mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 14:27:22 +00:00
Merge branch 'master' of https://github.com/Microsoft/win-cpub-itpro-docs
This commit is contained in:
JanKeller1
commit
4cf5ec8f4b
@ -19,6 +19,7 @@ This topic lists new and updated topics in the [Surface Hub Admin Guide]( surfac
|
||||
| New or changed topic | Description |
|
||||
| --- | --- |
|
||||
| [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) | Added graphics cards verified to work with 84" Surface Hubs and added information about the lengths of cables. |
|
||||
| [Online deployment](online-deployment-surface-hub-device-accounts.md) | Updated procedures for adding a device account for your Microsoft Surface Hub when you have a pure, online deployment. |
|
||||
|
||||
## December 2016
|
||||
|
||||
|
||||
@ -99,7 +99,7 @@ If you have a single-forest on-premises deployment with Microsoft Exchange 2013
|
||||
8. OPTIONAL: You can also allow your Surface Hub to make and receive public switched telephone network (PSTN) phone calls by enabling Enterprise Voice for your account. Enterprise Voice isn't a requirement for Surface Hub, but if you want PSTN dialing functionality for the Surface Hub client, here's how to enable it:
|
||||
|
||||
```PowerShell
|
||||
CsMeetingRoom HUB01 -DomainController DC-ND-001.contoso.com
|
||||
Set-CsMeetingRoom HUB01 -DomainController DC-ND-001.contoso.com
|
||||
-LineURItel: +14255550555;ext=50555" Set-CsMeetingRoom -DomainController DC-ND-001.contoso.com
|
||||
-Identity HUB01 -EnterpriseVoiceEnabled $true
|
||||
```
|
||||
|
||||
@ -54,13 +54,10 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
$easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
|
||||
```
|
||||
|
||||
Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too.
|
||||
Once you have a compatible policy, then you will need to apply the policy to the device account.
|
||||
|
||||
```PowerShell
|
||||
Set-Mailbox 'HUB01@contoso.com' -Type Regular
|
||||
Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.Id
|
||||
Set-Mailbox 'HUB01@contoso.com' -Type Room
|
||||
Set-Mailbox 'HUB01@contoso.com' -RoomMailboxPassword (ConvertTo-SecureString -String <password> -AsPlainText -Force) -EnableRoomMailboxAccount $true
|
||||
```
|
||||
|
||||
4. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
|
||||
@ -84,7 +81,10 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
Set-MsolUser -UserPrincipalName 'HUB01@contoso.com' -PasswordNeverExpires $true
|
||||
```
|
||||
|
||||
7. The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account.
|
||||
7. Surface Hub requires a license for Skype for Business functionality.
|
||||
- Your Surface Hub account requires a Lync Online (Plan 2) or Lync Online (Plan 3) license, but it does not require an Exchange Online license.
|
||||
- You'll need to have Lync Online (Plan 2) or higher in your O365 plan. The plan needs to support conferencing capability.
|
||||
- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Lync Online (Plan 3).
|
||||
|
||||
Next, you can use `Get-MsolAccountSku` to retrieve a list of available SKUs for your O365 tenant.
|
||||
|
||||
@ -98,15 +98,6 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
|
||||
8. Enable the device account with Skype for Business.
|
||||
|
||||
In order to enable Skype for Business, your environment will need to meet the following prerequisites:
|
||||
|
||||
- You'll need to have Lync Online (Plan 2) or higher in your O365 plan. The plan needs to support conferencing capability.
|
||||
- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Lync Online (Plan 3).
|
||||
- Your tenant users must have Exchange mailboxes.
|
||||
- Your device account needs a Lync Online (Plan 2) or Lync Online (Plan 3) license, but it does not require an Exchange Online license.
|
||||
|
||||
<!-- -->
|
||||
|
||||
- Start by creating a remote PowerShell session from a PC.
|
||||
|
||||
```PowerShell
|
||||
@ -115,34 +106,25 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
Import-PSSession $cssess -AllowClobber
|
||||
```
|
||||
|
||||
- To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool
|
||||
"sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
|
||||
```
|
||||
|
||||
If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet:
|
||||
- Next, if you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet (for example, *alice@contoso.com*):
|
||||
|
||||
```PowerShell
|
||||
Get-CsOnlineUser -Identity ‘alice@contoso.com’| fl *registrarpool*
|
||||
```
|
||||
OR by setting a variable
|
||||
```PowerShell
|
||||
$strRegistrarPool = (Get-CsOnlineUser -Identity ‘alice@contoso.com’).RegistrarPool
|
||||
```
|
||||
|
||||
9. Assign Skype for Business license to your Surface Hub account.
|
||||
- Enable the Surface Hub account with the following cmdlet:
|
||||
|
||||
Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) to the device.
