mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 22:07:22 +00:00
Merge pull request #6092 from MicrosoftDocs/master
Publish 12/15/2021, 10:30 AM
This commit is contained in:
Diana Hanson
GitHub
commit
409f741634
@ -31,7 +31,7 @@ landingContent:
|
||||
- text: Use Enterprise Mode to improve compatibility
|
||||
url: /microsoft-edge/deploy/emie-to-improve-compatibility
|
||||
- text: Lifecycle FAQ - Internet Explorer
|
||||
url: https://support.microsoft.com/help/17454/lifecycle-faq-internet-explorer
|
||||
url: /lifecycle/faq/internet-explorer-microsoft-edge
|
||||
- linkListType: download
|
||||
links:
|
||||
- text: Download IE11 with Windows 10
|
||||
@ -123,7 +123,7 @@ landingContent:
|
||||
- text: Group Policy preferences for IE11
|
||||
url: ./ie11-deploy-guide/group-policy-preferences-and-ie11.md
|
||||
- text: Configure Group Policy preferences
|
||||
url: https://support.microsoft.com/help/2898604/how-to-configure-group-policy-preference-settings-for-internet-explorer-11-in-windows-8.1-or-windows-server-2012-r2
|
||||
url: /troubleshoot/browsers/how-to-configure-group-policy-preference-settings
|
||||
- text: Blocked out-of-date ActiveX controls
|
||||
url: ./ie11-deploy-guide/blocked-out-of-date-activex-controls.md
|
||||
- text: Out-of-date ActiveX control blocking
|
||||
|
||||
@ -8583,6 +8583,9 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-configuredeadlinegraceperiod" id="update-configuredeadlinegraceperiod">Update/ConfigureDeadlineGracePeriod</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-configuredeadlinegraceperiodforfeatureupdates" id="update-configuredeadlinegraceperiodforfeatureupdates">Update/ConfigureDeadlineGracePeriodForFeatureUpdates</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-configuredeadlinenoautoreboot" id="update-configuredeadlinenoautoreboot">Update/ConfigureDeadlineNoAutoReboot</a>
|
||||
</dd>
|
||||
@ -8610,6 +8613,9 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-disablewufbsafeguards" id="update-disablewufbsafeguards">Update/DisableWUfBSafeguards</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-donotenforceenterprisetlscertpinningforupdatedetection" id="update-donotenforceenterprisetlscertpinningforupdatedetection">Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-engagedrestartdeadline" id="update-engagedrestartdeadline">Update/EngagedRestartDeadline</a>
|
||||
</dd>
|
||||
@ -8706,6 +8712,18 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-setedurestart" id="update-setedurestart">Update/SetEDURestart</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-setpolicydrivenupdatesourcefordriver" id="update-setpolicydrivenupdatesourcefordriver">Update/SetPolicyDrivenUpdateSourceForDriver</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-setpolicydrivenupdatesourceforfeature" id="update-setpolicydrivenupdatesourceforfeature">Update/SetPolicyDrivenUpdateSourceForFeature</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-setpolicydrivenupdatesourceforother" id="update-setpolicydrivenupdatesourceforother">Update/SetPolicyDrivenUpdateSourceForOther</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-setpolicydrivenupdatesourceforquality" id="update-setpolicydrivenupdatesourceforquality">Update/SetPolicyDrivenUpdateSourceForQuality</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-setproxybehaviorforupdatedetection"id="update-setproxybehaviorforupdatedetection">Update/SetProxyBehaviorForUpdateDetection</a>
|
||||
</dd>
|
||||
