge Group Legacy Policy configuration options # Required; page title displayed in search results. Include the brand. < 60 chars.
|
||||
description: Learn about interoperability goals and enterprise guidance along with system requirements, language support and frequently asked questions. # Required; article description that is displayed in search results. < 160 chars.
|
||||
ms.prod: microsoft-edge
|
||||
keywords: Microsoft Edge Legacy, Windows 10
|
||||
|
||||
ms.localizationpriority: medium
|
||||
|
||||
author: shortpatti
|
||||
|
||||
ms.author: pashort
|
||||
|
||||
ms.date: 08/09/2018
|
||||
|
||||
ms.topic: article
|
||||
|
||||
ms.devlang: na
|
||||
|
||||
sections:
|
||||
|
||||
- title:
|
||||
|
||||
- items:
|
||||
|
||||
- type: markdown
|
||||
|
||||
text: (Note - You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).) Learn about interoperability goals and enterprise guidance along with system requirements, language support and frequently asked questions.<p>IMPORTANT - The Microsoft Edge Legacy desktop app will reach end of support on March 9, 2021 in favor of the new Microsoft Edge. This means that Microsoft Edge Legacy will not receive security updates after that date. This change is applicable to all experiences that run in the Microsoft Edge Legacy desktop app. [Learn more](https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666)
|
||||
|
||||
- items:
|
||||
|
||||
- type: list
|
||||
|
||||
style: cards
|
||||
|
||||
className: cardsE
|
||||
|
||||
columns: 3
|
||||
|
||||
items:
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/change-history-for-microsoft-edge
|
||||
|
||||
html: <p>Learn more about the latest group policies and features added to Microsoft Edge.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_whats-new.svg
|
||||
|
||||
title: What's new
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/about-microsoft-edge
|
||||
|
||||
html: <p>Learn about the system requirements and language support for Microsoft Edge.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_overview.svg
|
||||
|
||||
title: System requirements and supported languages
|
||||
|
||||
- href: https://www.microsoft.com/en-us/WindowsForBusiness/Compare
|
||||
|
||||
html: <p>Learn about the supported features & functionality in each Windows edition.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_config-tools.svg
|
||||
|
||||
title: Compare Windows 10 Editions
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/security-privacy-management-gp
|
||||
|
||||
html: <p>Learn how Microsoft Edge helps to defend from increasingly sophisticated and prevalent web-based attacks against Windows.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_security-management.svg
|
||||
|
||||
title: Security & protection
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp
|
||||
|
||||
html: <p>Learn how you can use the Enterprise Mode site list for websites and apps that have compatibility problems in Microsoft Edge.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_management.svg
|
||||
|
||||
title: Interoperability & enterprise guidance
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/index
|
||||
|
||||
html: <p>Learn about the advanced VPN features you can add to improve the security and availability of your VPN connection.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_policy.svg
|
||||
|
||||
title: Group policies & configuration options
|
||||
|
||||
- items:
|
||||
|
||||
- type: list
|
||||
|
||||
style: cards
|
||||
|
||||
className: cardsL
|
||||
|
||||
items:
|
||||
|
||||
- title: Microsoft Edge resources
|
||||
|
||||
html: <p><a class="barLink" href="https://docs.microsoft.com/microsoft-edge/deploy/about-microsoft-edge#minimum-system-requirements">Minimum system requirements</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://docs.microsoft.com/microsoft-edge/deploy/about-microsoft-edge#supported-languages">Supported languages</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://docs.microsoft.com/microsoft-edge/deploy/change-history-for-microsoft-edge">Document change history</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://www.microsoft.com/en-us/WindowsForBusiness/Compare">Compare Windows 10 Editions</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://blogs.windows.com/msedgedev">Microsoft Edge Dev blog</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://twitter.com/MSEdgeDev">Microsoft Edge Dev on Twitter</a></p>
|
||||
|
||||
<p><a class="barLink" href="hhttps://developer.microsoft.com/microsoft-edge/platform/changelog/">Microsoft Edge changelog</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://www.microsoft.com/itpro/microsoft-edge/technical-benefits">Measuring the impact of Microsoft Edge</a></p>
|
||||
|
||||
- title: IE11 resources
|
||||
|
||||
html: <p><a class="barLink" href="https://go.microsoft.com/fwlink/p/?LinkId=760644">Deploy Internet Explorer 11 (IE11) - IT Pros</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://go.microsoft.com/fwlink/p/?LinkId=760646">Internet Explorer Administration Kit 11 (IEAK 11)</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://go.microsoft.com/fwlink/p/?linkid=290956">Download Internet Explorer 11</a></p>
|
||||
|
||||
- title: Additional resources
|
||||
|
||||
html: <p><a class="barLink" href="https://go.microsoft.com/fwlink/p/?LinkId=617921">Group Policy and the Group Policy Management Console (GPMC)</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://go.microsoft.com/fwlink/p/?LinkId=617922">Group Policy and the Local Group Policy Editor</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://go.microsoft.com/fwlink/p/?LinkId=617923">Group Policy and the Advanced Group Policy Management (AGPM)</a></p>
|
||||
|
||||
<p><a class="barLink" href="https://go.microsoft.com/fwlink/p/?LinkId=617924">Group Policy and Windows PowerShell</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
ms.topic: landing-page # Required
|
||||
ms.collection: collection # Optional; Remove if no collection is used.