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool yourRegistrarPool -SipAddressType EmailAddress
|
||||
OR using the $strRegistarPool variable from above
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool $strRegistrarPool -SipAddressType EmailAddress
|
||||
```
|
||||
|
||||
- Login as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app.
|
||||
- Click on **Users and Groups** and then **Add users, reset passwords, and more**.
|
||||
- Select the Surface Hub account, and then click or tap the pen icon, which means edit.
|
||||
- Click on the **Licenses** option.
|
||||
- In the **Assign licenses** section, you need to select Skype for Business (Plan 2) or Skype for Business (Plan 3), depending on your licensing and what you've decided in terms of needing Enterprise Voice. You'll have to use a Plan 3 license if you want to use Enterprise Voice on your Surface Hub.
|
||||
- Click **Save** and you're done.
|
||||
|
||||
>[!NOTE]
|
||||
>It's also possible to use the Windows Azure Active Directory Module for Windows PowerShell to run the cmdlets needed to assign one of these licenses, but that's not covered here.
|
||||
|
||||
For validation, you should be able to use any Skype for Business client (PC, Android, etc) to log in to this account.
|
||||
For validation, you should be able to use any Skype for Business client (PC, Android, etc) to sign in to this account.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ There are several ways to manage your BitLocker key on the Surface Hub.
|
||||
|
||||
2. If you’ve joined the Surface Hub to Azure Active Directory (Azure AD), the BitLocker key will be stored under the account that was used to join the device.
|
||||
|
||||
3. If you’re using a local admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive.
|
||||
3. If you’re using an admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -184,7 +184,7 @@ In Replacement PC mode, the power states are only Ready and Off and only change
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>5</p></td>
|
||||
<td align="left"><p>50</p></td>
|
||||
<td align="left"><p>S0</p></td>
|
||||
<td align="left"><p>Ready</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
|
||||
@ -37,6 +37,10 @@
|
||||
### [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
|
||||
#### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md)
|
||||
#### [Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md)
|
||||
#### [Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md)
|
||||
#### [Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md)
|
||||
## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md)
|
||||
## [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md)
|
||||
## [VPN technical guide](vpn-guide.md)
|
||||
### [VPN connection types](vpn-connection-type.md)
|
||||
### [VPN routing decisions](vpn-routing.md)
|
||||
@ -872,4 +876,5 @@
|
||||
### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md)
|
||||
### [Windows 10 security overview](windows-10-security-guide.md)
|
||||
### [Windows 10 credential theft mitigation guide abstract](windows-credential-theft-mitigation-guide-abstract.md)
|
||||
### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md)
|
||||
## [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md)
|
||||
|
||||
@ -12,10 +12,15 @@ author: brianlic-msft
|
||||
# Change history for Keep Windows 10 secure
|
||||
This topic lists new and updated topics in the [Keep Windows 10 secure](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
|
||||
|
||||
## December 2016
|
||||
|
||||
## January 2017
|
||||
|New or changed topic |Description |
|
||||
| --- | --- |
|
||||
|---------------------|------------|
|
||||
|[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |New |
|
||||
|[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |New |
|
||||
|
||||
## December 2016
|
||||
|New or changed topic |Description |
|
||||
|---------------------|------------|
|
||||
|[Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) |Added filter examples for Windows 10 and Windows Server 2016. |
|
||||
|
||||
|
||||
|
||||
@ -45,7 +45,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You
|
||||
|
||||
5. Press the **Enter** key or click **OK**.
|
||||
|
||||
For for information on how you can manually validate that the endpoint is compliant and correctly reports telemetry see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
|
||||
For for information on how you can manually validate that the endpoint is compliant and correctly reports sensor data see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
## Configure sample collection settings
|
||||
For each endpoint, you can set a configuration value to state whether samples can be collected from the endpoint when a request is made through the Windows Defender ATP portal to submit a file for deep analysis.
|
||||
|
||||
@ -21,7 +21,7 @@ localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
Endpoints in your organization must be configured so that the Windows Defender ATP service can get telemetry from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization.
|
||||
Endpoints in your organization must be configured so that the Windows Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization.
|
||||
|
||||
Windows Defender ATP supports the following deployment tools and methods:
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report telemetry and communicate with the Windows Defender ATP service.
