diff --git a/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index ab1c7f7bb2..a20d25ff66 100644 --- a/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -2,79 +2,113 @@ title: BitLocker Use BitLocker Drive Encryption Tools to manage BitLocker (Windows 10) description: This topic for the IT professional describes how to use tools to manage BitLocker. ms.assetid: e869db9c-e906-437b-8c70-741dd61b5ea6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker + **Applies to** - Windows 10 + This topic for the IT professional describes how to use tools to manage BitLocker. + BitLocker Drive Encryption Tools include the command line tools manage-bde and repair-bde and the BitLocker cmdlets for Windows PowerShell. + Both manage-bde and the BitLocker cmdlets can be used to perform any task that can be accomplished through the BitLocker control panel and are appropriate to use for automated deployments and other scripting scenarios. + Repair-bde is a special circumstance tool that is provided for disaster recovery scenarios in which a BitLocker protected drive cannot be unlocked normally or using the recovery console. + 1. [Manage-bde](#bkmk-managebde) 2. [Repair-bde](#bkmk-repairbde) 3. [BitLocker cmdlets for Windows PowerShell](#bkmk-blcmdlets) + ## Manage-bde + Manage-bde is a command-line tool that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the manage-bde options, see the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line reference. + Manage-bde includes less default settings and requires greater customization for configuring BitLocker. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. The following sections provide examples of common usage scenarios for manage-bde. + ### Using manage-bde with operating system volumes + Listed below are examples of basic valid commands for operating system volumes. In general, using only the `manage-bde -on ` command will encrypt the operating system volume with a TPM-only protector and no recovery key. However, many environments require more secure protectors such as passwords or PIN and expect to be able to recover information with a recovery key. It is recommended that at least one primary protector and a recovery protector be added to an operating system volume. + A good practice when using manage-bde is to determine the volume status on the target system. Use the following command to determine volume status: + ``` syntax manage-bde -status ``` This command returns the volumes on the target, current encryption status and volume type (operating system or data) for each volume. + The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. + ``` syntax manage-bde –protectors -add C: -startupkey E: manage-bde -on C: ``` -**Note**   -After the encryption is completed, the USB startup key must be inserted before the operating system can be started. + +>**Note:**  After the encryption is completed, the USB startup key must be inserted before the operating system can be started.   An alternative to the startup key protector on non-TPM hardware is to use a password and an **ADaccountorgroup** protector to protect the operating system volume. In this scenario, you would add the protectors first. This is done with the command: + ``` syntax manage-bde -protectors -add C: -pw -sid ``` + This command will require you to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, you can then turn BitLocker on. + On computers with a TPM it is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is: + ``` syntax manage-bde -on C: ``` + This will encrypt the drive using the TPM as the default protector. If you are not sure if a TPM protector is available, to list the protectors available for a volume, run the following command: + ``` syntax manage-bde -protectors -get ``` ### Using manage-bde with data volumes + Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or you can choose to add additional protectors to the volume first. It is recommended that at least one primary protector and a recovery protector be added to a data volume. + A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. + ``` syntax manage-bde -protectors -add -pw C: manage-bde -on C: ``` + ## Repair-bde + You may experience a problem that damages an area of a hard disk on which BitLocker stores critical information. This kind of problem may be caused by a hard disk failure or if Windows exits unexpectedly. + The BitLocker Repair Tool (Repair-bde) can be used to access encrypted data on a severely damaged hard disk if the drive was encrypted by using BitLocker. Repair-bde can reconstruct critical parts of the drive and salvage recoverable data as long as a valid recovery password or recovery key is used to decrypt the data. If the BitLocker metadata data on the drive has become corrupt, you must be able to supply a backup key package in addition to the recovery password or recovery key. This key package is backed up in Active Directory Domain Services (AD DS) if you used the default setting for AD DS backup. With this key package and either the recovery password or recovery key, you can decrypt portions of a BitLocker-protected drive if the disk is corrupted. Each key package will work only for a drive that has the corresponding drive identifier. You can use the BitLocker Recovery Password Viewer to obtain this key package from AD DS. -**Tip**   -If you are not backing up recovery information to AD DS or if you want to save key packages alternatively, you can use the command `manage-bde -KeyPackage` to generate a key package for a volume. + +>**Tip:**  If you are not backing up recovery information to AD DS or if you want to save key packages alternatively, you can use the command `manage-bde -KeyPackage` to generate a key package for a volume.   The Repair-bde command-line tool is intended for use when the operating system does not start or when you cannot start the BitLocker Recovery Console. You should use Repair-bde if the following conditions are true: + 1. You have encrypted the drive by using BitLocker Drive Encryption. 2. Windows does not start, or you cannot start the BitLocker recovery console. 3. You do not have a copy of the data that is contained on the encrypted drive. -**Note**   -Damage to the drive may not be related to BitLocker. Therefore, we recommend that you try other tools to help diagnose and resolve the problem with the drive before you use the BitLocker Repair Tool. The Windows Recovery Environment (Windows RE) provides additional options to repair computers. + +>**Note:**  Damage to the drive may not be related to BitLocker. Therefore, we recommend that you try other tools to help diagnose and resolve the problem with the drive before you use the BitLocker Repair Tool. The Windows Recovery Environment (Windows RE) provides additional options to repair computers.   The following limitations exist for Repair-bde: + - The Repair-bde command-line tool cannot repair a drive that failed during the encryption or decryption process. - The Repair-bde command-line tool assumes that if the drive has any encryption, then the drive has been fully encrypted. -For more information about using repair-bde see [Repair-bde](http://technet.microsoft.com/library/ff829851.aspx) + +For more information about using repair-bde, see [Repair-bde](http://technet.microsoft.com/library/ff829851.aspx). + ## BitLocker cmdlets for Windows PowerShell + Windows PowerShell cmdlets provide a new way for administrators to use when working with BitLocker. Using Windows PowerShell's scripting capabilities, administrators can integrate BitLocker options into existing scripts with ease. The list below displays the available BitLocker cmdlets. + @@ -205,72 +239,89 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the `Get-BitLockerVolume` cmdlet. The `Get-BitLockerVolume` cmdlet output gives information on the volume type, protectors, protection status and other details. -**Tip**   -Occasionally, all protectors may not be shown when using `Get-BitLockerVolume` due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a full listing of the protectors. + +>**Tip:**  Occasionally, all protectors may not be shown when using `Get-BitLockerVolume` due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a full listing of the protectors. `Get-BitLockerVolume C: | fl`   If you want to remove the existing protectors prior to provisioning BitLocker on the volume, you could use the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this requires the GUID associated with the protector to be removed. + A simple script can pipe the values of each Get-BitLockerVolume return out to another variable as seen below: + ``` syntax $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` + Using this, you can display the information in the $keyprotectors variable to determine the GUID for each protector. + Using this information, you can then remove the key protector for a specific volume using the command: + ``` syntax Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" ``` -**Note**   -The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. + +>**Note:**  The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command.   ### Using the BitLocker Windows PowerShell cmdlets with operating system volumes + Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes. Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them in BitLocker Windows PowerShell. + The following example shows how to enable BitLocker on an operating system drive using only the TPM protector: + ``` syntax Enable-BitLocker C: + ``` In the example below, adds one additional protector, the StartupKey protector and chooses to skip the BitLocker hardware test. In this example, encryption starts immediately without the need for a reboot. + ``` syntax Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTest ``` + ### Using the BitLocker Windows PowerShell cmdlets with data volumes -Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. + +Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a +SecureString value to store the user defined password. + ``` syntax $pw = Read-Host -AsSecureString Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw ``` ### Using an AD Account or Group protector in Windows PowerShell + The **ADAccountOrGroup** protector, introduced in Windows 8 and Windows Server 2012, is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover to and be unlocked by any member computer of the cluster. -**Warning**   -The **ADAccountOrGroup** protector requires the use of an additional protector for use (such as TPM, PIN, or recovery key) when used on operating system volumes + +>**Warning:**  The **ADAccountOrGroup** protector requires the use of an additional protector for use (such as TPM, PIN, or recovery key) when used on operating system volumes   To add an **ADAccountOrGroup** protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. + ``` syntax Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator ``` + For users who wish to use the SID for the account or group, the first step is to determine the SID associated with the account. To get the specific SID for a user account in Windows PowerShell, use the following command: -**Note**   -Use of this command requires the RSAT-AD-PowerShell feature. + +>**Note:**  Use of this command requires the RSAT-AD-PowerShell feature.   ``` syntax get-aduser -filter {samaccountname -eq "administrator"} ``` -**Tip**   -In addition to the PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features. + +>**Tip:**  In addition to the PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features.   The following example adds an **ADAccountOrGroup** protector to the previously encrypted operating system volume using the SID of the account: + ``` syntax Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup S-1-5-21-3651336348-8937238915-291003330-500 ``` -**Note**   -Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. + +>**Note:**  Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes.   ## More information -[BitLocker overview](bitlocker-overview.md) -[BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) -[Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) -[BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) -[BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) -  -  + +- [BitLocker overview](bitlocker-overview.md) +- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) +- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) +- [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) +- [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) diff --git a/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md index de1b0e8a2c..61521699b2 100644 --- a/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md +++ b/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md @@ -2,40 +2,56 @@ title: BitLocker Use BitLocker Recovery Password Viewer (Windows 10) description: This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. ms.assetid: 04c93ac5-5dac-415e-b636-de81435753a2 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # BitLocker: Use BitLocker Recovery Password Viewer + **Applies to** - Windows 10 + This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. + The BitLocker Recovery Password Viewer tool is an optional tool included with the Remote Server Administration Tools (RSAT). It lets you locate and view BitLocker recovery passwords that are stored in Active Directory Domain Services (AD DS). You can use this tool to help recover data that is stored on a drive that has been encrypted by using BitLocker. The BitLocker Active Directory Recovery Password Viewer tool is an extension for the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in. Using this tool, you can examine a computer object's **Properties** dialog box to view the corresponding BitLocker recovery passwords. Additionally, you can right-click a domain container and then search for a BitLocker recovery password across all the domains in the Active Directory forest. You can also search for a password by password identifier (ID). + ## Before you start + To complete the procedures in this scenario: + - You must have domain administrator credentials. - Your test computers must be joined to the domain. - On the test computers, BitLocker must have been turned on after joining the domain. + The following procedures describe the most common tasks performed by using the BitLocker Recovery Password Viewer. + **To view the recovery passwords for a computer** + 1. In **Active Directory Users and Computers**, locate and then click the container in which the computer is located. 2. Right-click the computer object, and then click **Properties**. 3. In the **Properties** dialog box, click the **BitLocker Recovery** tab to view the BitLocker recovery passwords that are associated with the computer. + **To copy the recovery passwords for a computer** + 1. Follow the steps in the previous procedure to view the BitLocker recovery passwords. 2. On the **BitLocker Recovery** tab of the **Properties** dialog box, right-click the BitLocker recovery password that you want to copy, and then click **Copy Details**. 3. Press CTRL+V to paste the copied text to a destination location, such as a text file or spreadsheet. + **To locate a recovery password by using a password ID** + 1. In Active Directory Users and Computers, right-click the domain container, and then click **Find BitLocker Recovery Password**. 2. In the **Find BitLocker Recovery Password** dialog box, type the first eight characters of the recovery password in the **Password ID (first 8 characters)** box, and then click **Search**. By completing the procedures in this scenario, you have viewed and copied the recovery passwords for a computer and used a password ID to locate a recovery password. + ## More information -[BitLocker Overview](bitlocker-overview.md) -[BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) -[Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) -[BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) -[BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md) + +- [BitLocker Overview](bitlocker-overview.md) +- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) +- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) +- [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) +- [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md)     diff --git a/windows/keep-secure/bypass-traverse-checking.md b/windows/keep-secure/bypass-traverse-checking.md index 17fb337e5a..d07fea0ff5 100644 --- a/windows/keep-secure/bypass-traverse-checking.md +++ b/windows/keep-secure/bypass-traverse-checking.md @@ -2,113 +2,90 @@ title: Bypass traverse checking (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Bypass traverse checking security policy setting. ms.assetid: 1c828655-68d3-4140-aa0f-caa903a7087e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Bypass traverse checking + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Bypass traverse checking** security policy setting. + ## Reference + This policy setting determines which users (or a process that acts on behalf of the user’s account) have permission to navigate an object path in the NTFS file system or in the registry without being checked for the Traverse Folder special access permission. This user right does not allow the user to list the contents of a folder. It only allows the user to traverse folders to access permitted files or subfolders. + Constant: SeChangeNotifyPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + 1. Use access–based enumeration when you want to prevent users from seeing any folder or file to which they do not have access. 2. Use the default settings of this policy in most cases. If you change the settings, verify your intent through testing. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. -
---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not Defined