|
||||
author: shortpatti #Required; your GitHub user alias, with correct capitalization.
|
||||
ms.author: pashort #Required; microsoft alias of author; optional team alias.
|
||||
ms.date: 07/07/2020 #Required; mm/dd/yyyy format.
|
||||
|
||||
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new
|
||||
|
||||
landingContent:
|
||||
# Cards and links should be based on top customer tasks or top subjects
|
||||
# Start card title with a verb
|
||||
# Card (optional)
|
||||
- title: About Microsoft Edge
|
||||
linkLists:
|
||||
- linkListType: whats-new
|
||||
links:
|
||||
- text: Documentation for Microsoft Edge version 77 or later
|
||||
url: /DeployEdge
|
||||
- text: Microsoft 365 apps say farewell to Internet Explorer 11 and Windows 10 sunsets Microsoft Edge Legacy
|
||||
url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666
|
||||
- text: Latest group policies and features added to Microsoft Edge
|
||||
url: /microsoft-edge/deploy/change-history-for-microsoft-edge
|
||||
- linkListType: overview
|
||||
links:
|
||||
- text: System requirements and supported languages
|
||||
url: /microsoft-edge/deploy/about-microsoft-edge
|
||||
- text: Compare Windows 10 editions
|
||||
url: https://www.microsoft.com/en-us/WindowsForBusiness/Compare
|
||||
- text: Security & protection
|
||||
url: /microsoft-edge/deploy/group-policies/security-privacy-management-gp
|
||||
- text: Interoperability & enterprise guidance
|
||||
url: /microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp
|
||||
- text: Group policies & configuration options
|
||||
url: /microsoft-edge/deploy/group-policies/
|
||||
|
||||
# Card (optional)
|
||||
- title: Microsoft Edge resources
|
||||
linkLists:
|
||||
- linkListType: overview
|
||||
links:
|
||||
- text: Minimum system requirements
|
||||
url: /microsoft-edge/deploy/about-microsoft-edge#minimum-system-requirements
|
||||
- text: Supported languages
|
||||
url: /microsoft-edge/deploy/about-microsoft-edge#supported-languages
|
||||
- text: Document change history
|
||||
url: /microsoft-edge/deploy/change-history-for-microsoft-edge
|
||||
- text: Microsoft Edge Dev blog
|
||||
url: https://blogs.windows.com/msedgedev
|
||||
- text: Microsoft Edge Dev on Twitter
|
||||
url: /microsoft-edge/deploy/about-microsoft-edge#supported-languages
|
||||
- text: Microsoft Edge changelog
|
||||
url: /microsoft-edge/deploy/change-history-for-microsoft-edge
|
||||
- text: Measuring the impact of Microsoft Edge
|
||||
url: https://blogs.windows.com/msedgedev
|
||||
|
||||
# Card (optional)
|
||||
- title: IE11 resources
|
||||
linkLists:
|
||||
- linkListType: overview
|
||||
links:
|
||||
- text: Deploy Internet Explorer 11 (IE11) - IT Pros
|
||||
url: https://go.microsoft.com/fwlink/p/?LinkId=760644
|
||||
- text: Internet Explorer Administration Kit 11 (IEAK 11)
|
||||
url: /internet-explorer/ie11-ieak
|
||||
- linkListType: download
|
||||
links:
|
||||
- text: Download Internet Explorer 11
|
||||
url: https://go.microsoft.com/fwlink/p/?linkid=290956
|
||||
|
||||
# Card (optional)
|
||||
- title: Additional resources
|
||||
linkLists:
|
||||
- linkListType: overview
|
||||
links:
|
||||
- text: Group Policy and the Group Policy Management Console (GPMC)
|
||||
url: https://go.microsoft.com/fwlink/p/?LinkId=617921
|
||||
- text: Group Policy and the Local Group Policy Editor
|
||||
url: https://go.microsoft.com/fwlink/p/?LinkId=617922
|
||||
- text: Group Policy and the Advanced Group Policy Management (AGPM)
|
||||
url: https://go.microsoft.com/fwlink/p/?LinkId=617923
|
||||
- text: Group Policy and Windows PowerShell
|
||||
url: https://go.microsoft.com/fwlink/p/?LinkId=617924
|
||||
|
||||
@ -17,7 +17,8 @@ ms.date: 06/26/2017
|
||||
|
||||
The Registry configuration service provider is used to update registry settings. However, if there is configuration service provider that is specific to the settings that need to be updated, use the specific configuration service provider.