@ -8853,6 +8871,14 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### WindowsAutoPilot policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-windowsautopilot.md#windowsautopilot-enableagilitypostenrollment" id="windowsautopilot-enableagilitypostenrollment">WindowsAutoPilot/EnableAgilityPostEnrollment</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### WindowsConnectionManager policies
|
||||
|
||||
<dl>
|
||||
|
||||
@ -73,6 +73,9 @@ ms.collection: highpri
|
||||
<dd>
|
||||
<a href="#update-configuredeadlinegraceperiod">Update/ConfigureDeadlineGracePeriod</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#update-configuredeadlinegraceperiodforfeatureupdates">Update/ConfigureDeadlineGracePeriodForFeatureUpdates</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#update-configuredeadlinenoautoreboot">Update/ConfigureDeadlineNoAutoReboot</a>
|
||||
</dd>
|
||||
@ -100,6 +103,9 @@ ms.collection: highpri
|
||||
<dd>
|
||||
<a href="#update-disablewufbsafeguards">Update/DisableWUfBSafeguards</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#update-donotenforceenterprisetlscertpinningforupdatedetection">Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#update-engagedrestartdeadline">Update/EngagedRestartDeadline</a>
|
||||
</dd>
|
||||
@ -196,6 +202,18 @@ ms.collection: highpri
|
||||
<dd>
|
||||
<a href="#update-setedurestart">Update/SetEDURestart</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#update-setpolicydrivenupdatesourcefordriver">Update/SetPolicyDrivenUpdateSourceForDriver</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#update-setpolicydrivenupdatesourceforfeature">Update/SetPolicyDrivenUpdateSourceForFeature</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#update-setpolicydrivenupdatesourceforother">Update/SetPolicyDrivenUpdateSourceForOther</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#update-setpolicydrivenupdatesourceforquality">Update/SetPolicyDrivenUpdateSourceForQuality</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#update-setproxybehaviorforupdatedetection">Update/SetProxyBehaviorForUpdateDetection</a>
|
||||
</dd>
|
||||
@ -1108,6 +1126,53 @@ Default value is 2.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="update-configuredeadlinegraceperiodforfeatureupdates"></a>**Update/ConfigureDeadlineGracePeriodForFeatureUpdates**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Allows IT admins to set different grace periods for both Quality Updates and Feature Updates. Specifically, when used with used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates).
|
||||
|
||||
IT Admins will be able to specify a minimum number of days until restarts occur automatically for Featur Updates. Setting the grace period may extend the effective deadline set by the deadline policies specifically for Feature Updates.
|
||||
|
||||
<!--/Description-->
|
||||
|
||||
<!--SupportedValues-->
|
||||
Supports a numeric value from 0 - 7, which indicates the minimum number of days.
|
||||
|
||||
Default value is 2.
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="update-configuredeadlinenoautoreboot"></a>**Update/ConfigureDeadlineNoAutoReboot**
|
||||
|
||||
@ -1573,6 +1638,56 @@ The following list shows the supported values:
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="update-donotenforceenterprisetlscertpinningforupdatedetection"></a>**Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
To ensure the highest levels of security, we recommended leveraging WSUS TLS certificate pinning on all devices.