Default Domain Controller Policy

Administrators

-

Authenticated Users

-

Everyone

-

Local Service

-

Network Service

-

Pre-Windows 2000 Compatible Access

Stand-Alone Server Default Settings

Administrators

-

Backup Operators

-

Users

-

Everyone

-

Local Service

-

Network Service

Domain Controller Effective Default Settings

Administrators

-

Authenticated Users

-

Everyone

-

Local Service

-

Network Service

-

Pre-Windows 2000 Compatible Access

Member Server Effective Default Settings

Administrators

-

Backup Operators

-

Users

-

Everyone

-

Local Service

-

Network Service

Client Computer Effective Default Settings

Administrators

-

Backup Operators

-

Users

-

Everyone

-

Local Service

-

Network Service

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not Defined | +| Default Domain Controller Policy | Administrators
Authenticated Users
Everyone
Local Service
Network Service
Pre-Windows 2000 Compatible Access| +| Stand-Alone Server Default Settings | Administrators
Backup Operators
Users
Everyone
Local Service
Network Service| +| Domain Controller Effective Default Settings | Administrators
Authenticated Users
Everyone
Local Service
Network Service
Pre-Windows 2000 Compatible Access| +| Member Server Effective Default Settings | Administrators
Backup Operators
Users
Everyone
Local Service
Network Service| +| Client Computer Effective Default Settings | Administrators
Backup Operators
Users
Everyone
Local Service
Network Service|   ## Policy management + Permissions to files and folders are controlled though the appropriate configuration of file system access control lists (ACLs).The ability to traverse the folder does not provide any Read or Write permissions to the user. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The default configuration for the **Bypass traverse checking** setting is to allow all users to bypass traverse checking. Permissions to files and folders are controlled though the appropriate configuration of file system access control lists (ACLs) because the ability to traverse the folder does not provide any Read or Write permissions to the user. The only scenario in which the default configuration could lead to a mishap would be if the administrator who configures permissions does not understand how this policy setting works. For example, the administrator might expect that users who are unable to access a folder are unable to access the contents of any child folders. Such a situation is unlikely, and, therefore, this vulnerability presents little risk. + ### Countermeasure + Organizations that are extremely concerned about security may want to remove the Everyone group, and perhaps the Users group, from the list of groups that have the **Bypass traverse checking** user right. Taking explicit control over traversal assignments can be an effective way to limit access to sensitive information. Access–based enumeration can also be used. If you use access–based enumeration, users cannot see any folder or file to which they do not have access. For more info about this feature, see [Access-based Enumeration](http://go.microsoft.com/fwlink/p/?LinkId=100745). + ### Potential impact + The Windows operating systems and many applications were designed with the expectation that anyone who can legitimately access the computer will have this user right. Therefore, we recommend that you thoroughly test any changes to assignments of the **Bypass traverse checking** user right before you make such changes to production systems. In particular, IIS requires this user right to be assigned to the Network Service, Local Service, IIS\_WPG, IUSR\_*<ComputerName>*, and IWAM\_*<ComputerName>* accounts. (It must also be assigned to the ASPNET account through its membership in the Users group.) We recommend that you leave this policy setting at its default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) + +- [User Rights Assignment](user-rights-assignment.md)     diff --git a/windows/keep-secure/change-the-system-time.md b/windows/keep-secure/change-the-system-time.md index f34f347c76..4ac7356093 100644 --- a/windows/keep-secure/change-the-system-time.md +++ b/windows/keep-secure/change-the-system-time.md @@ -2,106 +2,105 @@ title: Change the system time (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Change the system time security policy setting. ms.assetid: f2f6637d-acbc-4352-8ca3-ec563f918e65 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Change the system time + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Change the system time** security policy setting. + ## Reference + This policy setting determines which users can adjust the time on the device's internal clock. This right allows the computer user to change the date and time associated with records in the event logs, database transactions, and the file system. This right is also required by the process that performs time synchronization. This setting does not impact the user’s ability to change the time zone or other display characteristics of the system time. For info about assigning the right to change the time zone, see [Change the time zone](change-the-time-zone.md). + Constant: SeSystemtimePrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - Restrict the **Change the system time** user right to users with a legitimate need to change the system time. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, members of the Administrators and Local Service groups have this right on workstations and servers. Members of the Administrators, Server Operators, and Local Service groups have this right on domain controllers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not Defined

Default Domain Controller Policy

Administrators

-

Server Operators

-

Local Service

Stand-Alone Server Default Settings

Administrators

-

Local Service

DC Effective Default Settings

Administrators

-

Server Operators

-

Local Service

Member Server Effective Default Settings

Administrators

-

Local Service

Client Computer Effective Default Settings

Administrators

-

Local Service

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not Defined | +| Default Domain Controller Policy | Administrators
Server Operators
Local Service| +| Stand-Alone Server Default Settings | Administrators
Local Service| +| DC Effective Default Settings | Administrators
Server Operators
Local Service| +| Member Server Effective Default Settings | Administrators
Local Service| +| Client Computer Effective Default Settings | Administrators
Local Service|   ## Policy management + This section describes features, tools and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who can change the time on a computer could cause several problems. For example: + - Time stamps on event log entries could be made inaccurate - Time stamps on files and folders that are created or modified could be incorrect - Computers that belong to a domain might not be able to authenticate themselves - Users who try to log on to the domain from devices with inaccurate time might not be able to authenticate. + Also, because the Kerberos authentication protocol requires that the requester and authenticator have their clocks synchronized within an administrator-defined skew period, an attacker who changes a device's time may cause that computer to be unable to obtain or grant Kerberos protocol tickets. + The risk from these types of events is mitigated on most domain controllers, member servers, and end-user computers because the Windows Time Service automatically synchronizes time with domain controllers in the following ways: + - All desktop client devices and member servers use the authenticating domain controller as their inbound time partner. - All domain controllers in a domain nominate the primary domain controller (PDC) emulator operations master as their inbound time partner. - All PDC emulator operations masters follow the hierarchy of domains in the selection of their inbound time partner. - The PDC emulator operations master at the root of the domain is authoritative for the organization. Therefore, we recommend that you configure this computer to synchronize with a reliable external time server. + This vulnerability becomes much more serious if an attacker is able to change the system time and then stop the Windows Time Service or reconfigure it to synchronize with a time server that is not accurate. + ### Countermeasure + Restrict the **Change the system time** user right to users with a legitimate need to change the system time, such as members of the IT team. + ### Potential impact + There should be no impact because time synchronization for most organizations should be fully automated for all computers that belong to the domain. Computers that do not belong to the domain should be configured to synchronize with an external source, such as a web service. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/change-the-time-zone.md b/windows/keep-secure/change-the-time-zone.md index fafb6d6293..1b27d5afe9 100644 --- a/windows/keep-secure/change-the-time-zone.md +++ b/windows/keep-secure/change-the-time-zone.md @@ -2,91 +2,85 @@ title: Change the time zone (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Change the time zone security policy setting. ms.assetid: 3b1afae4-68bb-472f-a43e-49e300d73e50 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Change the time zone + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Change the time zone** security policy setting. + ## Reference + This policy setting determines which users can adjust the time zone that is used by the device for displaying the local time, which includes the device's system time plus the time zone offset. + Constant: SeTimeZonePrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + None. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not Defined