|
||||
|
||||
> **Note** The Registry CSP is only supported in Windows 10 Mobile for OEM configuration. Do not use this CSP for enterprise remote management.
|
||||
> [!NOTE]
|
||||
> The Registry CSP is only supported in Windows 10 Mobile for OEM configuration. Do not use this CSP for enterprise remote management.
|
||||
For Windows 10 Mobile only, this configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_CSP\_OEM capabilities to be accessed from a network configuration application.
|
||||
|
||||
|
||||
@ -32,13 +33,12 @@ For OMA Client Provisioning, the follows notes apply:
|
||||
|
||||
- This documentation describes the default characteristics. Additional characteristics may be added.
|
||||
|
||||
- Because the **Registry** configuration service provider uses the backslash (\) character as a separator between key names, backslashes which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\).
|
||||
- Because the **Registry** configuration service provider uses the backslash (\\) character as a separator between key names, backslashes which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\\).
|
||||
|
||||
The default security role maps to each subnode unless specific permission is granted to the subnode. The security role for subnodes is implementation specific, and can be changed by OEMs and mobile operators.
|
||||
|
||||
## Microsoft Custom Elements
|
||||
|
||||
|
||||
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
|
||||
|
||||
<table>
|
||||
@ -75,11 +75,10 @@ The following table shows the Microsoft custom elements that this configuration
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
Use these elements to build standard OMA Client Provisioning configuration XML. For information about specific elements, see MSPROV DTD elements.
|
||||
|
||||
## Supported Data Types
|
||||
|
||||
## Supported Data Types
|
||||
|
||||
The following table shows the data types this configuration service provider supports.
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ ms.author: v-hakima
|
||||
manager: obezeajo
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 7/22/2020
|
||||
ms.date: 08/18/2020
|
||||
---
|
||||
# Windows 10, version 1909, connection endpoints for non-Enterprise editions
|
||||
|
||||
@ -83,6 +83,7 @@ The following methodology was used to derive the network endpoints:
|
||||
|*.blob.core.windows.net|HTTP/TLS v1.2|Windows Telemetry
|
||||
|storage.live.com|HTTP/TLS v1.2|OneDrive
|
||||
|skydrivesync.policies.live.net|TLS v1.2|OneDrive
|
||||
|dm2302.settings.live.net|HTTP|OneDrive
|
||||
|slscr.update.microsoft.com|HTTPS/TLS V1.2|Windows Update
|
||||
|tile-service.weather.microsoft.com|HTTP|Used for the Weather app
|
||||
|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTP|This endpoint is used for content regulation
|
||||
@ -98,7 +99,7 @@ The following methodology was used to derive the network endpoints:
|
||||
| **Destination** | **Protocol** | **Description** |
|
||||
| --- | --- | --- |
|
||||
|*.prod.do.dsp.mp.microsoft.com|HTTP/TLS v1.2|Windows Update
|
||||
|api.onedrive.com|HTTP|One Drive
|
||||
|api.onedrive.com|HTTP|OneDrive
|
||||
|smartscreen-prod.microsoft.com|HTTP|Used for Windows Defender SmartScreen reporting and notifications
|
||||
|nav.smartscreen.microsoft.com|HTTPS/TLS v1.2|Windows Defender
|
||||
|*.update.microsoft.com|HTTP|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store
|
||||
@ -151,8 +152,9 @@ The following methodology was used to derive the network endpoints:
|
||||
|www.bing.com|HTTPS/TLS v1.2|Cortana and Live Tiles
|
||||
|www.msftconnecttest.com|HTTP|Network Connection Status Indicator (NCSI)
|
||||
|outlook.office365.com|HTTP|Microsoft Office
|
||||
|storage.live.com|HTTP/TLS v1.2|One Drive
|
||||
|skydrivesync.policies.live.net|TLS v1.2|One Drive
|
||||
|storage.live.com|HTTP/TLS v1.2|OneDrive
|
||||
|skydrivesync.policies.live.net|TLS v1.2|OneDrive
|
||||
|windows.policies.live.net|HTTP|OneDrive
|
||||
|
||||
## Windows 10 Education
|
||||
|
||||
@ -166,7 +168,7 @@ The following methodology was used to derive the network endpoints:
|
||||
|dmd.metaservices.microsoft.com|HTTP|Device metadata
|
||||
|Inference.location.live.net|TLS v1.2|Location
|
||||
|oneclient.sfx.ms|HTTPS|OneDrive
|
||||
|storage.live.com|HTTP/TLS v1.2|One Drive
|
||||
|storage.live.com|HTTP/TLS v1.2|OneDrive
|
||||
|skydrivesync.policies.live.net|TLS v1.2|OneDrive
|
||||
|slscr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update
|
||||
|fe2cr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update
|
||||
|
||||
@ -27,7 +27,7 @@ ms.custom:
|
||||
|
||||
|
||||
## Enable Windows Defender Credential Guard
|
||||
Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy), the [registry](#enable-windows-defender-credential-guard-by-using-the-registry), or the Hypervisor-Protected Code Integrity (HVCI) and Windows Defender Credential Guard [hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine.