|
||||
|
||||
By default, certificate pinning for Windows Update client is not enforced.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Allow user proxy to be used as a fallback if detection using system proxy fails*
|
||||
- GP name: *Allow user proxy to be used as a fallback if detection using system proxy fails*
|
||||
- GP path: *Windows Update\SpecifyintranetMicrosoftupdateserviceLocation*
|
||||
- GP ADMX file name: *WindowsUpdate.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) -Do not enforce certificate pinning
|
||||
- 1 - Do not enforce certificate pinning
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="update-engagedrestartdeadline"></a>**Update/EngagedRestartDeadline**
|
||||
|
||||
@ -3190,6 +3305,229 @@ The following list shows the supported values:
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="update-setpolicydrivenupdatesourcefordriver"></a>**Update/SetPolicyDrivenUpdateSourceForDriver**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
|
||||
|
||||
If you configure this policy, please also configure the scan source policies for other update types:
|
||||
- SetPolicyDrivenUpdateSourceForFeature
|
||||
- SetPolicyDrivenUpdateSourceForQuality
|
||||
- SetPolicyDrivenUpdateSourceForOther
|
||||
|
||||
>[!NOTE]
|
||||
>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Specify source service for specific classes of Windows Updates*
|
||||
- GP name: *SetPolicyDrivenUpdateSourceForDriver*
|
||||
- GP path: *Windows Components/Windows Update*
|
||||
- GP ADMX file name: *WindowsUpdate.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0: (Default) Detect, download and deploy Driver from Windows Update
|
||||
- 1: Enabled, Detect, download and deploy Driver from Windows Server Update Server (WSUS)
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="update-setpolicydrivenupdatesourceforfeature"></a>**Update/SetPolicyDrivenUpdateSourceForFeature**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
|
||||
|
||||
If you configure this policy, please also configure the scan source policies for other update types:
|
||||
- SetPolicyDrivenUpdateSourceForQuality
|
||||
- SetPolicyDrivenUpdateSourceForDriver
|
||||
- SetPolicyDrivenUpdateSourceForOther
|
||||
|
||||
>[!NOTE]
|
||||
>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Specify source service for specific classes of Windows Updates*
|
||||
- GP name: *SetPolicyDrivenUpdateSourceForFeature*
|
||||
- GP path: *Windows Components/Windows Update*
|
||||
- GP ADMX file name: *WindowsUpdate.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0: (Default) Detect, download and deploy Feature from Windows Update
|
||||
- 1: Enabled, Detect, download and deploy Feature from Windows Server Update Server (WSUS)
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="update-setpolicydrivenupdatesourceforother"></a>**Update/SetPolicyDrivenUpdateSourceForOther**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
|
||||
|
||||
If you configure this policy, please also configure the scan source policies for other update types:
|
||||
- SetPolicyDrivenUpdateSourceForFeature
|
||||
- SetPolicyDrivenUpdateSourceForQuality
|
||||
- SetPolicyDrivenUpdateSourceForDriver
|
||||
|
||||
>[!NOTE]
|
||||
>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Specify source service for specific classes of Windows Updates*
|
||||
- GP name: *SetPolicyDrivenUpdateSourceForOther*
|
||||
- GP path: *Windows Components/Windows Update*
|
||||
- GP ADMX file name: *WindowsUpdate.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0: (Default) Detect, download and deploy Other from Windows Update
|
||||
- 1: Enabled, Detect, download and deploy Other from Windows Server Update Server (WSUS)
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="update-setpolicydrivenupdatesourceforquality"></a>**Update/SetPolicyDrivenUpdateSourceForQuality**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
|
||||
|
||||
If you configure this policy, please also configure the scan source policies for other update types:
|
||||
- SetPolicyDrivenUpdateSourceForFeature
|
||||
- SetPolicyDrivenUpdateSourceForDriver
|
||||
- SetPolicyDrivenUpdateSourceForOther
|
||||
|
||||
>[!NOTE]
|
||||
>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Specify source service for specific classes of Windows Updates*
|
||||
- GP name: *SetPolicyDrivenUpdateSourceForQuality*
|
||||
- GP path: *Windows Components/Windows Update*
|
||||
- GP ADMX file name: *WindowsUpdate.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0: (Default) Detect, download and deploy Quality from Windows Update
|
||||
- 1: Enabled, Detect, download and deploy Quality from Windows Server Update Server (WSUS)
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="update-setproxybehaviorforupdatedetection"></a>**Update/SetProxyBehaviorForUpdateDetection**
|
||||
|
||||
74
windows/client-management/mdm/policy-csp-windowsautopilot.md
Normal file
74
windows/client-management/mdm/policy-csp-windowsautopilot.md
Normal file
@ -0,0 +1,74 @@
|
||||
---
|
||||
title: Policy CSP - WindowsAutoPilot
|
||||
description: Learn to use the Policy CSP - WindowsAutoPilot setting to enable or disable Autopilot Agility feature.