Default Domain Controller Policy

Administrators

-

Users

Stand-Alone Server Default Settings

Administrators

-

Users

Domain Controller Effective Default Settings

Administrators

-

Users

Member Server Effective Default Settings

Administrators

-

Users

Client Computer Effective Default Settings

Administrators

-

Users

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not Defined| +| Default Domain Controller Policy | Administrators
Users| +| Stand-Alone Server Default Settings | Administrators
Users| +| Domain Controller Effective Default Settings | Administrators
Users| +| Member Server Effective Default Settings | Administrators
Users| +| Client Computer Effective Default Settings | Administrators
Users|   ## Policy management + A restart of the device is not required for this policy setting to be effective. + Any change to the account for this user right assignment becomes effective the next time the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Changing the time zone represents little vulnerability because the system time is not affected. This setting merely enables users to display their preferred time zone while being synchronized with domain controllers in different time zones. + ### Countermeasure + Countermeasures are not required because system time is not affected by this setting. + ### Potential impact + None. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/change-the-tpm-owner-password.md b/windows/keep-secure/change-the-tpm-owner-password.md index e76c48aac1..7241d40deb 100644 --- a/windows/keep-secure/change-the-tpm-owner-password.md +++ b/windows/keep-secure/change-the-tpm-owner-password.md @@ -2,49 +2,66 @@ title: Change the TPM owner password (Windows 10) description: This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. ms.assetid: e43dcff3-acb4-4a92-8816-d6b64b7f2f45 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Change the TPM owner password + **Applies to** - Windows 10 + This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. -## About the TPM owner password + +## About the TPM owner password The owner of the TPM is the user who possesses the owner password and is able to set it and change it. Only one owner password exists per TPM. The owner of the TPM can make full use of TPM capabilities. When an owner is set, no other user or software can claim ownership of the TPM. Only the TPM owner can enable, disable, or clear the TPM without having physical access to the computer, for example, by using the command-line tools remotely. Taking ownership of the TPM can be performed as part of the initialization process. Ownership can change when you share the password or clear your ownership of the TPM so someone else can initialize it. + Applications, including BitLocker Drive Encryption, can automatically start the initialization process. If you enable BitLocker without manually initializing the TPM, the TPM owner password is automatically created and saved in the same location as the BitLocker recovery password. The TPM owner password can be saved as a file on a removable storage device, or on another computer. The password can also be printed. The TPM MMC gives the TPM owner the sole ability to choose the appropriate option to type the password or to use the saved password. As with any password, you should change your TPM owner password if you suspect that it has become compromised and is no longer a secret. + **Other TPM management options** + Instead of changing your owner password, you can also use the following options to manage your TPM: + - **Clear the TPM**   If you want to invalidate all of the existing keys that have been created since you took ownership of the TPM, you can clear it. For more info, see [Initialize and Configure Ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md#bkmk-clear1). - **Important**   - Clearing the TPM can result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM. + + >**Important:**  Clearing the TPM can result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM.   - **Turn off the TPM**   If you want to keep all existing keys and data intact, and you want to disable the services that are provided by the TPM, you can turn it off. For more info, see [Initialize and Configure Ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md#bkmk-onoff). + ## Change the TPM owner password + The following procedure provides the steps that are necessary to change the TPM owner password. + **To change the TPM owner password** + 1. Open the TPM MMC (tpm.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 2. In the **Actions** pane, click **Change Owner Password**. 3. In the **Manage the TPM security hardware** dialog box, select a method to enter your current TPM owner password. + - If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, use **Browse** to navigate to the .tpm file that is saved on your removable storage device. Click **Open**, and then click **Create New Password**. - If you do not have the removable storage device with your saved password, click **I want to enter the owner password**. In the **Type your TPM owner password** dialog box, enter your password (including hyphens), and click **Create New Password**. 4. On the **Create the TPM owner password** page, select a method for creating a new TPM owner password. + 1. Click **Automatically create the password** to have a new owner password generated for you. 2. Click **Manually create the password** if you want to specify a password. - **Note**   - The TPM owner password must have a minimum of eight characters. + >**Note:**  The TPM owner password must have a minimum of eight characters.   5. After the new password is created, you can choose **Save the password** to save the password in a password backup file on a removable storage device or **Print the password** to print a copy of the password for later reference. + 6. Click **Change password** to apply the new owner password to the TPM. -## Use the TPM cmdlets + +## Use the TPM cmdlets + If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: **dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** + For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). + ## Additional resources + For more info about TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). -  -  diff --git a/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md b/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md index 374b255db6..3e84e8f209 100644 --- a/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md +++ b/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md @@ -2,28 +2,46 @@ title: Choose the right BitLocker countermeasure (Windows 10) description: This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks. ms.assetid: b0b09508-7885-4030-8c61-d91458afdb14 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Choose the right BitLocker countermeasure + **Applies to** - Windows 10 + This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks. You can use BitLocker to protect your Windows 10 PCs. Whichever operating system you’re using, Microsoft and Windows-certified devices provide countermeasures to address attacks and improve your data security. In most cases, this protection can be implemented without the need for pre-boot authentication. -Figures 2, 3, and 4 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default settings. + +Figures 2, 3, and 4 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default +settings. + ![how to choose best countermeasures for windows 7](images/bitlockerprebootprotection-counterwin7.jpg) + **Figure 2.** How to choose the best countermeasures for Windows 7 + ![how to choose countermeasures for windows 8](images/bitlockerprebootprotection-counterwin8.jpg) + **Figure 3.** How to choose the best countermeasures for Windows 8 + ![how to choose countermeasures for windows 8.1](images/bitlockerprebootprotection-counterwin81.jpg) + **Figure 4.** How to choose the best countermeasures for Windows 8.1 -The latest InstantGo devices, primarily tablets, are designed to be secure by default against all attacks that might compromise the BitLocker encryption key. Other Windows devices can be, too. DMA port–based attacks, which represent the attack vector of choice, are not possible on InstantGo devices, because these port types are prohibited. The inclusion of DMA ports on even non-InstantGo devices is extremely rare on recent devices, particularly on mobile ones. This could change if Thunderbolt is broadly adopted, so IT should consider this when purchasing new devices. In any case DMA ports can be disabled entirely, which is an increasingly popular option because the use of DMA ports is infrequent in the non-developer space. + +The latest InstantGo devices, primarily tablets, are designed to be secure by default against all attacks that might compromise the BitLocker encryption key. Other Windows devices can be, too. DMA port–based attacks, which represent the attack vector of choice, are not possible on InstantGo devices, because these port types are prohibited. The inclusion of DMA ports on even non-InstantGo devices is extremely rare on recent devices, particularly on mobile ones. This could change if Thunderbolt is broadly adopted, so IT should consider this when purchasing new devices. In any case DMA ports can be disabled entirely, which is an increasingly popular option because the use of +DMA ports is infrequent in the non-developer space. + Memory remanence attacks can be mitigated with proper configuration; in cases where the system memory is fixed and non-removable, they are not possible using published techniques. Even in cases where system memory can be removed and loaded into another device, attackers will find the attack vector extremely unreliable, as has been shown in the DRDC Valcartier group’s analysis (see [An In-depth Analysis of the Cold Boot Attack](http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA545078)). + Windows 7 PCs share the same security risks as newer devices but are far more vulnerable to DMA and memory remanence attacks, because Windows 7 devices are more likely to include DMA ports, lack support for UEFI-based Secure Boot, and rarely have fixed memory. To eliminate the need for pre-boot authentication on Windows 7 devices, disable the ability to boot to external media, password-protect the BIOS configuration, and disable the DMA ports. If you believe that your devices may be a target of a memory remanence attack, where the system memory may be removed and put into another computer to gain access to its contents, consider testing your devices to determine whether they are susceptible to this type of attack. -In the end, many customers will find that pre-boot authentication improves security only for a shrinking subset of devices within their organization. Microsoft recommends a careful examination of the attack vectors and mitigations outlined in this document along with an evaluation of your devices before choosing to implement pre-boot authentication, which may not enhance the security of your devices and instead will only compromise the user experience and add to support costs. + +In the end, many customers will find that pre-boot authentication improves security only for a shrinking subset of devices within their organization. Microsoft recommends a careful examination of the attack vectors and mitigations +outlined in this document along with an evaluation of your devices before choosing to implement pre-boot authentication, which may not enhance the security of your devices and instead will only compromise the user experience and add to support costs. + ## See also - [Types of attacks for volume encryption keys](types-of-attacks-for-volume-encryption-keys.md) - [BitLocker Countermeasures](bitlocker-countermeasures.md) diff --git a/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md b/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md index 5de6e0fbde..58ba26536b 100644 --- a/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md +++ b/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md @@ -2,26 +2,31 @@ title: Configure an AppLocker policy for audit only (Windows 10) description: This topic for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker. ms.assetid: 10bc87d5-cc7f-4500-b7b3-9006e50afa50 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Configure an AppLocker policy for audit only + **Applies to** - Windows 10 + This topic for IT professionals describes how to set AppLocker policies to **Audit only** within your IT environment by using AppLocker. + After AppLocker rules are created within the rule collection, you can configure the enforcement setting to **Enforce rules** or **Audit only**. + When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. -**Note**   -There is no audit mode for the DLL rule collection. DLL rules affect specific apps. Therefore, test the impact of these rules first before deploying them to production. To enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md). + +>**Note:**  There is no audit mode for the DLL rule collection. DLL rules affect specific apps. Therefore, test the impact of these rules first before deploying them to production. To enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md).   You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To audit rule collections** + 1. From the AppLocker console, right-click **AppLocker**, and then click **Properties**. 2. On the **Enforcement** tab, select the **Configured** check box for the rule collection that you want to enforce, and then verify that **Audit only** is selected in the list for that rule collection. 