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
|
||||
The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service.
|
||||
|
||||
|
||||
@ -22,11 +22,10 @@ This section includes info about the enlightened Microsoft apps, including how t
|
||||
## In this section
|
||||
|Topic |Description |
|
||||
|------|------------|
|
||||
|[Windows Information Protection (WIP) overview](wip-enterprise-overview.md) |High-level overview info about why to use WIP, the enterprise scenarios, and how to turn it off. |
|
||||
|[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |A list of all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. |
|
||||
|[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. |
|
||||
|[Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) |We've come up with a list of suggested testing scenarios that you can use to test WIP in your company. |
|
||||
|[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |The most common problems you might encounter while using Windows Information Protection (WIP). |
|
||||
|[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |Learn the difference between enlightened and unenlightened app behaviors. |
|
||||
|[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |Recommended additions for the Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). |
|
||||
|[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |Options for using Outlook Web Access (OWA) with Windows Information Protection (WIP). |
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -0,0 +1,76 @@
|
||||
---
|
||||
title: How to use single sign on (SSO) over VPN and Wi-Fi connections (Windows 10)
|
||||
description: Explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: justinha
|
||||
---
|
||||
|
||||
# How to use single sign on (SSO) over VPN and Wi-Fi connections
|
||||
|
||||
This topic explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections. The scenario is:
|
||||
|
||||
- You connect to a network using Wi-Fi or VPN.
|
||||
- You want to use the credentials that you use for the WiFi or VPN authentication to also authenticate requests to access a domain resource you are connecting to, without being prompted for your domain credentials separately.
|
||||
|
||||
For example, you want to connect to a corporate network and access an internal website that requires Windows integrated authentication.
|
||||
|
||||
At a high level, the way this works is that the credentials that are used for the connection authentication are put in Credential Manager as the default credentials for the logon session.
|
||||
Credential Manager is a place where credentials in the OS are can be stored for specific domain resources based on the targetname of the resource.
|
||||
For VPN, the VPN stack saves its credential as the session default.
|
||||
For WiFi, EAP does it.
|
||||
|
||||
The credentials are put in Credential Manager as a "`*Session`" credential.
|
||||
A "`*Session`" credential implies that it is valid for the current user session.
|
||||
The credentials are also cleaned up when the WiFi or VPN connection is disconnected.
|
||||
|
||||
When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so WinInit.exe can release the credentials that it gets from the Credential Manager to the SSP that is requesting it.
|
||||
For more information about the Enterprise Authentication capability, see [App capability declarations](https://msdn.microsoft.com/windows/uwp/packaging/app-capability-declarations).
|
||||
|
||||
WinInit.exe will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability.
|
||||
If the app is not UWP, it does not matter.
|
||||
But if it is a UWP app, it will look at the device capability for Enterprise Authentication.
|
||||
If it does have that capability and if the resource that you are trying to access is in the Intranet zone in the Internet Options (ZoneMap), then the credential will be released.
|
||||
|
||||
## Intranet zone
|
||||
|
||||
For the Intranet zone, by default it only allows single-label names, such as Http://finance.
|
||||
If the resource that needs to be accessed has multiple domain labels, then the workaround is to use the [Registry CSP](https://msdn.microsoft.com/library/windows/hardware/dn904964.aspx).
|
||||
|
||||
### Setting the ZoneMap
|
||||
|
||||
The ZoneMap is controlled using a registry that can be set through MDM.
|
||||
By default, single-label names such as http://finance are already in the intranet zone.
|
||||
For multi-label names, such as http://finance.net, the ZoneMap needs to be updated.
|
||||
|
||||
## MDM Policy
|
||||
|
||||
OMA URI example:
|
||||
|
||||
./Vendor/MSFT/Registry/HKU/S-1-5-21-2702878673-795188819-444038987-2781/Software/Microsoft/Windows/CurrentVersion/Internet%20Settings/ZoneMap/Domains/`<domain name>`/* as an Integer Value of 1 for each of the domains that you want to SSO into from your device. This adds the specified domains to the Intranet Zone of the Edge browser.