|
||||
Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy), the [registry](#enable-windows-defender-credential-guard-by-using-the-registry), or the Hypervisor-Protected Code Integrity (HVCI) and Windows Defender Credential Guard [hardware readiness tool](dg-readiness-tool.md). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine.
|
||||
The same set of procedures used to enable Windows Defender Credential Guard on physical machines applies also to virtual machines.
|
||||
|
||||
|
||||
@ -36,9 +36,13 @@ The same set of procedures used to enable Windows Defender Credential Guard on p
|
||||
You can use Group Policy to enable Windows Defender Credential Guard. This will add and enable the virtualization-based security features for you if needed.
|
||||
|
||||
1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard**.
|
||||
|
||||
2. Double-click **Turn On Virtualization Based Security**, and then click the **Enabled** option.
|
||||
|
||||
3. In the **Select Platform Security Level** box, choose **Secure Boot** or **Secure Boot and DMA Protection**.
|
||||
|
||||
4. In the **Credential Guard Configuration** box, click **Enabled with UEFI lock**, and then click **OK**. If you want to be able to turn off Windows Defender Credential Guard remotely, choose **Enabled without lock**.
|
||||
|
||||
5. In the **Secure Launch Configuration** box, choose **Not Configured**, **Enabled** or **Disabled**. Check [this article](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) for more details.
|
||||
|
||||
|
||||
@ -49,8 +53,10 @@ To enforce processing of the group policy, you can run ```gpupdate /force```.
|
||||
|
||||
### Enable Windows Defender Credential Guard by using Intune
|
||||
|
||||
1. From **Home** click **Microsoft Intune**
|
||||
2. Click **Device configuration**
|
||||
1. From **Home**, click **Microsoft Intune**.
|
||||
|
||||
2. Click **Device configuration**.
|
||||
|
||||
3. Click **Profiles** > **Create Profile** > **Endpoint protection** > **Windows Defender Credential Guard**.
|
||||
|
||||
> [!NOTE]
|
||||
@ -66,6 +72,7 @@ Starting with Windows 10, version 1607 and Windows Server 2016, enabling Windows
|
||||
|
||||
If you are using Windows 10, version 1507 (RTM) or Windows 10, version 1511, Windows features have to be enabled to use virtualization-based security.
|
||||
You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM).
|
||||
|
||||
> [!NOTE]
|
||||
> If you enable Windows Defender Credential Guard by using Group Policy, the steps to enable Windows features through Control Panel or DISM are not required. Group Policy will install Windows features for you.
|
||||
|
||||
@ -73,22 +80,31 @@ You can do this by using either the Control Panel or the Deployment Image Servic
|
||||
**Add the virtualization-based security features by using Programs and Features**
|
||||
|
||||
1. Open the Programs and Features control panel.
|
||||
|
||||
2. Click **Turn Windows feature on or off**.
|
||||
|
||||
3. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box.
|
||||
|
||||
4. Select the **Isolated User Mode** check box at the top level of the feature selection.
|
||||
|
||||
5. Click **OK**.
|
||||
|
||||
**Add the virtualization-based security features to an offline image by using DISM**
|
||||
|
||||
1. Open an elevated command prompt.
|
||||
|
||||
2. Add the Hyper-V Hypervisor by running the following command:
|
||||
```
|
||||
|
||||
```console
|
||||
dism /image:<WIM file name> /Enable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /all
|
||||
```
|
||||
|
||||
3. Add the Isolated User Mode feature by running the following command:
|
||||
```
|
||||
|
||||
```console
|
||||
dism /image:<WIM file name> /Enable-Feature /FeatureName:IsolatedUserMode
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1607 and later, the Isolated User Mode feature has been integrated into the core operating system. Running the command in step 3 above is therefore no longer required.