3. Repeat the above step to configure the enforcement setting to **Audit only** for additional rule collections. 4. Click **OK**. -  -  diff --git a/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md b/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md index cd7c80e04b..3d6aa8a2c7 100644 --- a/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md +++ b/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md @@ -2,25 +2,30 @@ title: Configure an AppLocker policy for enforce rules (Windows 10) description: This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. ms.assetid: 5dbbb290-a5ae-4f88-82b3-21e95972e66c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Configure an AppLocker policy for enforce rules + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. -**Note**   -When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. + +>**Note:**  When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited.   For info about how AppLocker policies are applied within a GPO structure, see [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md). + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To enable the Enforce rules enforcement setting** + 1. From the AppLocker console, right-click **AppLocker**, and then click **Properties**. 2. On the **Enforcement** tab of the **AppLocker Properties** dialog box, select the **Configured** check box for the rule collection that you are editing, and then verify that **Enforce rules** is selected. 3. Click **OK**. + For info about viewing the events generated from rules enforcement, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). -  -  diff --git a/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md b/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md index 34f5707623..0d4e3eefd6 100644 --- a/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md +++ b/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md @@ -2,23 +2,31 @@ title: Add exceptions for an AppLocker rule (Windows 10) description: This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule. ms.assetid: d15c9d84-c14b-488d-9f48-bf31ff7ff0c5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Add exceptions for an AppLocker rule + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule. + Rule exceptions allow you to specify files or folders to exclude from the rule. For more information about exceptions, see [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md). + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To configure exceptions for a rule** + 1. Open the AppLocker console. 2. Expand the rule collection, right-click the rule that you want to configure exceptions for, and then click **Properties**. 3. Click the **Exceptions** tab. 4. In the **Add exception** box, select the rule type that you want to create, and then click **Add**. + - For a publisher exception, click **Browse**, select the file that contains the publisher to exclude, and then click **OK**. - For a path exception, choose the file or folder path to exclude, and then click **OK**. - For a file hash exception, edit the file hash rule, and click **Remove**. diff --git a/windows/keep-secure/configure-s-mime.md b/windows/keep-secure/configure-s-mime.md index 0f76c34cac..1d5a83822d 100644 --- a/windows/keep-secure/configure-s-mime.md +++ b/windows/keep-secure/configure-s-mime.md @@ -2,55 +2,84 @@ title: Configure S/MIME for Windows 10 and Windows 10 Mobile (Windows 10) description: In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. ms.assetid: 7F9C2A99-42EB-4BCC-BB53-41C04FBBBF05 -ms.pagetype: security -keywords: ["encrypt", "digital signature"] +keywords: encrypt, digital signature ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + + # Configure S/MIME for Windows 10 and Windows 10 Mobile + **Applies to** - Windows 10 - Windows 10 Mobile + S/MIME stands for Secure/Multipurpose Internet Mail Extensions, and provides an added layer of security for email sent to and from an Exchange ActiveSync (EAS) account. In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. + ## About message encryption + Users can send encrypted message to people in their organization and people outside their organization if they have their encryption certificates. However, users using Windows 10 Mail app can only read encrypted messages if the message is received on their Exchange account and they have corresponding decryption keys. + Encrypted messages can be read only by recipients who have a certificate. If you try to send an encrypted message to recipient(s) whose encryption certificate are not available, the app will prompt you to remove these recipients before sending the email. + ## About digital signatures + A digitally signed message reassures the recipient that the message hasn't been tampered with and verifies the identity of the sender. Recipients can only verify the digital signature if they’re using an email client that supports S/MIME. + ## Prerequisites + - [S/MIME is enabled for Exchange accounts](http://go.microsoft.com/fwlink/p/?LinkId=718217) (on-premises and Office 365). Users can’t use S/MIME signing and encryption with a personal account such as Outlook.com. - Valid Personal Information Exchange (PFX) certificates are installed on the device. + - [How to Create PFX Certificate Profiles in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkID=718215) - [Enable access to company resources using certificate profiles with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=718216) - [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) + ## Choose S/MIME settings + On the device, perform the following steps: (add select certificate) 1. Open the Mail app. (In Windows 10 Mobile, the app is Outlook Mail.) 2. Open **Settings** by tapping the gear icon on a PC, or the ellipsis (...) and then the gear icon on a phone. + ![settings icon in mail app](images/mailsettings.png) + 3. Tap **Email security**. + ![email security settings](images/emailsecurity.png) + 4. In **Select an account**, select the account for which you want to configure S/MIME options. 5. Make a certificate selection for digital signature and encryption. + - Select **Automatically** to let the app choose the certificate. - Select **Manually** to specify the certificate yourself from the list of valid certificates on the device. 6. (Optional) Select **Always sign with S/MIME**, **Always encrypt with S/MIME**, or both, to automatically digitally sign or encrypt all outgoing messages. - **Note**  The option to sign or encrypt can be changed for individual messages, unless EAS policies prevent it. + + >**Note:**  The option to sign or encrypt can be changed for individual messages, unless EAS policies prevent it.   7. Tap the back arrow. + ## Encrypt or sign individual messages 1. While composing a message, choose **Options** from the ribbon. On phone, **Options** can be accessed by tapping the the ellipsis (...). + 2. Use **Sign** and **Encrypt** icons to turn on digital signature and encryption for this message. + ![sign or encrypt message](images/signencrypt.png) + ## Read signed or encrypted messages + When you receive an encrypted message, the mail app will check whether there is a certificate available on your computer. If there is a certificate available, the message will be decrypted when you open it. If your certificate is stored on a smartcard, you will be prompted to insert the smartcard to read the message. Your smartcard may also require a PIN to access the certificate. + ## Install certificates from a received message + When you receive a signed email, the app provide feature to install corresponding encryption certificate on your device if the certificate is available. This certificate can then be used to send encrypted email to this person. + 1. Open a signed email. 2. Tap or click the digital signature icon in the reading pane. 3. Tap **Install.** + ![message security information](images/installcert.png)     diff --git a/windows/keep-secure/configure-the-appLocker-reference-device.md b/windows/keep-secure/configure-the-appLocker-reference-device.md index d3dd0de7e5..59e6e81b2d 100644 --- a/windows/keep-secure/configure-the-appLocker-reference-device.md +++ b/windows/keep-secure/configure-the-appLocker-reference-device.md @@ -2,35 +2,47 @@ title: Configure the AppLocker reference device (Windows 10) description: This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. ms.assetid: 034bd367-146d-4956-873c-e1e09e6fefee -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Configure the AppLocker reference device + **Applies to** - Windows 10 + This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. + An AppLocker reference device that is used for the development and deployment of AppLocker policies should mimic the directory structure and corresponding applications in the organizational unit (OU) or business group for the production environment. On a reference device, you can: + - Maintain an application list for each business group. - Develop AppLocker policies by creating individual rules or by creating a policy by automatically generating rules. - Create the default rules to allow the Windows system files to run properly. - Run tests and analyze the event logs to determine the affect of the policies that you intend to deploy. + The reference device does not need to be joined to a domain, but it must be able to import and export AppLocker policies in XML format. The reference computer must be running one of the supported editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). -**Warning**   -Do not use operating system snapshots when creating AppLocker rules. If you take a snapshot of the operating system, install an app, create AppLocker rules, and then revert to a clean snapshot and repeat the process for another app, there is a chance that duplicate rule GUIDs can be created. If duplicate GUIDs are present, AppLocker policies will not work as expected. + +>**Warning:**  Do not use operating system snapshots when creating AppLocker rules. If you take a snapshot of the operating system, install an app, create AppLocker rules, and then revert to a clean snapshot and repeat the process for another app, there is a chance that duplicate rule GUIDs can be created. If duplicate GUIDs are present, AppLocker policies will not work as expected.   **To configure a reference device** + 1. If the operating system is not already installed, install one of the supported editions of Windows on the device. - **Note**   - If you have the Group Policy Management Console (GPMC) installed on another device to test your implementation of AppLocker policies, you can export the policies to that device + + >**Note:**  If you have the Group Policy Management Console (GPMC) installed on another device to test your implementation of AppLocker policies, you can export the policies to that device   2. Configure the administrator account. + To update local policies, you must be a member of the local Administrators group. To update domain policies, you must be a member of the Domain Admins group or have been delegated privileges to use Group Policy to update a Group Policy Object (GPO). + 3. Install all apps that run in the targeted business group or OU by using the same directory structure. + The reference device should be configured to mimic the structure of your production environment. It depends on having the same apps in the same directories to accurately create the rules. + ### See also + - After you configure the reference computer, you can create the AppLocker rule collections. You can build, import, or automatically generate the rules. For procedures to do this, see [Working with AppLocker rules](working-with-applocker-rules.md). - [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md)   diff --git a/windows/keep-secure/configure-the-application-identity-service.md b/windows/keep-secure/configure-the-application-identity-service.md index 2f0505366e..0714a613da 100644 --- a/windows/keep-secure/configure-the-application-identity-service.md +++ b/windows/keep-secure/configure-the-application-identity-service.md @@ -15,12 +15,13 @@ author: brianlic-msft - Windows 10 This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually. + The Application Identity service determines and verifies the identity of an app. Stopping this service will prevent AppLocker policies from being enforced. -**Important**   -When using Group Policy, you must configure it to start automatically in at least one Group Policy Object (GPO) that applies AppLocker rules. This is because AppLocker uses this service to verify the attributes of a file. +>**Important:**  When using Group Policy, you must configure it to start automatically in at least one Group Policy Object (GPO) that applies AppLocker rules. This is because AppLocker uses this service to verify the attributes of a file.   **To start the Application Identity service automatically using Group Policy** + 1. On the **Start** screen, type **gpmc.msc** to open the Group Policy Management Console (GPMC). 2. Locate the GPO to edit, right-click the GPO, and then click **Edit**. 3. In the console tree under **Computer Configuration\\Windows Settings\\Security Settings**, click **System Services**. @@ -30,6 +31,7 @@ When using Group Policy, you must configure it to start automatically in at leas Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. **To start the Application Identity service manually** + 1. Right-click the taskbar, and click **Task Manager**. 2. Click the **Services** tab, right-click **AppIDSvc**, and then click **Start Service**. 