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: alekyaj
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 11/25/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - WindowsAutoPilot
|
||||
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## WindowsAutoPilot policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#windowsautopilot-enableagilitypostenrollment">WindowsAutoPilot/EnableAgilityPostEnrollment</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="windowsautopilot-enableagilitypostenrollment"></a>**WindowsAutoPilot/EnableAgilityPostEnrollment**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy enables Windows Autopilot to be kept up-to-date during the out-of-box experience after MDM enrollment.
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--/Policies-->
|
||||
@ -835,6 +835,8 @@ items:
|
||||
href: policy-csp-virtualizationbasedtechnology.md
|
||||
- name: Wifi
|
||||
href: policy-csp-wifi.md
|
||||
- name: WindowsAutoPilot
|
||||
href: policy-csp-windowsautopilot.md
|
||||
- name: WindowsConnectionManager
|
||||
href: policy-csp-windowsconnectionmanager.md
|
||||
- name: WindowsDefenderSecurityCenter
|
||||
|
||||
@ -28,12 +28,12 @@ With the release of Windows 10, version 1607, the Company Settings Center was re
|
||||
|
||||
Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell.
|
||||
|
||||
**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable:
|
||||
|
||||
- Contact IT Link Text
|
||||
- Contact IT URL
|
||||
- Tray Icon
|
||||
|
||||
> [!NOTE]
|
||||
> With the removal of the Company Settings Center, the following group policies are no longer applicable:
|
||||
>
|
||||
> - Contact IT Link Text
|
||||
> - Contact IT URL
|
||||
> - Tray Icon
|
||||
|
||||
### Upgrading from UE-V 1.0 to the in-box version of UE-V is blocked
|
||||
|
||||
@ -99,31 +99,11 @@ Operating system settings for Narrator and currency characters specific to the l
|
||||
|
||||
WORKAROUND: None
|
||||
|
||||
## Hotfixes and Knowledge Base articles for UE-V
|
||||
|
||||
This section contains hotfixes and KB articles for UE-V.
|
||||
|
||||
| KB Article | Title | Link |
|
||||
|------------|---------|--------|
|
||||
| 3018608 | UE-V - TemplateConsole.exe crashes when UE-V WMI classes are missing | [support.microsoft.com/kb/3018608](https://support.microsoft.com/kb/3018608) |
|
||||
| 2903501 | UE-V: User Experience Virtualization (UE-V) compatibility with user profiles | [support.microsoft.com/kb/2903501](https://support.microsoft.com/kb/2903501) |
|
||||
| 2770042 | UE-V Registry Settings | [support.microsoft.com/kb/2770042](/troubleshoot/windows-client/ue-v/ue-v-registry-settings) |
|
||||
| 2847017 | Internet Explorer settings replicated by UE-V | [support.microsoft.com/kb/2847017](https://support.microsoft.com/kb/2847017) |
|
||||
| 2769631 | How to repair a corrupted UE-V install | [support.microsoft.com/kb/2769631](https://support.microsoft.com/kb/2769631) |
|
||||
| 2850989 | Migrating MAPI profiles with Microsoft UE-V is not supported | [support.microsoft.com/kb/2850989](https://support.microsoft.com/kb/2850989) |
|
||||
| 2769586 | UE-V roams empty folders and registry keys | [support.microsoft.com/kb/2769586](https://support.microsoft.com/kb/2769586) |
|
||||
| 2782997 | How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) | [support.microsoft.com/kb/2782997](/troubleshoot/windows-client/ue-v/enable-debug-logging) |
|
||||
| 2769570 | UE-V does not update the theme on RDS or VDI sessions | [support.microsoft.com/kb/2769570](https://support.microsoft.com/kb/2769570) |
|
||||
| 2850582 | How To Use Microsoft User Experience Virtualization With App-V Applications | [support.microsoft.com/kb/2850582](https://support.microsoft.com/kb/2850582) |
|
||||
| 3041879 | Current file versions for Microsoft User Experience Virtualization | [support.microsoft.com/kb/3041879](https://support.microsoft.com/kb/3041879) |
|
||||
| 2843592 | Information on User Experience Virtualization and High Availability | [support.microsoft.com/kb/2843592](https://support.microsoft.com/kb/2843592) |
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
**Additional resources for this feature**
|
||||
|
||||
- [UE-V Registry Settings](/troubleshoot/windows-client/ue-v/ue-v-registry-settings)
|
||||
|
||||
- [How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V)](/troubleshoot/windows-client/ue-v/enable-debug-logging)
|
||||
|
||||
- [User Experience Virtualization](uev-for-windows.md)
|
||||
|
||||
|
||||
@ -53,7 +53,7 @@ Choose one of the following two enrollment options:
|
||||
|
||||
This is the Bring Your Own Device (BYOD) method--your device will receive Olympia policies and features, but a new account will not be created. See [Set up Azure Active Directory registered Windows 10 devices](/azure/active-directory/device-management-azuread-registered-devices-windows10-setup) for additional information.