|
||||
|
||||
## Credential requirements
|
||||
|
||||
For VPN, the following types of credentials will be added to credential manager after authentication:
|
||||
|
||||
- Username and password
|
||||
- Certificate-based authentication:
|
||||
- TPM KSP Certificate
|
||||
- Software KSP Certificates
|
||||
- Smart Card Certificate
|
||||
- Passport for Work Certificate
|
||||
|
||||
The username should also include a domain that can be reached over the connection (VPN or WiFi).
|
||||
|
||||
## User certificate templates
|
||||
|
||||
If the credentials are certificate-based, then the elements in the following table need to be configured for the certificate templates to ensure they can also be used for Kerberos client authentication.
|
||||
|
||||
| TEmplate element | Configuration |
|
||||
|------------------|---------------|
|
||||
| SubjectName | The user’s distinguished name (DN) where the domain components of the distinguished name reflects the internal DNS namespace when the SubjectAlternativeName does not have the fully qualified UPN required to find the domain controller. </br>This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located. |
|
||||
| SubjectAlternativeName | The user’s fully qualified UPN where a domain name component of the user’s UPN matches the organizations internal domain’s DNS namespace.</br>This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located when the SubjectName does not have the DN required to find the domain controller. |
|
||||
| Key Storage Provider (KSP) | If the device is joined to Azure AD, a discrete SSO certificate is used. This certificate must be issued using the PassportForWork CSP. |
|
||||
| EnhancedKeyUsage | One or more of the following EKUs is required: </br>- Client Authentication (for the VPN) </br>- EAP Filtering OID (for PassportForWork)</br>- SmartCardLogon (for Azure AD joined devices)</br>If the domain controllers require smart card EKU either:</br>- SmartCardLogon</br>- id-pkinit-KPClientAuth (1.3.6.1.5.2.3.4)</br>Otherwise:</br>- TLS/SSL Client Authentication (1.3.6.1.5.5.7.3.2) |
|
||||
@ -34,8 +34,6 @@ If this policy is disabled, the full name of the last user to log on is displaye
|
||||
|
||||
Your implementation of this policy depends on your security requirements for displayed logon information. If you have devices that store sensitive data, with monitors displayed in unsecured locations, or if you have devices with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy.
|
||||
|
||||
Depending on your security policy, you might also want to enable the [Interactive logon: Display user information when the session is locked](interactive-logon-display-user-information-when-the-session-is-locked.md) policy, which will prevent the Windows operating system from displaying the logon name when the session is locked or started.
|
||||
|
||||
### Location
|
||||
|
||||
Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
|
||||
|
||||
@ -21,12 +21,12 @@ localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of active malware detections. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting telemetry in your network.
|
||||
The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of active malware detections. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting sensor data in your network.
|
||||
|
||||
Use the Machines view in these two main scenarios:
|
||||
|
||||
- **During onboarding**
|
||||
- During the onboarding process, the Machines view gradually gets populated with endpoints as they begin to report telemetry. Use this view to track your onboarded endpoints as they appear. Use the available features to sort and filer to see which endpoints have most recently reported telemetry, or download the complete endpoint list as a CSV file for offline analysis.
|
||||
- During the onboarding process, the Machines view gradually gets populated with endpoints as they begin to report sensor data. Use this view to track your onboarded endpoints as they appear. Use the available features to sort and filer to see which endpoints have most recently reported sensor data, or download the complete endpoint list as a CSV file for offline analysis.
|
||||
- **Day-to-day work**
|
||||
- The **Machines view** enables you to identify machines that are most at risk in a glance. High-risk machines are those with the greatest number and highest-severity alerts. By sorting the machines by risk, you'll be able to identify the most vulnerable machines and take action on them.
|
||||
|
||||
@ -34,7 +34,7 @@ The Machines view contains the following columns:
|
||||
|
||||
- **Machine name** - the name or GUID of the machine
|
||||
- **Domain** - the domain the machine belongs to
|
||||
- **Last seen** - when the machine last reported telemetry
|
||||
- **Last seen** - when the machine last reported sensor data
|
||||
- **Internal IP** - the local internal Internet Protocol (IP) address of the machine
|
||||
- **Active Alerts** - the number of alerts reported by the machine by severity
|
||||
- **Active malware detections** - the number of active malware detections reported by the machine
|
||||
@ -59,7 +59,7 @@ You can filter the view by the following time periods:
|
||||
- 6 months
|
||||
|
||||
> [!NOTE]
|
||||
> When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period.