3. Verify that the status for the Application Identity service is **Running**. diff --git a/windows/keep-secure/configure-windows-defender-in-windows-10.md b/windows/keep-secure/configure-windows-defender-in-windows-10.md index b4f9e3572b..72c2a16a9b 100644 --- a/windows/keep-secure/configure-windows-defender-in-windows-10.md +++ b/windows/keep-secure/configure-windows-defender-in-windows-10.md @@ -2,33 +2,48 @@ title: Configure Windows Defender in Windows 10 (Windows 10) description: IT professionals can configure definition updates and cloud-based protection in Windows Defender in Windows 10 through Microsoft Active Directory and Windows Server Update Services (WSUS). ms.assetid: 22649663-AC7A-40D8-B1F7-5CAD9E49653D -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security author: jasesso --- + # Configure Windows Defender in Windows 10 + **Applies to** - Windows 10 + IT professionals can configure definition updates and cloud-based protection in Windows Defender in Windows 10 through Microsoft Active Directory and Windows Server Update Services (WSUS). + ## Configure definition updates + It is important to update definitions regularly to ensure that your endpoints are protected. Definition updates can be configured to suit the requirements of your organization. + Windows Defender supports the same updating options (such as using multiple definition sources) as other Microsoft endpoint protection products; for more information, see [Configuring Definition Updates](https://technet.microsoft.com/library/gg412502.aspx). + When you configure multiple definition sources in Windows Defender, you can configure the fallback order using the following values through *Group Policy* settings: + - InternalDefinitionUpdateServer - WSUS - MicrosoftUpdateServer - Microsoft Update - MMPC - [Microsoft Malware Protection Center definitions page](http://www.microsoft.com/security/portal/definitions/adl.aspx) - FileShares - file share + Read about deploying administrative template files for Windows Defender in the article [Description of the Windows Defender Group Policy administrative template settings](https://support.microsoft.com/kb/927367). + You can also manage your Windows Defender update configuration settings through System Center Configuration Manager. See [How to Configure Definition Updates for Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/jj822983.aspx) for details. + ## Definition update logic + You can update Windows Defender definitions in four ways depending on your business requirements: + - WSUS, the managed server. You can manage the distribution of updates that are released through Microsoft Update to computers in your enterprise environment; read more on the [Windows Server Update Services](https://technet.microsoft.com/windowsserver/bb332157.aspx) website. - Microsoft Update, the unmanaged server. You can use this method to get regular updates from Microsoft Update. - The [Microsoft Malware Protection Center definitions page](http://www.microsoft.com/security/portal/definitions/adl.aspx), as an alternate download location. You can use this method if you want to download the latest definitions. - File share, where the definition package is downloaded. You can retrieve definition updates from a file share. The file share must be provisioned on a regular basis with the update files. + ## Update Windows Defender definitions through Active Directory and WSUS + This section details how to update Windows Defender definitions for Windows 10 endpoints through Active Directory and WSUS. @@ -109,50 +124,78 @@ This section details how to update Windows Defender definitions for Windows 10
  ## Manage cloud-based protection + Windows Defender offers improved cloud-based protection and threat intelligence for endpoint protection clients using the Microsoft Active Protection Service. Read more about the Microsoft Active Protection Service community in [Join the Microsoft Active Protection Service community](http://windows.microsoft.com/windows-8/join-maps-community). + You can enable or disable the Microsoft Active Protection Service using *Group Policy* settings and administrative template files. + More information on deploying administrative template files for Windows Defender is available in the article [Description of the Windows Defender Group Policy administrative template settings](https://support.microsoft.com/kb/927367). + The Microsoft Active Protection Service can be configured with the following *Group Policy* settings: + 1. Open the **Group Policy Editor**. 2. In the **Local Computer Policy** tree, expand **Computer Configuration**, then **Administrative Templates**, then **Windows Components**, then **Windows Defender**. 3. Click on **MAPS**. 4. Double-click on **Join Microsoft MAPS**. 5. Select your configuration option from the **Join Microsoft MAPS** list. - **Note**  Any settings modified on an endpoint will be overridden by the administrator's policy setting. + + >**Note:**  Any settings modified on an endpoint will be overridden by the administrator's policy setting.   Use the Windowsdefender.adm *Group Policy* template file to control the policy settings for Windows Defender in Windows 10: + Policy setting: **Configure Microsoft SpyNet Reporting** + Registry key name: **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\\SpyNetReporting** + Policy description: **Adjusts membership in Microsoft Active Protection Service** + You can also configure preferences using the following PowerShell parameters: + - Turn Microsoft Active Protection Service off: *Set-MpPreference -MAPSReporting 0* - Turn Microsoft Active Protection Service on: *Set-MpPreference -MAPSReporting 2* + Read more about this in: + - [Scripting with Windows PowerShell](https://technet.microsoft.com/library/bb978526.aspx) - [Defender Cmdlets](https://technet.microsoft.com/library/dn433280.aspx) -**Note**  Any information that Windows Defender collects is encrypted in transit to our servers, and then stored in secure facilities. Microsoft takes several steps to avoid collecting any information that directly identifies you, such as your name, email address, or account ID. + +>**Note:**  Any information that Windows Defender collects is encrypted in transit to our servers, and then stored in secure facilities. Microsoft takes several steps to avoid collecting any information that directly identifies you, such as your name, email address, or account ID.   Read more about how to manage your privacy settings in [Setting your preferences for Windows 10 services](http://windows.microsoft.com/windows-10/services-setting-preferences). + ## Opt-in to Microsoft Update + You can use Microsoft Update to keep definitions on mobile computers running Windows Defender in Windows 10 up to date when they are not connected to the corporate network. If the mobile computer doesn't have a [Windows Server Update Service](https://technet.microsoft.com/windowsserver/bb332157.aspx) (WSUS) connection, the signatures will still come from Microsoft Update. This means that signatures can be pushed down (via Microsoft Update) even if WSUS overrides Windows Update. + You need to opt-in to Microsoft Update on the mobile computer before it can retrieve the definition updates from Microsoft Update. + There are two ways you can opt-in to Microsoft Update in Windows Defender for Windows 10: + 1. Use a VBScript to create a script, then run it on each computer in your network. 2. Manually opt-in every computer on your network through the **Settings** menu. + You can create a VBScript and run it on each computer on your network; this is an efficient way to opt-in to Microsoft Update. + **Use a VBScript to opt in to Microsoft Update** + 1. Use the instructions in the MSDN article [Opt-In to Microsoft Update](https://msdn.microsoft.com/library/windows/desktop/aa826676.aspx) to create the VBScript. 2. Run the VBScript you created on each computer in your network. + You can manually opt-in each individual computer on your network to receive Microsoft Update. + **Manually opt-in to Microsoft Update** + 1. Open **Windows Update** in **Update & security** settings on the computer you want to opt-in. 2. Click **Advanced** options. 3. Select the checkbox for **Give me updates for other Microsoft products when I update Windows**. + ## Schedule updates for Microsoft Update + Opting-in to Microsoft Update means that your system administrator can schedule updates to your mobile computer, so that it keeps up-to-date with the latest software versions and security definitions, even when you’re on the road. + For more information on scheduling updates, see [Configure definition updates](https://technet.microsoft.com/library/mt622088.aspx#configure-definition-updates). + ## Related topics -[Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) -[Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) -  -  + +- [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) +- [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) diff --git a/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md index 08b1dfb88d..cdd372d271 100644 --- a/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md +++ b/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md @@ -2,26 +2,36 @@ title: Create a basic audit policy for an event category (Windows 10) description: By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. ms.assetid: C9F52751-B40D-482E-BE9D-2C61098249D3 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a basic audit policy for an event category + **Applies to** - Windows 10 + By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. On devices that are joined to a domain, auditing settings for the event categories are undefined by default. On domain controllers, auditing is turned on by default. + To complete this procedure, you must be logged on as a member of the built-in Administrators group. + **To define or modify auditing policy settings for an event category for your local computer** + 1. Open the Local Security Policy snap-in (secpol.msc), and then click **Local Policies**. 2. Click **Audit Policy**. 3. In the results pane, double-click an event category that you want to change the auditing policy settings for. 4. Do one or both of the following, and then click **OK.** + - To audit successful attempts, select the **Success** check box. - To audit unsuccessful attempts, select the **Failure** check box. + To complete this procedure, you must be logged on as a member of the Domain Admins group. + **To define or modify auditing policy settings for an event category for a domain or organizational unit, when you are on a member server or on a workstation that is joined to a domain** + 1. Open the Group Policy Management Console (GPMC). 2. In the console tree, double-click **Group Policy objects** in the forest and domain containing the **Default Domain Policy** Group Policy object (GPO) that you want to edit. 3. Right-click the **Default Domain Policy** GPO, and then click **Edit**. @@ -29,11 +39,12 @@ To complete this procedure, you must be logged on as a member of the Domain Admi 5. In the results pane, double-click an event category that you want to change the auditing policy settings for. 6. If you are defining auditing policy settings for this event category for the first time, select the **Define these policy settings** check box. 7. Do one or both of the following, and then click **OK.** + - To audit successful attempts, select the **Success** check box. - To audit unsuccessful attempts, select the **Failure** check box. + ## Additional considerations + - To audit object access, enable auditing of the object access event category by following the steps above. Then, enable auditing on the specific object. - After your audit policy is configured, events will be recorded in the Security log. Open the Security log to view these events. - The default auditing policy setting for domain controllers is **No Auditing**. This means that even if auditing is enabled in the domain, the domain controllers do not inherit auditing policy locally. If you want domain auditing policy to apply to domain controllers, you must modify this policy setting. -  -  diff --git a/windows/keep-secure/create-a-pagefile.md b/windows/keep-secure/create-a-pagefile.md index 31839c324f..c914d790aa 100644 --- a/windows/keep-secure/create-a-pagefile.md +++ b/windows/keep-secure/create-a-pagefile.md @@ -2,88 +2,89 @@ title: Create a pagefile (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create a pagefile security policy setting. ms.assetid: dc087897-459d-414b-abe0-cd86c8dccdea -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a pagefile + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Create a pagefile** security policy setting. + ## Reference + Windows designates a section of the hard drive as virtual memory known as the page file, or more specifically, as pagefile.sys. It is used to supplement the computer’s Random Access Memory (RAM) to improve performance for programs and data that are used frequently. Although the file is hidden from browsing, you can manage it using the system settings. + This policy setting determines which users can create and change the size of a page file. It determines whether users can specify a page file size for a particular drive in the **Performance Options** box located on the **Advanced** tab of the **System Properties** dialog box or through using internal application interfaces (APIs). + Constant: SeCreatePagefilePrivilege + ### Possible values + - User-defined list of accounts - Administrators + ### Best practices + - Restrict the **Create a pagefile** user right to Administrators, which is the default. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, members of the Administrators group have this right. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Administrators