|
||||
|
||||
@ -100,11 +116,13 @@ You can do this by using either the Control Panel or the Deployment Image Servic
|
||||
1. Open Registry Editor.
|
||||
|
||||
2. Enable virtualization-based security:
|
||||
|
||||
- Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard.
|
||||
- Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it.
|
||||
- Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**.
|
||||
|
||||
3. Enable Windows Defender Credential Guard:
|
||||
|
||||
- Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA.
|
||||
- Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it.
|
||||
|
||||
@ -120,9 +138,10 @@ You can do this by using either the Control Panel or the Deployment Image Servic
|
||||
|
||||
You can also enable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
|
||||
```
|
||||
```console
|
||||
DG_Readiness_Tool.ps1 -Enable -AutoReboot
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
> This is a known issue.
|
||||
@ -134,7 +153,9 @@ DG_Readiness_Tool.ps1 -Enable -AutoReboot
|
||||
You can view System Information to check that Windows Defender Credential Guard is running on a PC.
|
||||
|
||||
1. Click **Start**, type **msinfo32.exe**, and then click **System Information**.
|
||||
|
||||
2. Click **System Summary**.
|
||||
|
||||
3. Confirm that **Credential Guard** is shown next to **Virtualization-based security Services Configured**.
|
||||
|
||||
Here's an example:
|
||||
@ -143,9 +164,10 @@ You can view System Information to check that Windows Defender Credential Guard
|
||||
|
||||
You can also check that Windows Defender Credential Guard is running by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
|
||||
```
|
||||
```console
|
||||
DG_Readiness_Tool_v3.6.ps1 -Ready
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
> This is a known issue.
|
||||
@ -165,7 +187,7 @@ DG_Readiness_Tool_v3.6.ps1 -Ready
|
||||
- **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\]
|
||||
You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0.
|
||||
- **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: **0x0**. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: **0x1**. TPM PCR mask: **0x0**.
|
||||
- You can use Windows Powershell to determine whether credential guard is running on a client computer. On the computer in question, open an elevated Powershell window and run the following command:
|
||||
- You can use Windows PowerShell to determine whether credential guard is running on a client computer. On the computer in question, open an elevated PowerShell window and run the following command:
|
||||
|
||||
```powershell
|
||||
(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning
|
||||
@ -195,7 +217,7 @@ To disable Windows Defender Credential Guard, you can use the following set of p
|
||||
|
||||
4. Delete the Windows Defender Credential Guard EFI variables by using bcdedit. From an elevated command prompt, type the following commands:
|
||||
|
||||
``` syntax
|
||||
```console
|
||||
mountvol X: /s
|
||||
copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y
|
||||
bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader
|
||||
@ -232,9 +254,10 @@ For more info on virtualization-based security and HVCI, see [Enable virtualizat
|
||||
|
||||
You can also disable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
|
||||
```
|
||||
```console
|
||||
DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
> This is a known issue.