|
||||
> When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported sensor data within the last 24-hour period.
|
||||
|
||||
The threat category filter lets you filter the view by the following categories:
|
||||
|
||||
@ -94,7 +94,7 @@ When you investigate a specific machine, you'll see:
|
||||
- **Alerts related to this machine**
|
||||
- **Machine timeline**
|
||||
|
||||
The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting telemetry to the Windows Defender ATP service.
|
||||
The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting sensor data to the Windows Defender ATP service.
|
||||
|
||||
The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. This list is a simplified version of the [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows the date that the alert was detected, a short description of the alert, the alert's severity, the alert's threat category, and the alert's status in the queue.
|
||||
|
||||
|
||||
@ -61,7 +61,7 @@ Before you configure endpoints, the telemetry and diagnostics service must be en
|
||||
|
||||
### Telemetry and diagnostics settings
|
||||
You must ensure that the telemetry and diagnostics service is enabled on all the endpoints in your organization.
|
||||
By default, this service is enabled, but it's good practice to check to ensure that you'll get telemetry from them.
|
||||
By default, this service is enabled, but it's good practice to check to ensure that you'll get sensor data from them.
|
||||
|
||||
**Use the command line to check the Windows 10 telemetry and diagnostics service startup type**:
|
||||
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
---
|
||||
title: Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP) (Windows 10)
|
||||
description: Recommended URLs to add to your Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP).
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Neutral Resources, WIP and Enterprise Cloud Resources
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
localizationpriority: high
|
||||
---
|
||||
|
||||
# Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607
|
||||
- Windows 10 Mobile
|
||||
|
||||
>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare).
|
||||
|
||||
We recommend that you add the following URLs to the Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP).
|
||||
|
||||
## Recommended Enterprise Cloud Resources
|
||||
This table includes the recommended URLs to add to your Enterprise Cloud Resources network setting, based on the apps you use in your organization.
|
||||
|
||||
|If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting<br>(Replace "contoso" with your domain name(s) |
|
||||
|-----------------------------|---------------------------------------------------------------------|
|
||||
|Office 365 for Business |<ul><li>contoso.sharepoint.com</li><li>contoso-my.sharepoint.com</li><li>contoso-files.sharepoint.com</li><li>tasks.office.com</li><li>lists.office.com</li><li>collabdb.com</li><li>www.collabdb.com</li><li>protection.office.com</li><li>meet.lync.com</li><li>teams.microsoft.com</li></ul> |
|
||||
|Yammer |<ul><li>www.yammer.com</li><li>yammer.com</li><li>persona.yammer.com</li></ul> |
|
||||
|Microsoft Dynamics |contoso.crm.dynamics.com |
|
||||
|Visual Studio Online |contoso.visualstudio.com |
|
||||
|Power BI |contoso.powerbi.com |
|
||||
|
||||
## Recommended Neutral Resources
|
||||
We recommended adding these URLs if you use the Neutral Resources network setting with Windows Information Protection (WIP).
|
||||
<ul>
|
||||
<li>login.microsoftonline.com</li>
|
||||
<li>login.windows.net</li>
|
||||
</ul>
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Troubleshoot Windows Defender ATP onboarding issues
|
||||
description: Troubleshoot issues that might arise during the onboarding of endpoints or to the Windows Defender ATP service.
|
||||
keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds, telemetry and diagnostics
|
||||
keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds, sensor data and diagnostics
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -214,7 +214,7 @@ First, you should check that the service is set to start automatically when Wind
|
||||
|
||||
### Ensure the endpoint has an Internet connection
|
||||
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report telemetry and communicate with the Windows Defender ATP service.
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
|
||||
WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment.
|
||||
|
||||
|
||||
35
windows/keep-secure/using-owa-with-wip.md
Normal file
35
windows/keep-secure/using-owa-with-wip.md
Normal file
@ -0,0 +1,35 @@
|
||||
---
|
||||
title: Using Outlook Web Access with Windows Information Protection (WIP) (Windows 10)
|
||||
description: Options for using Outlook Web Access (OWA) with Windows Information Protection (WIP).