Default Domain Controller Policy

Administrators

Stand-Alone Server Default Settings

Administrators

Domain Controller Effective Default Settings

Administrators

Member Server Effective Default Settings

Administrators

Client Computer Effective Default Settings

Administrators

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Administrators | +| Default Domain Controller Policy | Administrators | +| Stand-Alone Server Default Settings | Administrators | +| Domain Controller Effective Default Settings | Administrators | +| Member Server Effective Default Settings | Administrators | +| Client Computer Effective Default Settings | Administrators |   ## Policy management + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who can change the page file size could make it extremely small or move the file to a highly fragmented storage volume, which could cause reduced device performance. + ### Countermeasure + Restrict the **Create a pagefile** user right to members of the Administrators group. + ### Potential impact + None. Restricting this right to members of the Administrators group is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/create-a-rule-for-packaged-apps.md b/windows/keep-secure/create-a-rule-for-packaged-apps.md index 2474296f59..3909260775 100644 --- a/windows/keep-secure/create-a-rule-for-packaged-apps.md +++ b/windows/keep-secure/create-a-rule-for-packaged-apps.md @@ -2,24 +2,34 @@ title: Create a rule for packaged apps (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition. ms.assetid: e4ffd400-7860-47b3-9118-0e6853c3dfa0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a rule for packaged apps + **Applies to** - Windows 10 + This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition. + Packaged apps, also known as Universal Windows apps, are based on an app model that ensures that all the files within an app package share the same identity. Therefore, it is possible to control the entire app using a single AppLocker rule as opposed to the non-packaged apps where each file within the app could have a unique identity. Windows does not support unsigned packaged apps which implies all packaged apps must be signed. AppLocker supports only publisher rules for packaged apps. A publisher rule for a packaged app is based on the following information: + - Publisher of the package - Package name - Package version + All the files within a package as well as the package installer share these attributes. Therefore, an AppLocker rule for a packaged app controls both the installation as well as the running of the app. Otherwise, the publisher rules for packaged apps are no different than the rest of the rule collections; they support exceptions, can be increased or decreased in scope, and can be assigned to users and groups. + For info about the publisher condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md). + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To create a packaged app rule** + 1. Open the AppLocker console. 2. On the **Action** menu, or by right-clicking on **Packaged app Rules**, click **Create New Rule**. 3. On the **Before You Begin** page, click **Next**. @@ -99,5 +109,3 @@ You can perform this task by using the Group Policy Management Console for an Ap 6. Click **Next**. 7. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. This allows you to add exceptions based on the same rule reference and rule scope as you set before. Click **Next**. 8. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -  -  diff --git a/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md index f5a2a1ed28..261eea052b 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md @@ -2,30 +2,37 @@ title: Create a rule that uses a file hash condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. ms.assetid: eb3b3524-1b3b-4979-ba5a-0a0b1280c5c7 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a rule that uses a file hash condition + **Applies to** - Windows 10 + This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. + File hash rules use a system-computed cryptographic hash of the identified file. + For info about the file hash condition, see [Understanding the File Hash Rule Condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md). -You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + +You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer +AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To create a new rule with a file hash condition** + 1. Open the AppLocker console, and then click the rule collection that you want to create the rule for. 2. On the **Action** menu, click **Create New Rule**. 3. On the **Before You Begin** page, click **Next**. 4. On the **Permissions** page, select the action (allow or deny) and the user or group that the rule should apply to, and then click **Next**. 5. On the **Conditions** page, select the **File hash** rule condition, and then click **Next**. 6. **Browse Files** to locate the targeted application file. - **Note**   - You can also click **Browse Folders** which calculates the hash for all the appropriate files relative to the rule collection. To remove hashes individually, click the **Remove** button. + + >**Note:**  You can also click **Browse Folders** which calculates the hash for all the appropriate files relative to the rule collection. To remove hashes individually, click the **Remove** button.   7. Click **Next**. 8. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -  -  diff --git a/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md index 3130eeb9a7..8553577fac 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md @@ -2,34 +2,39 @@ title: Create a rule that uses a path condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a path condition. ms.assetid: 9b2093f5-5976-45fa-90c3-da1e0e845d95 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a rule that uses a path condition + **Applies to** - Windows 10 + This topic for IT professionals shows how to create an AppLocker rule with a path condition. + The path condition identifies an app by its location in the file system of the computer or on the network. -**Important**   -When creating a rule that uses a deny action, path conditions are less secure for preventing access to a file because a user could easily copy the file to a different location than what is specified in the rule. Because path rules correspond to locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file within C:\\ will be allowed to run, including users' profiles. + +>**Important:**  When creating a rule that uses a deny action, path conditions are less secure for preventing access to a file because a user could easily copy the file to a different location than what is specified in the rule. Because path rules correspond to locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file within C:\\ will be allowed to run, including users' profiles.   For info about the path condition, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For information how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To create a new rule with a path condition** + 1. Open the AppLocker console, and then click the rule collection that you want to create the rule for. 2. On the **Action** menu, click **Create New Rule**. 3. On the **Before You Begin** page, click **Next**. 4. On the **Permissions** page, select the action (allow or deny) and the user or group that the rule should apply to, and then click **Next**. 5. On the **Conditions** page, select the **Path** rule condition, and then click **Next**. 6. Click **Browse Files** to locate the targeted folder for the app. - **Note**   - When you browse to a file or folder location, the wizard automatically converts absolute file paths to use AppLocker path variables. You may edit the path after browsing to specify an absolute path, or you may type the path directly into the **Path** box. To learn more about AppLocker path variables, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). + + >**Note:**  When you browse to a file or folder location, the wizard automatically converts absolute file paths to use AppLocker path variables. You may edit the path after browsing to specify an absolute path, or you may type the path directly into the **Path** box. To learn more about AppLocker path variables, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md).   7. Click **Next**. 8. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. Click **Next**. 9. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -  -  diff --git a/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md index 11baddf574..11ceca1e52 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md @@ -2,21 +2,30 @@ title: Create a rule that uses a publisher condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. ms.assetid: 345ad45f-2bc1-4c4c-946f-17804e29f55b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a rule that uses a publisher condition + **Applies to** - Windows 10 + This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. + You can use publisher conditions only for files that are digitally signed; the publisher condition identifies an app based on its digital signature and extended attributes. The digital signature contains information about the company that created the app (the publisher). The extended attributes, which are obtained from the binary resource, contain the name of the product that the file is part of and the version number of the application. The publisher may be a software development company, such as Microsoft, or the information technology department of your organization. Packaged app rules are by definition rules that use publisher conditions. For info about creating a packaged app rule, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md). + For info about the publisher condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md). -You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + +You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer +AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To create a new rule with a publisher condition** + 1. Open the AppLocker console, and then click the rule collection that you want to create the rule for. 2. On the **Action** menu, click **Create New Rule**. 3. On the **Before You Begin** page, click **Next**. @@ -26,5 +35,3 @@ You can perform this task by using the Group Policy Management Console for an Ap 7. Click **Next**. 8. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. Click **Next**. 9. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -  -  diff --git a/windows/keep-secure/create-a-token-object.md b/windows/keep-secure/create-a-token-object.md index 1c972b491b..99055b694f 100644 --- a/windows/keep-secure/create-a-token-object.md +++ b/windows/keep-secure/create-a-token-object.md @@ -2,91 +2,91 @@ title: Create a token object (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create a token object security policy setting. ms.assetid: bfbf52fc-6ba4-442a-9df7-bd277e55729c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a token object + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Create a token object** security policy setting. + ## Reference + This policy setting determines which accounts a process can use to create a token, and which accounts it can then use to gain access to local resources when the process uses NtCreateToken() or other token-creation APIs. + When a user logs on to the local device or connects to a remote device through a network, Windows builds the user’s access token. Then the system examines the token to determine the level of the user's privileges. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user's access token until the next time the user logs on or connects. + Constant: SeCreateTokenPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + This user right is used internally by the operating system. By default, it is not assigned to any user groups. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not Defined

Default Domain Controller Policy

Not Defined

Stand-Alone Server Default Settings

Not Defined

Domain Controller Effective Default Settings

Local System

Member Server Effective Default Settings

Local System

Client Computer Effective Default Settings

Local System

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not Defined | +| Default Domain Controller Policy | Not Defined | +| Stand-Alone Server Default Settings | Not Defined | +| Domain Controller Effective Default Settings | Local System | +| Member Server Effective Default Settings | Local System | +| Client Computer Effective Default Settings | Local System |   ## Policy management + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -**Caution**   -A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts. + +>**Caution:**  A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts.   Windows examines a user's access token to determine the level of the user's privileges. Access tokens are built when users log on to the local device or connect to a remote device over a network. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user's access token until the next time the user logs on or connects. Users with the ability to create or modify tokens can change the level of access for any account on a computer if they are currently logged on. They could escalate their privileges or create a DoS condition. + ### Countermeasure + Do not assign the **Create a token object** user right to any users. Processes that require this user right should use the Local System account, which already includes it, instead of a separate user account that has this user right assigned. + ### Potential impact + None. Not Defined is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/create-applocker-default-rules.md b/windows/keep-secure/create-applocker-default-rules.md index 15c82719f5..eb37fb2112 100644 --- a/windows/keep-secure/create-applocker-default-rules.md +++ b/windows/keep-secure/create-applocker-default-rules.md @@ -2,24 +2,28 @@ title: Create AppLocker default rules (Windows 10) description: This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. ms.assetid: 21e9dc68-a6f4-4ebe-ac28-4c66a7ab6e18 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create AppLocker default rules + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. + AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed to run. -**Important**   -You can use the default rules as a template when creating your own rules to allow files within the Windows folders to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. The default rules can be modified in the same way as other AppLocker rule types. + +>**Important:**  You can use the default rules as a template when creating your own rules to allow files within the Windows folders to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. The default rules can be modified in the same way as other AppLocker rule types.   You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For information how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To create default rules** + 1. Open the AppLocker console. 2. Right-click the appropriate rule type for which you want to automatically generate default rules. You can automatically generate rules for executable, Windows Installer, script rules and Packaged app rules. 3. Click **Create Default Rules**. -  -  diff --git a/windows/keep-secure/create-global-objects.md b/windows/keep-secure/create-global-objects.md index 7e51c7a813..1f047ee451 100644 --- a/windows/keep-secure/create-global-objects.md +++ b/windows/keep-secure/create-global-objects.md @@ -2,106 +2,91 @@ title: Create global objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create global objects security policy setting. ms.assetid: 9cb6247b-44fc-4815-86f2-cb59b6f0221e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create global objects + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Create global objects** security policy setting. + ## Reference + This policy setting determines which users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. + A global object is an object that is created to be used by any number of processes or threads, even those not started within the user’s session. Remote Desktop Services uses global objects in its processes to facilitate connections and access. + Constant: SeCreateGlobalPrivilege + ### Possible values + - User-defined list of accounts - Default accounts listed below + ### Best practices + - Do not assign any user accounts this right. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, members of the Administrators group have this right, as do Local Service and Network Service accounts on the supported versions of Windows. Service is included for backwards compatibility with earlier versions of Windows. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not Defined