|
||||
|
||||
1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
|
||||
1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/windows/create-a-local-user-or-administrator-account-in-windows-20de74e0-ac7f-3502-a866-32915af2a34d)).
|
||||
|
||||
|
||||
|
||||
@ -92,7 +92,7 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi
|
||||
> [!NOTE]
|
||||
> Make sure that you save your Pro license key before upgrading to the Enterprise edition. If the device gets disconnected from Olympia, you can use the Pro key to reactivate the license manually in the unlikely event that the license fails to downgrade back to Pro automatically. To reactivate manually, see [Upgrade by manually entering a product key](../../upgrade/windows-10-edition-upgrades.md#upgrade-by-manually-entering-a-product-key).
|
||||
|
||||
1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
|
||||
1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/windows/create-a-local-user-or-administrator-account-in-windows-20de74e0-ac7f-3502-a866-32915af2a34d)).
|
||||
|
||||
|
||||
|
||||
@ -100,7 +100,7 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi
|
||||
|
||||
3. Click **Connect**, then click **Join this device to Azure Active Directory**.
|
||||
|
||||
![Joining device to Azure AD.]](images/2-3.png)
|
||||
|
||||
|
||||
4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
|
||||
|
||||
|
||||
@ -16,7 +16,7 @@ ms.collection:
|
||||
- M365-security-compliance
|
||||
- highpri
|
||||
ms.topic: article
|
||||
ms.date: 11/29/2021
|
||||
ms.date: 12/14/2021
|
||||
ms.technology: privacy
|
||||
---
|
||||
|
||||
@ -1723,91 +1723,34 @@ In Group Policy, configure:
|
||||
- Create a SZ registry setting named **ConfigureAppInstallControl** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SmartScreen** with a value of **Anywhere**.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-spotlight"></a>25. Windows Spotlight
|
||||
### <a href="" id="bkmk-spotlight"></a>25. Personalized Experiences
|
||||
|
||||
Windows Spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface or Group Policy.
|
||||
Personalized experiences provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. Example features include Windows Spotlight and Start Suggestions. You can control them by using the Group Policy.
|
||||
|
||||
> [!NOTE]
|
||||
> This excludes how individual experiences (e.g., Windows Spotlight) can be controlled by users in Windows Settings.
|
||||
|
||||
If you're running Windows 10, version 1607 or later, or Windows 11, you need to:
|
||||
|
||||
- **Enable** the following Group Policy **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off all Windows spotlight features**
|
||||
|
||||
-or-
|
||||
|
||||
- Create a new REG_DWORD registry setting named **DisableWindowsSpotlightFeatures** in **HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)**.
|
||||
|
||||
|
||||
-AND-
|
||||
|
||||
|
||||
- Enable the following Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off cloud optimized content**
|
||||
|
||||
-or-
|
||||
|
||||
- Create a new REG_DWORD registry setting named **DisableCloudOptimizedContent** in **HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CloudContent** with a **value of 1 (one)**.
|
||||
|
||||
> [!NOTE]
|
||||
> This must be done within 15 minutes after Windows 10 or Windows 11 is installed. Alternatively, you can create an image with this setting.