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and OWA configuration
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
localizationpriority: high
|
||||
---
|
||||
|
||||
# Using Outlook Web Access with Windows Information Protection (WIP)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607
|
||||
- Windows 10 Mobile
|
||||
|
||||
>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare).
|
||||
|
||||
Because Outlook Web Access (OWA) can be used both personally and as part of your organization, you have the following options to configure it with Windows Information Protection (WIP):
|
||||
|
||||
|Option |OWA behavior |
|
||||
|-------|-------------|
|
||||
|Disable OWA. Employees can only use Microsoft Outlook 2016 or the Office 365 Mail app. | Disabled. |
|
||||
|Don't configure outlook.office.com in any of your networking settings. |All mailboxes are automatically marked as personal. This means employees attempting to copy work content into OWA receive prompts and that files downloaded from OWA aren't automatically protected as corporate data. |
|
||||
|Do all of the following:<ul><li>Create a domain (such as mail.contoso.com, redirecting to outlook.office.com) that can be used by your employees to access work email.</li><li>Add the new domain to the Enterprise Cloud Resources network element in your WIP policy.</li><li>Add the following URLs to the Neutral Resources network element in your WIP policy:<ul><li>outlook.office365.com</li><li>outlook.office.com</li><li>outlook-sdf.office.com</li><li>attachment.outlook.office.net</li></ul></li></ul> |Inbox content accessed through the new domain is automatically marked as corporate data, while content accessed through personal email is automatically marked as personal. |
|
||||
|Add outlook.office.com to the Enterprise Cloud Resources network element in your WIP policy. |All mailboxes are automatically marked as corporate. This means any personal inboxes hosted on Office 365 are also automatically marked as corporate data. |
|
||||
|
||||
>[!NOTE]
|
||||
>These limitations don’t apply to Outlook 2016 or to the Office 365 Mail and Calendar apps. These apps will work properly, marking an employee’s mailbox as corporate data, regardless of how you’ve configured outlook.office.com in your network settings.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ author: justinha
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
This topic provides a summary of the Windows 10 credential theft mitigation guide, which can be downloaded from the Microsoft Download Center.
|
||||
This topic provides a summary of the Windows 10 credential theft mitigation guide, which can be downloaded from the [Microsoft Download Center](http://download.microsoft.com/download/C/1/4/C14579CA-E564-4743-8B51-61C0882662AC/Windows 10 credential theft mitigation guide.docx).
|
||||
This guide explains how credential theft attacks occur and the strategies and countermeasures you can implement to mitigate them, following these security stages:
|
||||
|
||||
- Identify high-value assets
|
||||
|
||||
@ -32,7 +32,7 @@ Windows Defender ATP uses the following combination of technology built into Win
|
||||
- **Endpoint behavioral sensors**: Embedded in Windows 10, these sensors
|
||||
collect and process behavioral signals from the operating system
|
||||
(for example, process, registry, file, and network communications)
|
||||
and sends this telemetry to your private, isolated, cloud instance of Windows Defender ATP.
|
||||
and sends this sensor data to your private, isolated, cloud instance of Windows Defender ATP.
|
||||
|
||||
|
||||
- **Cloud security analytics**: Leveraging big-data, machine-learning, and
|
||||
@ -47,7 +47,7 @@ Windows Defender ATP uses the following combination of technology built into Win
|
||||
and augmented by threat intelligence provided by partners, threat
|
||||
intelligence enables Windows Defender ATP to identify attacker
|
||||
tools, techniques, and procedures, and generate alerts when these
|
||||
are observed in collected telemetry.
|
||||
are observed in collected sensor data.
|
||||
|
||||
The following diagram shows these Windows Defender ATP service
|
||||
components:
|
||||
|
||||
@ -25,7 +25,7 @@
|
||||
### [Manage Windows 10 and Windows Store tips, tricks, and suggestions](manage-tips-and-suggestions.md)
|
||||
### [New policies for Windows 10](new-policies-for-windows-10.md)
|
||||
### [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md)
|
||||
### [Changes to Group Policy settings for Windows 10 Start](changes-to-start-policies-in-windows-10.md)
|
||||
### [Changes to Group Policy settings for Windows 10 Start menu](changes-to-start-policies-in-windows-10.md)
|
||||
### [Windows 10 Mobile and MDM](windows-10-mobile-and-mdm.md)
|
||||
### [Introduction to configuration service providers (CSPs)](how-it-pros-can-use-configuration-service-providers.md)
|
||||
## [Windows Spotlight on the lock screen](windows-spotlight.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Changes to Group Policy settings for Windows 10 Start (Windows 10)
|
||||
title: Changes to Group Policy settings for Windows 10 Start menu (Windows 10)
|
||||
description: Windows 10 has a brand new Start experience.