Default Domain Controller Policy

Administrators

-

Local Service

-

Network Service

-

Service

Stand-Alone Server Default Settings

Administrators

-

Local Service

-

Network Service

-

Service

Domain Controller Effective Default Settings

Administrators

-

Local Service

-

Network Service

-

Service

Member Server Effective Default Settings

Administrators

-

Local Service

-

Network Service

-

Service

Client Computer Effective Default Settings

Administrators

-

Local Service

-

Network Service

-

Service

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not Defined | +| Default Domain Controller Policy | Administrators
Local Service
Network Service
Service| +| Stand-Alone Server Default Settings | Administrators
Local Service
Network Service
Service| +| Domain Controller Effective Default Settings | Administrators
Local Service
Network Service
Service| +| Member Server Effective Default Settings | Administrators
Local Service
Network Service
Service| +| Client Computer Effective Default Settings | Administrators
Local Service
Network Service
Service|   ## Policy management + A restart of the device is not required for this policy setting to take effect. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -**Caution**   -A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts. + +>**Caution:**  A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts.   Windows examines a user's access token to determine the level of the user's privileges. Access tokens are built when users log on to the local device or connect to a remote device over a network. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user's access token until the next time the user logs on or connects. Users with the ability to create or modify tokens can change the level of access for any currently logged on account. They could escalate their privileges or create a denial-of-service (DoS) condition. + ### Countermeasure + Do not assign the **Create a token object** user right to any users. Processes that require this user right should use the Local System account, which already includes it, instead of a separate user account with this user right assigned. + ### Potential impact + None. Not Defined is the default domain policy configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md b/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md index 6afbbb8eb8..074fababfc 100644 --- a/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md +++ b/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md @@ -2,46 +2,69 @@ title: Create a list of apps deployed to each business group (Windows 10) description: This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. ms.assetid: d713aa07-d732-4bdc-8656-ba616d779321 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a list of apps deployed to each business group + **Applies to** - Windows 10 + This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. + ## Determining app usage + For each business group, determine the following: + - The complete list of apps used, including different versions of an app - The full installation path of the app - The publisher and signed status of each app - The type of requirement the business groups set for each app, such as business critical, business productivity, optional, or personal. It might also be helpful during this effort to identify which apps are supported or unsupported by your IT department, or supported by others outside your control. - A list of files or apps that require administrative credentials to install or run. If the file requires administrative credentials to install or run, users who cannot provide administrative credentials will be prevented from running the file even if the file is explicitly allowed by an AppLocker policy. Even with AppLocker policies enforced, only members of the Administrators group can install or run files that require administrative credentials. + ### How to perform the app usage assessment -Although you might already have a method in place to understand app usage for each business group, you will need to use this information to help create your AppLocker rule collection. AppLocker includes the Automatically Generate Rules wizard and the **Audit only** enforcement configuration to assist you with planning and creating your rule collection. + +Although you might already have a method in place to understand app usage for each business group, you will need to use this information to help create your AppLocker rule collection. AppLocker includes the Automatically Generate +Rules wizard and the **Audit only** enforcement configuration to assist you with planning and creating your rule collection. + **Application inventory methods** + Using the Automatically Generate Rules wizard quickly creates rules for the applications you specify. The wizard is designed specifically to build a rule collection. You can use the Local Security Policy snap-in to view and edit the rules. This method is very useful when creating rules from a reference computer, and when creating and evaluating AppLocker policies in a testing environment. However, it does require that the files be accessible on the reference computer or through a network drive. This might mean additional work in setting up the reference computer and determining a maintenance policy for that computer. -Using the **Audit only** enforcement method permits you to view the logs because it collects information about every process on the computers receiving the Group Policy Object (GPO). Therefore, you can see what the enforcement will be on the computers in a business group. AppLocker includes Windows PowerShell cmdlets that you can use to analyze the events from the event log and cmdlets to create rules. However, when you use Group Policy to deploy to several computers, a means to collect events in a central location is very important for manageability. Because AppLocker logs information about files that users or other processes start on a computer, you could miss creating some rules initially. Therefore, you should continue your evaluation until you can verify that all required applications that are allowed to run are accessed successfully. -**Tip**   -If you run Application Verifier against a custom application with any AppLocker policies enabled, it might prevent the application from running. You should either disable Application Verifier or AppLocker. + +Using the **Audit only** enforcement method permits you to view the logs because it collects information about every process on the computers receiving the Group Policy Object (GPO). Therefore, you can see what the enforcement will be on the computers in a business group. AppLocker includes Windows PowerShell cmdlets that you can use to analyze the events from the event log and cmdlets to create rules. However, when you use Group Policy to deploy to several computers, a means to collect events in a central location is very important for manageability. Because AppLocker logs information about files that users or other processes start on a computer, you could miss creating some rules +initially. Therefore, you should continue your evaluation until you can verify that all required applications that are allowed to run are accessed successfully. + +>**Tip:**  If you run Application Verifier against a custom application with any AppLocker policies enabled, it might prevent the application from running. You should either disable Application Verifier or AppLocker. You can create an inventory of Universal Windows apps on a device by using two methods: the **Get-AppxPackage** Windows PowerShell cmdlet or the AppLocker console.   The following topics in the [AppLocker Step-by-Step Guide](http://go.microsoft.com/fwlink/p/?LinkId=160261) describe how to perform each method: + - [Automatically generating executable rules from a reference computer](http://go.microsoft.com/fwlink/p/?LinkId=160264) - [Using auditing to track which apps are used](http://go.microsoft.com/fwlink/p/?LinkId=160281) + ### Prerequisites to completing the inventory + Identify the business group and each organizational unit (OU) within that group to which you will apply application control policies. In addition, you should have identified whether or not AppLocker is the most appropriate solution for these policies. For info about these steps, see the following topics: + - [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md) - [Determine your application control objectives](determine-your-application-control-objectives.md) + ## Next steps + Identify and develop the list of apps. Record the name of the app, whether it is signed or not as indicated by the publisher's name, and whether or not it is a mission critical, business productivity, optional, or personal application. Record the installation path of the apps. For info about how to do this, see [Document your app list](document-your-application-list.md). + After you have created the list of apps, the next step is to identify the rule collections, which will become the policies. This information can be added to the table under columns labeled: + - Use default rule or define new rule condition - Allow or deny - GPO name + To do this, see the following topics: + - [Select the types of rules to create](select-types-of-rules-to-create.md) - [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md)   diff --git a/windows/keep-secure/create-permanent-shared-objects.md b/windows/keep-secure/create-permanent-shared-objects.md index ee6979dbe5..33ab226516 100644 --- a/windows/keep-secure/create-permanent-shared-objects.md +++ b/windows/keep-secure/create-permanent-shared-objects.md @@ -2,88 +2,89 @@ title: Create permanent shared objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create permanent shared objects security policy setting. ms.assetid: 6a58438d-65ca-4c4a-a584-450eed976649 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create permanent shared objects + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Create permanent shared objects** security policy setting. + ## Reference + This user right determines which accounts can be used by processes to create a directory object by using the object manager. Directory objects include Active Directory objects, files and folders, printers, registry keys, processes, and threads. Users who have this capability can create permanent shared objects, including devices, semaphores, and mutexes. This user right is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel-mode inherently have this user right assigned to them, it is not necessary to specifically assign it. + Constant: SeCreatePermanentPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - Users who have the **Create permanent shared objects** user right could create new shared objects and expose sensitive data to the network. Therefore, do not assign this right to any users. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, **LocalSystem** is the only account that has this right. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not Defined

Default Domain Controller Policy

Not Defined

Stand-Alone Server Default Settings

Not Defined

Domain Controller Effective Default Settings

LocalSystem

Member Server Effective Default Settings

LocalSystem

Client Computer Effective Default Settings

LocalSystem

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not Defined| +| Default Domain Controller Policy | Not Defined | +| Stand-Alone Server Default Settings | Not Defined| +| Domain Controller Effective Default Settings | **LocalSystem**| +| Member Server Effective Default Settings | **LocalSystem**| +| Client Computer Effective Default Settings | **LocalSystem**|   ## Policy management + This section describes different features and tools available to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who have the **Create permanent shared objects** user right could create new shared objects and expose sensitive data to the network. + ### Countermeasure + Do not assign the **Create permanent shared objects** user right to any users. Processes that require this user right should use the System account, which already includes this user right, instead of a separate user account. + ### Potential impact + None. Not Defined is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/create-symbolic-links.md b/windows/keep-secure/create-symbolic-links.md index 618cd6c90a..857a5a7ca9 100644 --- a/windows/keep-secure/create-symbolic-links.md +++ b/windows/keep-secure/create-symbolic-links.md @@ -2,92 +2,96 @@ title: Create symbolic links (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create symbolic links security policy setting. ms.assetid: 882922b9-0ff8-4ee9-8afc-4475515ee3fd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create symbolic links + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Create symbolic links** security policy setting. + ## Reference + This user right determines if users can create a symbolic link from the device they are logged on to. + A symbolic link is a file-system object that points to another file-system object. The object that is pointed to is called the target. Symbolic links are transparent to users. The links appear as normal files or directories, and they can be acted upon by the user or application in exactly the same manner. Symbolic links are designed to aid in migration and application compatibility with UNIX operating systems. Microsoft has implemented symbolic links to function just like UNIX links. -**Warning**   This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. + +>**Warning:**   This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. Constant: SeCreateSymbolicLinkPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - This user right should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that are not designed to handle them. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, members of the Administrators group have this right. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not Defined