|
||||
|
||||
-or-
|
||||
|
||||
- Create a new REG_DWORD registry setting named **DisableWindowsSpotlightFeatures** in **HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one).
|
||||
|
||||
|
||||
-AND-
|
||||
|
||||
|
||||
- Enable the following Group Policy **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the Lock Screen**
|
||||
|
||||
-or-
|
||||
|
||||
- Create a new REG_DWORD registry setting named **NoLockScreen** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a **value of 1 (one)**
|
||||
|
||||
|
||||
-AND-
|
||||
|
||||
|
||||
- Configure the following in **Settings** UI:
|
||||
|
||||
- **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Get fun facts, tips, tricks and more on your lock screen**
|
||||
|
||||
- **Personalization** > **Start** > **Occasionally show suggestions in Start**
|
||||
|
||||
- **System** > **Notifications & actions** > **Show me tips about Windows**
|
||||
|
||||
-or-
|
||||
|
||||
- Apply the Group Policies:
|
||||
|
||||
- **Enable** the **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image and logon image** Group Policy.
|
||||
- Add **C:\\windows\\web\\screen\\lockscreen.jpg** as the location in the **Path to local lock screen image** box.
|
||||
|
||||
- Check the **Turn off fun facts, tips, tricks, and more on lock screen** check box.
|
||||
|
||||
> [!NOTE]
|
||||
> This will only take effect if the policy is applied before the first logon.
|
||||
> If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device,
|
||||
> you can **Enable** the **Do not display the lock screen** policy under **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization**
|
||||
>
|
||||
> Alternatively, you can create a new REG_SZ registry setting named **LockScreenImage** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization**
|
||||
> with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG_DWORD registry setting named **LockScreenOverlaysDisabled** in
|
||||
> **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of **1 (one)**.
|
||||
>
|
||||
> The Group Policy for the **LockScreenOverlaysDisabled** registry key is **Force a specific default lock screen and logon image** that is under **Control Panel** **Personalization**.
|
||||
|
||||
|
||||
\-AND-
|
||||
|
||||
|
||||
- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips** to **Enabled**
|
||||
|
||||
-or-
|
||||
|
||||
- Create a new REG_DWORD registry setting named **DisableSoftLanding** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)**
|
||||
|
||||
|
||||
\-AND-
|
||||
|
||||
|
||||
- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences** to **Enabled**
|
||||
|
||||
-or-
|
||||
|
||||
- Create a new REG_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)**
|
||||
|
||||
This policy setting controls whether the lock screen appears for users. The Do not display the lock screen Group Policy should be set to Enable to prevent the lock screen from being displayed. The Group Computer Configuration\Administrative templates\Control Panel\Personalization!Do not display the lock screen.
|
||||
|
||||
If you enable this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC.
|
||||
|
||||
If you disable or do not configure this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see a lock screen after locking their PC. They must dismiss the lock screen using touch, the keyboard, or by dragging it with the mouse.
|
||||
|
||||
|
||||
For more info, see [Windows Spotlight on the lock screen](/windows/configuration/windows-spotlight).
|
||||
|
||||
### <a href="" id="bkmk-windowsstore"></a>26. Microsoft Store
|
||||
|
||||
|
||||
@ -83,7 +83,7 @@ This event is generated when workstation was unlocked.
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -83,7 +83,7 @@ This event is generated when screen saver was invoked.
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -83,7 +83,7 @@ This event is generated when screen saver was dismissed.
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -88,7 +88,7 @@ Separate events will be generated for “Registry” and “File system” polic
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -90,7 +90,7 @@ This event generates when Dynamic Access Control Proposed [Central Access Policy
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -90,7 +90,7 @@ For example, it generates when a new [Central Access Policy](/windows-server/ide
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -93,7 +93,7 @@ This event is generated only on domain controllers.
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -93,7 +93,7 @@ This event is generated only on domain controllers.