|
||||
ms.assetid: 612FB68A-3832-451F-AA97-E73791FEAA9F
|
||||
keywords: ["group policy", "start menu", "start screen"]
|
||||
|
||||
@ -148,6 +148,7 @@ The following table defines the endpoints for telemetry services:
|
||||
| Connected User Experience and Telemetry component | v10.vortex-win.data.microsoft.com<br />settings-win.data.microsoft.com |
|
||||
| [Windows Error Reporting](http://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com |
|
||||
| [Online Crash Analysis](http://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com |
|
||||
| OneDrive UWP app (used by Windows 10 Mobile only) | vortex.data.microsoft.com/collect/v1 |
|
||||
|
||||
### Data use and access
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 68 KiB After Width: | Height: | Size: 60 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 64 KiB After Width: | Height: | Size: 54 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 66 KiB After Width: | Height: | Size: 62 KiB |
@ -23,10 +23,10 @@ You can integrate Windows Update for Business deployments with existing manageme
|
||||
## Integrate Windows Update for Business with Windows Server Update Services
|
||||
|
||||
|
||||
For Windows 10, version 1607, devices can now be configured to receive updates from both Windows Update and Windows Server Update Services (WSUS). In a joint WSUS and Windows Update for Business setup:
|
||||
For Windows 10, version 1607, devices can now be configured to receive updates from both Windows Update (or Microsoft Update) and Windows Server Update Services (WSUS). In a joint WSUS and Windows Update for Business setup:
|
||||
|
||||
- Devices will receive their Windows content from Microsoft and defer these updates according to Windows Update for Business policy
|
||||
- All other content synced from WSUS will be directly applied to the device; that is, non-Windows Updates content will not follow your Windows Update for Business deferral policies
|
||||
- All other content synced from WSUS will be directly applied to the device; that is, updates to products other than Windows will not follow your Windows Update for Business deferral policies
|
||||
|
||||
### Configuration example \#1: Deferring Windows Update updates with other update content hosted on WSUS
|
||||
|
||||
@ -34,13 +34,13 @@ For Windows 10, version 1607, devices can now be configured to receive updates f
|
||||
|
||||
- Device is configured to defer Windows Quality Updates using Windows Update for Business
|
||||
- Device is also configured to be managed by WSUS
|
||||
- Device is not configured to include Microsoft Updates from Windows Update (**Update/AllowMUUpdateService** = not enabled)
|
||||
- Admin has opted to put Microsoft updates on WSUS
|
||||
- Device is not configured to enable Microsoft Update (**Update/AllowMUUpdateService** = not enabled)
|
||||
- Admin has opted to put updates to Office and other products on WSUS
|
||||
- Admin has also put 3rd party drivers on WSUS
|
||||
|
||||
<table><thead><th>Content</th><th>Metadata source</th><th>Payload source</th><th>Deferred?</th><th></th></thead>
|
||||
<tbody><tr><td>Windows Update</td><td>Windows Update</td><td>Windows Update</td><td>Yes</td><td rowspan="3"></td></tr>
|
||||
<tr><td>Microsoft Update (such as Office updates)</td><td>WSUS</td><td>WSUS</td><td>No</td></tr>
|
||||
<tbody><tr><td>Updates to Windows</td><td>Windows Update</td><td>Windows Update</td><td>Yes</td><td rowspan="3"></td></tr>
|
||||
<tr><td>Updates to Office and other products</td><td>WSUS</td><td>WSUS</td><td>No</td></tr>
|
||||
<tr><td>Third-party drivers</td><td>WSUS</td><td>WSUS</td><td>No</td></tr>
|
||||
</table>
|
||||
|
||||
@ -54,10 +54,9 @@ For Windows 10, version 1607, devices can now be configured to receive updates f
|
||||
|
||||
|
||||
<table><thead><th>Content</th><th>Metadata source</th><th>Payload source</th><th>Deferred?</th><th></th></thead>
|
||||
<tbody><tr><td>Windows Update (exclude driver)</td><td>Windows Update</td><td>Windows Update</td><td>Yes</td><td rowspan="4"></td></tr>
|
||||
<tr><td>Windows Update drivers</td><td>WSUS</td><td>WSUS</td><td>No</td></tr>
|
||||
<tr><td>Microsoft Update (such as Office updates)</td><td>WSUS</td><td>WSUS</td><td>No</td></tr>
|
||||
<tr><td>Windows drivers, third-party drivers</td><td>WSUS</td><td>WSUS</td><td>No</td></tr>
