From e12626e9da4e5fb934aa117ea313f49e76ca0519 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Thu, 11 Jun 2020 15:21:47 +0530 Subject: [PATCH 1/9] replaced invalid link to correct link as per the report from Microsoft Employee-issue #6922 . so i changed to correct link --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 89b074632e..02ddfa2a9b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -399,7 +399,7 @@ GUID: `e6db77e5-3df2-4cf1-b95a-636979351e5b` ## Related topics -- [Attack surface reduction FAQ](attack-surface-reduction.md) +- [Attack surface reduction FAQ](attack-surface-reduction-faq.md) - [Enable attack surface reduction rules](enable-attack-surface-reduction.md) From a60c83df3d18e01cd2ad59f34f8680096fe5cabb Mon Sep 17 00:00:00 2001 From: Aacer Daken <41165107+AaDake@users.noreply.github.com> Date: Thu, 11 Jun 2020 16:51:05 -0700 Subject: [PATCH 2/9] Update index.md Updated section name of Kernel DMA Protection, to reflect the update title of the document --- windows/security/information-protection/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/index.md b/windows/security/information-protection/index.md index c2050be90b..84ea720232 100644 --- a/windows/security/information-protection/index.md +++ b/windows/security/information-protection/index.md @@ -22,7 +22,7 @@ Learn more about how to secure documents and other data across your organization |-|-| | [BitLocker](bitlocker/bitlocker-overview.md)| Provides information about BitLocker, which is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. | | [Encrypted Hard Drive](encrypted-hard-drive.md)| Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. | -| [Kernel DMA Protection for Thunderbolt™ 3](kernel-dma-protection-for-thunderbolt.md)| Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. | +| [Kernel DMA Protection](kernel-dma-protection-for-thunderbolt.md)| Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to PCI accessible ports, such as Thunderbolt™ 3 ports. | | [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection/protect-enterprise-data-using-wip.md)|Provides info about how to create a Windows Information Protection policy that can help protect against potential corporate data leakage.| | [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md)| Windows 10 supports features to help prevent rootkits and bootkits from loading during the startup process. | | [Trusted Platform Module](tpm/trusted-platform-module-top-node.md)| Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that helps you with actions such as generating, storing, and limiting the use of cryptographic keys. | From c93f6ac2296f21d4a71285e79255df0fbe61af81 Mon Sep 17 00:00:00 2001 From: Steve Burkett Date: Mon, 15 Jun 2020 16:24:36 +1200 Subject: [PATCH 3/9] Update mac-exclusions.md Remove extraneous escape characters in wildcard example. --- .../threat-protection/microsoft-defender-atp/mac-exclusions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md b/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md index af6fa6157c..d96e6da0ab 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md @@ -50,7 +50,7 @@ File, folder, and process exclusions support the following wildcards: Wildcard | Description | Example | Matches | Does not match ---|---|---|---|--- -\* | Matches any number of any characters including none (note that when this wildcard is used inside a path it will substitute only one folder) | `/var/\*/\*.log` | `/var/log/system.log` | `/var/log/nested/system.log` +\* | Matches any number of any characters including none (note that when this wildcard is used inside a path it will substitute only one folder) | `/var/*/*.log` | `/var/log/system.log` | `/var/log/nested/system.log` ? | Matches any single character | `file?.log` | `file1.log`
`file2.log` | `file123.log` ## How to configure the list of exclusions From 4e696b00f68822f9899d6c450c3c128e30a8ccbf Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 17 Jun 2020 12:32:29 +0500 Subject: [PATCH 4/9] Changes as per user suggestion As per user's recommendation, document has been updated. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5404 --- .../access-control/active-directory-security-groups.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/access-control/active-directory-security-groups.md b/windows/security/identity-protection/access-control/active-directory-security-groups.md index 2c3214bc3c..4a94f45a39 100644 --- a/windows/security/identity-protection/access-control/active-directory-security-groups.md +++ b/windows/security/identity-protection/access-control/active-directory-security-groups.md @@ -111,8 +111,8 @@ The following table lists the three group scopes and more information about each

Accounts from any domain in the same forest

Global groups from any domain in the same forest

Other Universal groups from any domain in the same forest

-

Can be converted to Domain Local scope

-

Can be converted to Global scope if the group is not a member of any other Universal groups

+

Can be converted to Domain Local scope if the group is not a member of any other Universal groups

+

Can be converted to Global scope if the group does not contain any other Universal groups