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -95,7 +95,7 @@ This event contains new values only, it doesn’t contains old values and it doe
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -88,7 +88,7 @@ You can typically see this event during system startup, if specific roles (Inter
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -91,7 +91,7 @@ This event doesn't generate for Active Directory objects.
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -16,10 +16,9 @@ ms.technology: windows-sec
|
||||
|
||||
# 4908(S): Special Groups Logon table modified.
|
||||
|
||||
:::image type="content" source="images/event-4908.png" alt-text="Event 4908 illustration":::
|
||||
|
||||
<img src="images/event-4908.png" alt="Event 4908 illustration" width="449" height="361" hspace="10" align="left" />
|
||||
|
||||
***Subcategory:*** [Audit Policy Change](audit-audit-policy-change.md)
|
||||
***Subcategory:*** [Audit Policy Change](audit-audit-policy-change.md)
|
||||
|
||||
***Event Description:***
|
||||
|
||||
@ -29,18 +28,16 @@ This event also generates during system startup.
|
||||
|
||||
This event is always logged regardless of the "Audit Policy Change" sub-category setting.
|
||||
|
||||
More information about Special Groups auditing can be found here:
|
||||
For more information about Special Groups auditing, see [4908(S): Special Groups Logon table modified](/windows/security/threat-protection/auditing/event-4908).
|
||||
|
||||
<https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx>
|
||||
|
||||
<https://support.microsoft.com/kb/947223>
|
||||
|
||||
> **Note** For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
> [!NOTE]
|
||||
> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
|
||||
<br clear="all">
|
||||
|
||||
***Event XML:***
|
||||
```
|
||||
|
||||
```xml
|
||||
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
||||
- <System>
|
||||
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
|
||||
@ -75,11 +72,12 @@ More information about Special Groups auditing can be found here:
|
||||
|
||||
**Special Groups** \[Type = UnicodeString\]**:** contains current list of SIDs (groups or accounts) which are members of Special Groups. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
> [!NOTE]
|
||||
> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
“HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Audit\\SpecialGroups” registry value contains current list of SIDs which are included in Special Groups:
|
||||
|
||||
<img src="images/registry-editor-audit.png" alt="Registry Editor Audit key illustration" width="1440" height="335" />
|
||||
:::image type="content" source="images/registry-editor-audit.png" alt-text="Registry Editor Audit key illustration":::
|
||||
|
||||
## Security Monitoring Recommendations
|
||||
|
||||
|
||||
@ -91,7 +91,7 @@ Resource attributes for file or folder can be changed, for example, using Window
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -89,7 +89,7 @@ This event is always logged regardless of the "Audit Policy Change" sub-category
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -91,7 +91,7 @@ This event always generates, regardless of the object’s [SACL](/windows/win32/
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -17,7 +17,7 @@ ms.technology: windows-sec
|
||||
# 4937(S): A lingering object was removed from a replica.
|
||||
|
||||
|
||||
This event generates when a [lingering object](https://support.microsoft.com/kb/910205) was removed from a replica.
|
||||
This event generates when a [lingering object](/troubleshoot/windows-server/identity/information-lingering-objects) was removed from a replica.
|
||||
|
||||
There is no example of this event in this document.
|
||||
|
||||
|
||||
@ -111,7 +111,7 @@ This event occurs when an account that is a member of any defined [Special Group
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
@ -139,7 +139,7 @@ This event occurs when an account that is a member of any defined [Special Group
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -87,7 +87,7 @@ This is an informational event from file system [Transaction Manager](/windows/w
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -95,7 +95,7 @@ You can see these events, for example, during certificate renewal or export oper
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -92,7 +92,7 @@ This event generates when a cryptographic key is exported or imported using a [K
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -92,7 +92,7 @@ This event generates when a cryptographic operation (open key, create key, creat
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -96,7 +96,7 @@ For a change operation you will typically see two 5136 events for one action, wi
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -90,7 +90,7 @@ This event only generates if the parent object has a particular entry in its [SA
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -91,7 +91,7 @@ This event only generates if the container to which the Active Directory object
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -91,7 +91,7 @@ This event only generates if the destination object has a particular entry in it
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -92,7 +92,7 @@ This event generates once per session, when first access attempt was made.