|
||||
<tbody><tr><td>Updates to Windows (excluding drivers)</td><td>Windows Update</td><td>Windows Update</td><td>Yes</td><td rowspan="4"></td></tr>
|
||||
<tr><td>Updates to Office and other products</td><td>WSUS</td><td>WSUS</td><td>No</td></tr>
|
||||
<tr><td>Drivers</td><td>WSUS</td><td>WSUS</td><td>No</td></tr>
|
||||
|
||||
</table>
|
||||
|
||||
@ -66,18 +65,18 @@ For Windows 10, version 1607, devices can now be configured to receive updates f
|
||||
**Configuration:**
|
||||
|
||||
- Device is configured to defer Quality Updates using Windows Update for Business and to be managed by WSUS
|
||||
- Device is configured to “receive updates for other Microsoft products” along with Windows Update updates (**Update/AllowMUUpdateService** = enabled)
|
||||
- Admin has also placed Microsoft Update content on the WSUS server
|
||||
- Device is configured to “receive updates for other Microsoft products” along with updates to Windows (**Update/AllowMUUpdateService** = enabled)
|
||||
- Admin has also placed Microsoft Update, third-paprty, and locally-published update content on the WSUS server
|
||||
|
||||
In this example, the Microsoft Update deferral behavior is slightly different than if WSUS were not enabled.
|
||||
- In a non-WSUS case, the Microsoft Update updates would be deferred just as any Windows Update update would be.
|
||||
- However, with WSUS also configured, Microsoft Update content is sourced from Microsoft but deferral policies are not applied.
|
||||
In this example, the deferral behavior for updates to Office and other non-Windows products is slightly different than if WSUS were not enabled.
|
||||
- In a non-WSUS case, these updates would be deferred just as any update to Windows would be.
|
||||
- However, with WSUS also configured, these updates are sourced from Microsoft but deferral policies are not applied.
|
||||
|
||||
|
||||
<table><thead><th>Content</th><th>Metadata source</th><th>Payload source</th><th>Deferred?</th><th></th></thead>
|
||||
<tbody><tr><td>Windows Update (exclude drivers)</td><td>Windows Update</td><td>Windows Update</td><td>Yes</td><td rowspan="3"></td></tr>
|
||||
<tr><td>Microsoft Update (such as Office updates)</td><td>Microsoft Update</td><td>Microsoft Update</td><td>No</td></tr>
|
||||
<tr><td>Drivers, third-party</td><td>WSUS</td><td>WSUS</td><td>No</td></tr>
|
||||
<tbody><tr><td>Updates to Windows (excluding drivers)</td><td>Microsoft Update</td><td>Microsoft Update</td><td>Yes</td><td rowspan="3"></td></tr>
|
||||
<tr><td>Updates to Office and other products</td><td>Microsoft Update</td><td>Microsoft Update</td><td>No</td></tr>
|
||||
<tr><td>Drivers, third-party applications</td><td>WSUS</td><td>WSUS</td><td>No</td></tr>
|
||||
</table>
|
||||
|
||||
>[!NOTE]
|
||||
|
||||
@ -27,7 +27,7 @@ When you set the **Configure Automatic Updates** policy to **Auto download and s
|
||||
When **Configure Automatic Updates** is enabled, you can enable one of the following additional policies to manage device restart:
|
||||
|
||||
- **Turn off auto-restart for updates during active hours** prevents automatic restart during active hours.
|
||||
- **Always automatically restart at the scheduled time** forces a restart after the specified installation time and lets you configure a timer to warn a signed-in user that a restart is going to occur.
|
||||
- **Always automatically restart at the scheduled time** forces a restart after the specified installation time and lets you configure a timer to warn a signed-in user that a restart is going to occur. To set the time, you need to go **Configure Automatic Updates**, select option **4 - Auto download and schedule the install**, and then enter a time in the **Scheduled install time** dropdown.
|
||||
- **No auto-restart with logged on users for scheduled automatic updates installations** prevents automatic restart when a user is signed in. If a user schedules the restart in the update notification, the device will restart at the time the user specifies even if a user is signed in at the time. This policy only applies when **Configure Automatic Updates** is set to option **4-Auto download and schedule the install**.
|
||||
|
||||
## Configure active hours
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user