On any domain in the same forest or trusting forests

Other Universal groups in the same forest

Domain Local groups in the same forest or trusting forests

From 6973aee120a88c14e4cbd648099c273d73f04f6e Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Wed, 17 Jun 2020 20:43:59 +0530 Subject: [PATCH 5/9] added word *REG_DWORD* as per the user report #6977 , so i added **Type : REG_DWORD** --- .../microsoft-defender-antivirus-compatibility.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md index 2cb802f3b8..07b211d997 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md @@ -50,6 +50,7 @@ The following table summarizes what happens with Microsoft Defender Antivirus wh If you are Using Windows Server, version 1803 and Windows 2019, you can enable passive mode by setting this registry key: - Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` - Name: ForceDefenderPassiveMode +- Type: REG_DWORD - Value: 1 See [Microsoft Defender Antivirus on Windows Server 2016 and 2019](microsoft-defender-antivirus-on-windows-server-2016.md) for key differences and management options for Windows Server installations. From 0497bc6d4f645116b073e7295b35d18fb1fac8f7 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Wed, 17 Jun 2020 23:27:37 +0530 Subject: [PATCH 6/9] Added word *type:REG_DWORD As per the user report #6978 , so I added **type:reg_dword** --- .../microsoft-defender-atp/configure-server-endpoints.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index c3acfa8df0..990cd51ee1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -156,6 +156,7 @@ Support for Windows Server, provide deeper insight into activities happening on 1. Set the following registry entry: - Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` - Name: ForceDefenderPassiveMode + - Type: REG_DWORD - Value: 1 1. Run the following PowerShell command to verify that the passive mode was configured: From 2e2d29027045fb3da12d129698941a5eb8238736 Mon Sep 17 00:00:00 2001 From: Michael House Date: Wed, 17 Jun 2020 22:49:46 -0700 Subject: [PATCH 7/9] Additional benefits to calibration --- devices/hololens/hololens-calibration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-calibration.md b/devices/hololens/hololens-calibration.md index dc20ced641..230e8c5c55 100644 --- a/devices/hololens/hololens-calibration.md +++ b/devices/hololens/hololens-calibration.md @@ -25,7 +25,7 @@ While both devices need to calibrate for the best hologram viewing experience, t ## Calibrating your HoloLens 2 -HoloLens 2 uses eye-tracking technology to improve your experience seeing and interacting with the virtual environment. Calibrating the HoloLens 2 ensures that it can accurately track your eyes (and the eyes of anyone else who uses the device). After calibration, holograms will appear correctly even as the visor shifts on your head. +HoloLens 2 uses eye-tracking technology to improve your experience seeing and interacting with the virtual environment. Calibrating the HoloLens 2 ensures that it can accurately track your eyes (and the eyes of anyone else who uses the device). It also helps with user comfort, hologram alignment, and hand tracking. After calibration, holograms will appear correctly even as the visor shifts on your head. HoloLens 2 prompts a user to calibrate the device under the following circumstances: From 709061dbcc06132434077d38536bff23df2750f6 Mon Sep 17 00:00:00 2001 From: Aacer Daken <41165107+AaDake@users.noreply.github.com> Date: Thu, 18 Jun 2020 13:43:46 -0700 Subject: [PATCH 8/9] Update TOC.md Updated the title of the Kernel DMA Protection document, to reflect the new name --- windows/security/information-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md index 6d79db4dc3..d8a2cdfedd 100644 --- a/windows/security/information-protection/TOC.md +++ b/windows/security/information-protection/TOC.md @@ -38,7 +38,7 @@ ## [Encrypted Hard Drive](encrypted-hard-drive.md) -## [Kernel DMA Protection for Thunderbolt™ 3](kernel-dma-protection-for-thunderbolt.md) +## [Kernel DMA Protection](kernel-dma-protection-for-thunderbolt.md) ## [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection\protect-enterprise-data-using-wip.md) ### [Create a WIP policy using Microsoft Intune](windows-information-protection\overview-create-wip-policy.md) From e6fec622279d98e277e25f825178bdf0b0a28460 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 18 Jun 2020 14:07:49 -0700 Subject: [PATCH 9/9] Added type to code block, added missing periods Second round for this following a force-push or something --- .../microsoft-defender-atp/configure-server-endpoints.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index 990cd51ee1..537ebb95b2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -85,9 +85,9 @@ You'll need to take the following steps if you choose to onboard servers through Microsoft Defender ATP integrates with System Center Endpoint Protection. The integration provides visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware. The following steps are required to enable this integration: -- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie) +- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie). -- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting +- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting. ### Turn on Server monitoring from the Microsoft Defender Security Center portal @@ -186,7 +186,7 @@ The following capabilities are included in this integration: > Automated onboarding is only applicable for Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016. - Servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console. -- Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach +- Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach. > [!IMPORTANT] > - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default. @@ -234,7 +234,7 @@ To offboard the server, you can use either of the following methods: 2. Open an elevated PowerShell and run the following command. Use the Workspace ID you obtained and replacing `WorkspaceID`: - ``` + ```powershell # Load agent scripting object $AgentCfg = New-Object -ComObject AgentConfigManager.MgmtSvcCfg # Remove OMS Workspace