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -91,7 +91,7 @@ This event only generates if the deleted object has a particular entry in its [S
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -92,7 +92,7 @@ This event generates every time network share object was modified.
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -83,7 +83,7 @@ This event generates every time a network share object is deleted.
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -92,7 +92,7 @@ This event generates every time network share object (file or folder) was access
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -89,7 +89,7 @@ It often happens because of NTLMv1 or LM protocols usage from client side when
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
|
||||
@ -13,7 +13,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/04/2021
|
||||
ms.date: 12/13/2021
|
||||
search.appverid: met150
|
||||
ms.technology: windows-sec
|
||||
---
|
||||
@ -49,6 +49,8 @@ Microsoft classifies most malicious software into one of the following categorie
|
||||
|
||||
* **Backdoor:** A type of malware that gives malicious hackers remote access to and control of your device.
|
||||
|
||||
* **Command and Control:** A type of malware that infects your device and establishes communication with the hackers’ command-and-control server to receive instructions. Once communication is established, hackers can send commands that can steal data, shut down and reboot the device, and disrupt web services.
|
||||
|
||||
* **Downloader:** A type of malware that downloads other malware onto your device. It must connect to the internet to download files.
|
||||
|
||||
* **Dropper:** A type of malware that installs other malware files onto your device. Unlike a downloader, a dropper doesn't have to connect to the internet to drop malicious files. The dropped files are typically embedded in the dropper itself.
|
||||
|
||||
@ -168,7 +168,7 @@ One of the most common techniques used to gain access to a system is to find a v
|
||||
|
||||
Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 3 illustrates how ASLR works by showing how the locations of different critical Windows components can change in memory between restarts.
|
||||
|
||||
|
||||
:::image type="content" alt-text="ASLR at work." source="images/security-fig4-aslr.png" lightbox="images/security-fig4-aslr.png":::
|
||||
|
||||
**Figure 3. ASLR at work**
|
||||
|
||||
@ -300,7 +300,7 @@ Some of the protections available in Windows 10 are provided through functions t
|
||||
|
||||
## Understanding Windows 10 in relation to the Enhanced Mitigation Experience Toolkit
|
||||
|
||||
You might already be familiar with the [Enhanced Mitigation Experience Toolkit (EMET)](https://support.microsoft.com/kb/2458544), which has since 2009 offered various exploit mitigations, and an interface for configuring those mitigations. You can use this section to understand how EMET mitigations relate to those mitigations in Windows 10. Many of EMET's mitigations have been built into Windows 10, some with extra improvements. However, some EMET mitigations carry high-performance cost, or appear to be relatively ineffective against modern threats, and therefore have not been brought into Windows 10.
|
||||
You might already be familiar with the [Enhanced Mitigation Experience Toolkit (EMET)](https://support.microsoft.com/topic/emet-mitigations-guidelines-b529d543-2a81-7b5a-d529-84b30e1ecee0), which has since 2009 offered various exploit mitigations, and an interface for configuring those mitigations. You can use this section to understand how EMET mitigations relate to those mitigations in Windows 10. Many of EMET's mitigations have been built into Windows 10, some with extra improvements. However, some EMET mitigations carry high-performance cost, or appear to be relatively ineffective against modern threats, and therefore have not been brought into Windows 10.
|
||||
|
||||
Because many of EMET's mitigations and security mechanisms already exist in Windows 10 and have been improved, particularly the ones assessed to have high effectiveness at mitigating known bypasses, version 5.5*x* has been announced as the final major version release for EMET (see [Enhanced Mitigation Experience Toolkit](https://web.archive.org/web/20170928073955/https://technet.microsoft.com/en-US/security/jj653751)).
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user