|
||||
@ -243,7 +266,7 @@ DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot
|
||||
|
||||
From the host, you can disable Windows Defender Credential Guard for a virtual machine:
|
||||
|
||||
``` PowerShell
|
||||
```powershell
|
||||
Set-VMSecurity -VMName <VMName> -VirtualizationBasedSecurityOptOut $true
|
||||
```
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.reviewer: ksarens
|
||||
manager: dansimp
|
||||
ms.date: 08/17/2020
|
||||
---
|
||||
|
||||
# Configure and manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line tool
|
||||
@ -29,11 +30,12 @@ You can perform various Microsoft Defender Antivirus functions with the dedicate
|
||||
|
||||
The utility has the following commands:
|
||||
|
||||
```DOS
|
||||
```console
|
||||
MpCmdRun.exe [command] [-options]
|
||||
```
|
||||
Here's an example:
|
||||
```
|
||||
|
||||
```console
|
||||
MpCmdRun.exe -Scan -ScanType 2
|
||||
```
|
||||
|
||||
@ -53,6 +55,22 @@ MpCmdRun.exe -Scan -ScanType 2
|
||||
| `-ListAllDynamicSignatures` | Lists the loaded dynamic Security intelligence |
|
||||
| `-RemoveDynamicSignature [-SignatureSetID]` | Removes dynamic Security intelligence |
|
||||
| `-CheckExclusion -path <path>` | Checks whether a path is excluded |
|
||||
| `-ValidateMapsConnection` | Verifies that your network can communicate with the Microsoft Defender Antivirus cloud service. This command will only work on Windows 10, version 1703 or higher.|
|
||||
|
||||
|
||||
## Common errors in running commands via mpcmdrun.exe
|
||||
|
||||
|Error message | Possible reason
|
||||
|:----|:----|
|
||||
| `ValidateMapsConnection failed (800106BA) or 0x800106BA` | The Microsoft Defender Antivirus service is disabled. Enable the service and try again. <br> **Note:** In Windows 10 1909 or older, and Windows Server 2019 or older, the service used to be called "Windows Defender Antivirus" service.|
|
||||
| `0x80070667` | You're running the `-ValidateMapsConnection` command from a computer that is Windows 10 version 1607 or older, or Windows Server 2016 or older. Run the command from a machine that is Windows 10 version 1703 or newer, or Windows Server 2019 or newer.|
|
||||
| `'MpCmdRun' is not recognized as an internal or external command, operable program or batch file.` | The tool needs to be run from either: `%ProgramFiles%\Windows Defender` or `C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.4-0` (where `2008.4-0` might differ since platform updates are monthly except for December)|
|
||||
| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80070005 httpcode=450)` | Not enough privileges. Use the command prompt (cmd.exe) as an administrator.|
|
||||
| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80070006 httpcode=451)` | The firewall is blocking the connection or conducting SSL inspection. |
|
||||
| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80004005 httpcode=450)` | Possible network-related issues, like name resolution problems|
|
||||
| `ValidateMapsConnection failed to establish a connection to MAPS (hr=0x80508015` | The firewall is blocking the connection or conducting SSL inspection. |
|
||||
| `ValidateMapsConnection failed to establish a connection to MAPS (hr=800722F0D` | The firewall is blocking the connection or conducting SSL inspection. |
|
||||
| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80072EE7 httpcode=451)` | The firewall is blocking the connection or conducting SSL inspection. |
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 08/12/2020
|
||||
ms.date: 08/17/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
@ -43,7 +43,7 @@ Depending on your organization's settings, employees can copy and paste images (
|
||||
|
||||
### Why don't employees see their Favorites in the Application Guard Edge session?
|
||||
|
||||
To help keep the Application Guard Edge session secure and isolated from the host device, we don't copy the Favorites stored in the Application Guard Edge session back to the host device.
|
||||
To help keep the Application Guard Edge session secure and isolated from the host device, favorites that are stored in an Application Guard Edge session are not copied to the host device.
|
||||
|
||||
### Are extensions supported in the Application Guard?
|
||||
|
||||
@ -53,6 +53,10 @@ Extension installs in the container are supported from Microsoft Edge version 81
|
||||
|
||||
Microsoft Defender Application Guard requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as `192.168.1.4:81` can be annotated as `itproxy:81` or using a record such as `P19216810010` for a proxy with an IP address of `192.168.100.10`. This applies to Windows 10 Enterprise edition 1709 or higher. These would be for the proxy policies under Network Isolation in Group Policy or Intune.
|
||||
|
||||
If Application Guard is used with network proxies, they need to be specified by fully qualified domain name (FQDN) in the system proxy settings (likewise in a PAC script if that is the type of proxy configuration used). Additionally these proxies need to be marked as *neutral* in the **Application trust** list. The FQDNs for the PAC file and the proxy servers the PAC file redirects to must be added as neutral resources in the network isolation policies that are used by Application Guard. You can verify this by going to `edge://application-guard-internals/#utilities` and entering the FQDN for the pac/proxy in the **check url trust** field. Verify that it says *Neutral.*
|
||||
|
||||
Optionally, if possible, the IP addresses associated with the server hosting the above should be removed from the enterprise IP ranges in the network isolation policies that are used by Application Guard. Additionally, go to `edge://application-guard-internals/#utilities` to view the Application Guard proxy configuration. This step can be done in both the host and within Application Guard to verify that each side is using the proxy setup you expect.
|
||||
|
||||
### Which Input Method Editors (IME) in 19H1 are not supported?
|
||||
|
||||
The following Input Method Editors (IME) introduced in Windows 10, version 1903 are currently not supported in Microsoft Defender Application Guard.