Default Domain Controller Policy

Not Defined

Stand-Alone Server Default Settings

Not Defined

Domain Controller Effective Default Settings

Administrators

Member Server Effective Default Settings

Administrators

Client Computer Effective Default Settings

Administrators

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not Defined| +| Default Domain Controller Policy | Not Defined| +| Stand-Alone Server Default Settings | Not Defined| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes different features and tools available to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ### Command-line tools + This setting can be used in conjunction with a symbolic link file system setting that can be manipulated with the command-line tool to control the kinds of symlinks that are allowed on the device. For more info, type **fsutil behavior set symlinkevalution /?** at the command prompt. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who have the **Create symbolic links** user right could inadvertently or maliciously expose your system to symbolic link attacks. Symbolic link attacks can be used to change the permissions on a file, to corrupt data, to destroy data, or as a DoS attack. + ### Countermeasure + Do not assign the **Create symbolic links** user right to standard users. Restrict this right to trusted administrators. You can use the **fsutil** command to establish a symbolic link file system setting that controls the kind of symbolic links that can be created on a computer. + ### Potential impact + None. Not defined is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/create-your-applocker-planning-document.md b/windows/keep-secure/create-your-applocker-planning-document.md index 990887b439..263be36d5e 100644 --- a/windows/keep-secure/create-your-applocker-planning-document.md +++ b/windows/keep-secure/create-your-applocker-planning-document.md @@ -2,26 +2,37 @@ title: Create your AppLocker planning document (Windows 10) description: This planning topic for the IT professional summarizes the information you need to research and include in your AppLocker planning document. ms.assetid: 41e49644-baf4-4514-b089-88adae2d624e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create your AppLocker planning document + **Applies to** + - Windows 10 + This planning topic for the IT professional summarizes the information you need to research and include in your AppLocker planning document. + ## The AppLocker deployment design + The design process and the planning document help you investigate application usage in your organization and record your findings so you can effectively deploy and maintain application control policies by using AppLocker. + You should have completed these steps in the design and planning process: + 1. [Determine your application control objectives](determine-your-application-control-objectives.md) 2. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) 3. [Select types of rules to create](select-types-of-rules-to-create.md) 4. [Determine Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) 5. [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) + ### AppLocker planning document contents + Your planning document should contain: + - A list of business groups that will participate in the application control policy project, their requirements, a description of their business processes, and contact information. - Application control policy project target dates, both for planning and deployment. - A complete list of apps used by each business group (or organizational unit), including version information and installation paths. @@ -29,10 +40,15 @@ Your planning document should contain: - A strategy for using Group Policy to deploy the AppLocker policies. - A strategy in processing the application usage events generated by AppLocker. - A strategy to maintain and manage AppLocker polices after deployment. + ### Sample template for an AppLocker planning document + You can use the following form to construct your own AppLocker planning document. + **Business group**: + **Operating system environment**: (Windows and non-Windows) + @@ -69,6 +85,7 @@ You can use the following form to construct your own AppLocker planning document
  **Rules** + @@ -110,6 +127,7 @@ You can use the following form to construct your own AppLocker planning document
  **Event processing** + @@ -139,6 +157,7 @@ You can use the following form to construct your own AppLocker planning document
  **Policy maintenance** + @@ -169,7 +188,9 @@ You can use the following form to construct your own AppLocker planning document
  ### Example of an AppLocker planning document + **Rules** + @@ -268,6 +289,7 @@ You can use the following form to construct your own AppLocker planning document
  **Event processing** + @@ -304,6 +326,7 @@ You can use the following form to construct your own AppLocker planning document
  **Policy maintenance** + @@ -348,6 +371,7 @@ You can use the following form to construct your own AppLocker planning document
  ### Additional resources + - The AppLocker Policies Design Guide is the predecessor to the AppLocker Policies Deployment Guide. When planning is complete, see the [AppLocker policies deployment guide](applocker-policies-deployment-guide.md). - For more general info, see [AppLocker](applocker-overview.md).   diff --git a/windows/keep-secure/create-your-applocker-policies.md b/windows/keep-secure/create-your-applocker-policies.md index cc275dc563..b7a23cc02d 100644 --- a/windows/keep-secure/create-your-applocker-policies.md +++ b/windows/keep-secure/create-your-applocker-policies.md @@ -2,19 +2,26 @@ title: Create Your AppLocker policies (Windows 10) description: This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. ms.assetid: d339dee2-4da2-4d4a-b46e-f1dfb7cb4bf0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create Your AppLocker policies + **Applies to** - Windows 10 + This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. + Creating effective application control policies with AppLocker starts by creating the rules for each app. Rules are grouped into one of five rule collections. The rule collection can be configured to be enforced or to run in **Audit only** mode. An AppLocker policy includes the rules in the five rule collections and the enforcement settings for each rule collection. + ## Step 1: Use your plan + You can develop an application control policy plan to guide you in making successful deployment decisions. For more info about how to do this and what you should consider, see the [AppLocker Design Guide](applocker-policies-design-guide.md). This guide is intended for security architects, security administrators, and system administrators. It contains the following topics to help you create an AppLocker policy deployment plan for your organization that will address your specific application control requirements by department, organizational unit, or business group: + 1. [Understand the AppLocker policy deployment process](understand-the-applocker-policy-deployment-process.md) 2. [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md) 3. [Determine your application control objectives](determine-your-application-control-objectives.md) @@ -23,24 +30,40 @@ You can develop an application control policy plan to guide you in making succes 6. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) 7. [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) 8. [Create your AppLocker planning document](create-your-applocker-planning-document.md) + ## Step 2: Create your rules and rule collections + Each rule applies to one or more apps, and it imposes a specific rule condition on them. Rules can be created individually or they can be generated by the Automatically Generate Rules Wizard. For the steps to create the rules, see [Create Your AppLocker rules](create-your-applocker-rules.md). + ## Step 3: Configure the enforcement setting -An AppLocker policy is a set of rule collections that are configured with a rule enforcement setting. The enforcement setting can be **Enforce rules**, **Audit only**, or **Not configured**. If an AppLocker policy has at least one rule, and it is set to **Not configured**, all the rules in that policy will be enforced. For info about configuring the rule enforcement setting, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) and [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). + +An AppLocker policy is a set of rule collections that are configured with a rule enforcement setting. The enforcement setting can be **Enforce rules**, **Audit only**, or **Not configured**. If an AppLocker policy has at least one rule, and it is set to **Not configured**, all the rules in that +policy will be enforced. For info about configuring the rule enforcement setting, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) and [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). + ## Step 4: Update the GPO + AppLocker policies can be defined locally on a device or applied through Group Policy. To use Group Policy to apply AppLocker policies, you must create a new Group Policy Object (GPO) or you must update an existing GPO. You can create or modify AppLocker policies by using the Group Policy Management Console (GPMC), or you can import an AppLocker policy into a GPO. For the procedure to do this, see [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). + ## Step 5: Test the effect of the policy + In a test environment or with the enforcement setting set at **Audit only**, verify that the results of the policy are what you intended. For info about testing a policy, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). + ## Step 6: Implement the policy + Depending on your deployment method, import the AppLocker policy to the GPO in your production environment, or if the policy is already deployed, change the enforcement setting to your production environment value—**Enforce rules** or **Audit only**. + ## Step 7: Test the effect of the policy and adjust Validate the effect of the policy by analyzing the AppLocker logs for application usage, and then modify the policy as necessary. To do this, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). + ## Next steps + Follow the steps described in the following topics to continue the deployment process: + 1. [Create Your AppLocker rules](create-your-applocker-rules.md) 2. [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md) 3. [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) + ## See also -[AppLocker deployment guide](applocker-policies-deployment-guide.md) -  -  + +- [AppLocker deployment guide](applocker-policies-deployment-guide.md) + diff --git a/windows/keep-secure/create-your-applocker-rules.md b/windows/keep-secure/create-your-applocker-rules.md index 15de4246f0..ee0590e89b 100644 --- a/windows/keep-secure/create-your-applocker-rules.md +++ b/windows/keep-secure/create-your-applocker-rules.md @@ -2,54 +2,73 @@ title: Create Your AppLocker rules (Windows 10) description: This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. ms.assetid: b684a3a5-929c-4f70-8742-04088022f232 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create Your AppLocker rules + **Applies to** - Windows 10 + This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. + ## Creating AppLocker rules + AppLocker rules apply to the targeted app, and they are the components that make up the AppLocker policy. Depending on your IT environment and the business group that requires application control policies, setting these access rules for each application can be time-consuming and prone to error. With AppLocker, you can generate rules automatically or create rules individually. Creating rules that are derived from your planning document can help you avoid unintended results. For info about this planning document and other planning activities, see [AppLocker Design Guide](applocker-policies-design-guide.md). + ### Automatically generate your rules + You can use a reference device to automatically create a set of default rules for each of the installed apps, test and modify each rule as necessary, and deploy the policies. Creating most of the rules for all the installed apps gives you a starting point to build and test your policies. For info about performing this task, see the following topics: + - [Configure the AppLocker reference device](configure-the-appLocker-reference-device.md) - [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md) - [Create AppLocker default rules](create-applocker-default-rules.md) - [Edit AppLocker rules](edit-applocker-rules.md) - [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) + ### Create your rules individually + You can create rules and set the mode to **Audit only** for each installed app, test and update each rule as necessary, and then deploy the policies. Creating rules individually might be best when you are targeting a small number of applications within a business group. -**Note**   -AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You can also edit the default rules. For information about creating the default rules for the Windows operating system, see [Create AppLocker default rules](create-applocker-default-rules.md). + +>**Note:**  AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You can also edit the default rules. For information about creating the default rules for the Windows operating system, see [Create AppLocker default rules](create-applocker-default-rules.md).   For information about performing this task, see: + 1. [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) 2. [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) 3. [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) 4. [Edit AppLocker rules](edit-applocker-rules.md) 5. [Enforce AppLocker rules](enforce-applocker-rules.md) 6. [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) + ## About selecting rules + AppLocker policies are composed of distinct rules for specific apps. These rules are grouped by collection, and they are implemented through an AppLocker policy definition. AppLocker policies are managed by using Group Policy or by using the Local Security Policy snap-in for a single computer. + When you determine what types of rules to create for each of your business groups or organizational units (OUs), you should also determine what enforcement setting to use for each group. Certain rule types are more applicable for some apps, depending on how the apps are deployed in a specific business group. + For info about how to determine and document your AppLocker rules, see [AppLocker Design Guide](applocker-policies-design-guide.md). + For info about AppLocker rules and AppLocker policies, see the following topics: + - [Understanding AppLocker rule behavior](understanding-applocker-rule-behavior.md) - [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md) - [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md) - [Understanding AppLocker allow and deny actions on rules](understanding-applocker-allow-and-deny-actions-on-rules.md) - [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md) - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) + ## Next steps + 1. [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) 2. [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md) 3. [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md) 4. [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) + ## Related topics -[Create Your AppLocker policies](create-your-applocker-policies.md) -  -  + +- [Create Your AppLocker policies](create-your-applocker-policies.md)