|
||||
@ -83,29 +87,29 @@ To trust a subdomain, you must precede your domain with two dots, for example: `
|
||||
|
||||
### Are there differences between using Application Guard on Windows Pro vs Windows Enterprise?
|
||||
|
||||
When using Windows Pro or Windows Enterprise, you will have access to using Application Guard's Standalone Mode. However, when using Enterprise you will have access to Application Guard's Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Microsoft Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard).
|
||||
When using Windows Pro or Windows Enterprise, you will have access to using Application Guard's standalone mode. However, when using Windows Enterprise you will have access to Application Guard's enterprise-managed mode. This mode has some extra features that the standalone Mode does not. For more information, see [Prepare to install Microsoft Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard).
|
||||
|
||||
### Is there a size limit to the domain lists that I need to configure?
|
||||
|
||||
Yes, both the Enterprise Resource domains hosted in the cloud and the Domains categorized as both work and personal have a 16383B limit.
|
||||
Yes, both the enterprise resource domains hosted in the cloud and the domains categorized as both work and personal have a 16383B limit.
|
||||
|
||||
### Why does my encryption driver break Microsoft Defender Application Guard?
|
||||
|
||||
Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work and result in an error message ("0x80070013 ERROR_WRITE_PROTECT").
|
||||
Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Microsoft Defender Application Guard will not work, and will result in an error message (*0x80070013 ERROR_WRITE_PROTECT*).
|
||||
|
||||
### Why do the Network Isolation policies in Group Policy and CSP look different?
|
||||
### Why do the network isolation policies in Group Policy and CSP look different?
|
||||
|
||||
There is not a one-to-one mapping among all the Network Isolation policies between CSP and GP. Mandatory network isolation policies to deploy WDAG are different between CSP and GP.
|
||||
There is not a one-to-one mapping among all the network isolation policies between CSP and GP. Mandatory network isolation policies to deploy WDAG are different between CSP and GP.
|
||||
|
||||
Mandatory network isolation GP policy to deploy WDAG: "DomainSubnets or CloudResources"
|
||||
Mandatory network isolation CSP policy to deploy WDAG: "EnterpriseCloudResources or (EnterpriseIpRange and EnterpriseNetworkDomainNames)"
|
||||
For EnterpriseNetworkDomainNames, there is no mapped CSP policy.
|
||||
|
||||
Windows Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work and result in an error message (`0x80070013 ERROR_WRITE_PROTECT`).
|
||||
Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work and result in an error message (*0x80070013 ERROR_WRITE_PROTECT*).
|
||||
|
||||
### Why did Application Guard stop working after I turned off hyperthreading?
|
||||
|
||||
If hyperthreading is disabled (because of an update applied through a KB article or through BIOS settings), there is a possibility Application Guard no longer meets the minimum requirements.
|
||||
If hyperthreading is disabled (because of an update applied through a KB article or through BIOS settings), there is a possibility that Microsoft Defender Application Guard no longer meets the minimum requirements.
|
||||
|
||||
### Why am I getting the error message ("ERROR_VIRTUAL_DISK_LIMITATION")?
|
||||
|
||||
@ -139,7 +143,7 @@ In the Microsoft Defender Firewall user interface go through the following steps
|
||||
|
||||
### Why can I not launch Application Guard when Exploit Guard is enabled?
|
||||
|
||||
There is a known issue where if you change the Exploit Protection settings for CFG and possibly others, hvsimgr cannot launch. To mitigate this issue, go to Windows Security-> App and Browser control -> Exploit Protection Setting -> switch CFG to the “use default".
|
||||
There is a known issue where if you change the Exploit Protection settings for CFG and possibly others, hvsimgr cannot launch. To mitigate this issue, go to **Windows Security** > **App and Browser control** > **Exploit Protection Setting**, and then switch CFG to the **use default**.
|
||||
|
||||
|
||||
### How can I have ICS in enabled state yet still use Application Guard?
|
||||
@ -148,7 +152,7 @@ This is a two step process.
|
||||
|
||||
Step 1:
|
||||
|
||||
Enable Internet Connection sharing by changing the Group Policy setting **Prohibit use of Internet Connection Sharing on your DNS domain network.** This setting is part of the Microsoft security baseline. Change it from Enabled to Disabled.
|
||||
Enable Internet Connection sharing by changing the Group Policy setting **Prohibit use of Internet Connection Sharing on your DNS domain network.** This setting is part of the Microsoft security baseline. Change it from **Enabled** to **Disabled**.
|
||||
|
||||
Step 2:
|
||||
|
||||
@ -165,7 +169,6 @@ Step 2:
|
||||
Application Guard must meet all these prerequisites to be enabled in Enterprise mode: [System requirements for Microsoft Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard).
|
||||
To understand why it is not enabled in Enterprise mode, check the status of the evaluation to understand what's missing.
|
||||
|
||||
For CSP (Intune) you can query the status node by using **Get**. This is described in the [Application Guard CSP](https://docs.microsoft.com/windows/client-management/mdm/windowsdefenderapplicationguard-csp).
|
||||
On this page, you will see the **status** node as well as the meaning of each bit. If the status is not 63, you are missing a prerequisite.
|
||||
For CSP (Intune) you can query the status node by using **Get**. This is described in the [Application Guard CSP](https://docs.microsoft.com/windows/client-management/mdm/windowsdefenderapplicationguard-csp). On this page, you will see the **status** node as well as the meaning of each bit. If the status is not 63, you are missing a prerequisite.
|
||||
|
||||
For Group Policy you need to look at the registry. See **Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HVSIGP** Status. The meaning of each bit is the same as the CSP.
|
||||
|
||||
@ -90,7 +90,7 @@ While the attack was detected and stopped, alerts, such as an "initial access al
|
||||
|
||||
This example shows how behavior-based device learning models in the cloud add new layers of protection against attacks, even after they have started running.
|
||||
|
||||
### Example 2: NTML relay - Juicy Potato malware variant
|
||||
### Example 2: NTLM relay - Juicy Potato malware variant
|
||||
|
||||
As described in the recent blog post, [Behavioral blocking and containment: Transforming optics into protection](https://www.microsoft.com/security/blog/2020/03/09/behavioral-blocking-and-containment-transforming-optics-into-protection), in January 2020, Microsoft Defender ATP detected a privilege escalation activity on a device in an organization. An alert called “Possible privilege escalation using NTLM relay” was triggered.
|
||||
|
||||
|
||||
@ -34,13 +34,13 @@ Selecting an incident from the **Incidents queue** brings up the **Incident mana
|
||||
You can assign incidents to yourself, change the status and classification, rename, or comment on them to keep track of their progress.
|
||||
|
||||
> [!TIP]
|
||||
> For additional visibility at-a-glance, automatic incident naming, currently in public preview, generates incident names based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories. This allows you to quickly understand the scope of the incident.
|
||||
> For additional visibility at a glance, incident names are automatically generated based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories. This allows you to quickly understand the scope of the incident.
|
||||
>
|
||||
> For example: *Multi-stage incident on multiple endpoints reported by multiple sources.*
|
||||
>
|
||||
> Incidents that existed prior the rollout of automatic incident naming will not have their name changed.
|
||||
> Incidents that existed prior the rollout of automatic incident naming will retain their names.
|
||||
>
|
||||
> Learn more about [turning on preview features](preview.md#turn-on-preview-features).
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -49,7 +49,7 @@ Incident severity | Description
|
||||
High </br>(Red) | Threats often associated with advanced persistent threats (APT). These incidents indicate a high risk due to the severity of damage they can inflict on devices.
|
||||
Medium </br>(Orange) | Threats rarely observed in the organization, such as anomalous registry change, execution of suspicious files, and observed behaviors typical of attack stages.
|
||||
Low </br>(Yellow) | Threats associated with prevalent malware and hack-tools that do not necessarily indicate an advanced threat targeting the organization.
|
||||
Informational </br>(Grey) | Informational incidents are those that might not be considered harmful to the network but might be good to keep track of.
|
||||
Informational </br>(Grey) | Informational incidents might not be considered harmful to the network but might be good to keep track of.
|
||||
|
||||
## Assigned to
|
||||
You can choose to filter the list by selecting assigned to anyone or ones that are assigned to you.
|
||||
@ -65,16 +65,15 @@ Use this filter to show incidents that contain sensitivity labels.
|
||||
|
||||
## Incident naming
|
||||
|
||||
To understand the incident's scope at-a-glance, automatic incident naming, currently in public preview, generates incident names based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories.
|
||||
To understand the incident's scope at a glance, incident names are automatically generated based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories.
|
||||
|
||||
For example: *Multi-stage incident on multiple endpoints reported by multiple sources.*
|
||||
|
||||
> [!NOTE]
|
||||
> Incidents that existed prior the rollout of automatic incident naming will not have their name changed.
|
||||
> Incidents that existed prior the rollout of automatic incident naming will retain their name.
|
||||
|
||||
Learn more about [turning on preview features](preview.md#turn-on-preview-features).
|
||||
|
||||
## Related topics
|
||||
## See also
|
||||
- [Incidents queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue)
|
||||
- [Manage incidents](manage-incidents.md)
|
||||
- [Investigate incidents](investigate-incidents.md)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user