mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-25 07:13:37 +00:00
Merge pull request #6918 from MicrosoftDocs/repo_sync_working_branch
Resolve syncing conflicts from repo_sync_working_branch to public
This commit is contained in:
Thomas Raya
GitHub
@ -1,80 +1,38 @@
|
||||
### YamlMime:YamlDocument
|
||||
### YamlMime:Hub
|
||||
|
||||
documentType: LandingData
|
||||
|
||||
title: Windows 10 Enterprise Security
|
||||
title: Windows 10 Enterprise Security # < 60 chars
|
||||
summary: Secure corporate data and manage risk. # < 160 chars
|
||||
# brand: aspnet | azure | dotnet | dynamics | m365 | ms-graph | office | power-bi | power-platform | sql | sql-server | vs | visual-studio | windows | xamarin
|
||||
brand: windows
|
||||
|
||||
metadata:
|
||||
|
||||
document_id:
|
||||
|
||||
title: Windows 10 Enterprise Security
|
||||
|
||||
description: Learn about enterprise-grade security features for Windows 10.
|
||||
|
||||
keywords: protect, company, data, Windows, device, app, management, Microsoft365, e5, e3
|
||||
|
||||
title: Windows 10 Enterprise Security # Required; page title displayed in search results. Include the brand. < 60 chars.
|
||||
description: Learn about enterprise-grade security features for Windows 10. # Required; article description that is displayed in search results. < 160 chars.
|
||||
services: windows
|
||||
ms.product: windows
|
||||
ms.topic: hub-page # Required
|
||||
ms.collection: M365-security-compliance # Optional; Remove if no collection is used.
|
||||
author: danihalfin #Required; your GitHub user alias, with correct capitalization.
|
||||
ms.author: daniha #Required; microsoft alias of author; optional team alias.
|
||||
ms.date: 01/08/2018 #Required; mm/dd/yyyy format.
|
||||
ms.localizationpriority: high
|
||||
|
||||
author: brianlic-msft
|
||||
|
||||
ms.author: brianlic
|
||||
|
||||
manager: brianlic
|
||||
|
||||
ms.date: 08/01/2018
|
||||
|
||||
ms.topic: article
|
||||
|
||||
ms.devlang: na
|
||||
|
||||
sections:
|
||||
|
||||
- items:
|
||||
|
||||
- type: markdown
|
||||
|
||||
text: Secure corporate data and manage risk.
|
||||
|
||||
- items:
|
||||
|
||||
- type: list
|
||||
|
||||
style: cards
|
||||
|
||||
className: cardsM
|
||||
|
||||
columns: 3
|
||||
|
||||
items:
|
||||
|
||||
- href: \windows\security\identity-protection\
|
||||
|
||||
html: <p>Deploy secure enterprise-grade authentication and access control to protect accounts and data</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_identity-protection.svg
|
||||
|
||||
title: Identity and access management
|
||||
|
||||
- href: \windows\security\threat-protection\
|
||||
|
||||
html: <p>Stop cyberthreats and quickly identify and respond to breaches</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_threat-protection.svg
|
||||
|
||||
title: Threat protection
|
||||
|
||||
- href: \windows\security\information-protection\
|
||||
|
||||
html: <p>Identify and secure critical data to prevent data loss</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_information-protection.svg
|
||||
|
||||
title: Information protection
|
||||
|
||||
# productDirectory section (optional)
|
||||
productDirectory:
|
||||
items:
|
||||
# Card
|
||||
- title: Identity and access management
|
||||
# imageSrc should be square in ratio with no whitespace
|
||||
imageSrc: https://docs.microsoft.com/media/common/i_identity-protection.svg
|
||||
summary: Deploy secure enterprise-grade authentication and access control to protect accounts and data
|
||||
url: ./identity-protection/index.md
|
||||
# Card
|
||||
- title: Threat protection
|
||||
imageSrc: https://docs.microsoft.com/media/common/i_threat-protection.svg
|
||||
summary: Stop cyberthreats and quickly identify and respond to breaches
|
||||
url: ./threat-protection/index.md
|
||||
# Card
|
||||
- title: Information protection
|
||||
imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg
|
||||
summary: Identify and secure critical data to prevent data loss
|
||||
url: ./information-protection/index.md
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Collect diagnostic data for Update Compliance and Windows Defender Microsoft Defender Antivirus
|
||||
description: Use a tool to collect data to troubleshoot Update Compliance issues when using the Microsoft Defender Antivirus Assessment add in
|
||||
keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, windows defender av
|
||||
keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
@ -17,13 +17,13 @@ ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Collect Update Compliance diagnostic data for Windows Defender AV Assessment
|
||||
# Collect Update Compliance diagnostic data for Microsoft Defender AV Assessment
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Windows Defender AV Assessment section in the Update Compliance add-in.
|
||||
This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Microsoft Defender AV Assessment section in the Update Compliance add-in.
|
||||
|
||||
Before attempting this process, ensure you have read [Troubleshoot Microsoft Defender Antivirus reporting](troubleshoot-reporting.md), met all require prerequisites, and taken any other suggested troubleshooting steps.
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Collect diagnostic data of Microsoft Defender Antivirus
|
||||
description: Use a tool to collect data to troubleshoot Microsoft Defender Antivirus
|
||||
keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, windows defender av
|
||||
keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
@ -17,13 +17,13 @@ ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Collect Windows Defender AV diagnostic data
|
||||
# Collect Microsoft Defender AV diagnostic data
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Windows Defender AV.
|
||||
This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Microsoft Defender AV.
|
||||
|
||||
On at least two devices that are experiencing the same issue, obtain the .cab diagnostic file by taking the following steps:
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Manage Windows Defender in your business
|
||||
description: Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the command line to manage Windows Defender AV
|
||||
description: Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the command line to manage Microsoft Defender AV
|
||||
keywords: group policy, gpo, config manager, sccm, scep, powershell, wmi, intune, defender, antivirus, antimalware, security, protection
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure scanning options for Windows Defender AV
|
||||
description: You can configure Windows Defender AV to scan email storage files, back-up or reparse points, network files, and archived files (such as .zip files).
|
||||
title: Configure scanning options for Microsoft Defender AV
|
||||
description: You can configure Microsoft Defender AV to scan email storage files, back-up or reparse points, network files, and archived files (such as .zip files).
|
||||
keywords: advanced scans, scanning, email, archive, zip, rar, archive, reparse scanning
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
|
||||
@ -34,7 +34,7 @@ You can [specify how long the file should be prevented from running](configure-c
|
||||
When Microsoft Defender Antivirus encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend applies heuristics, machine learning, and automated analysis of the file to determine whether the files are malicious or clean.
|
||||
|
||||
Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/).
|
||||
|
||||
|
||||
|
||||
In Windows 10, version 1803, block at first sight can now block non-portable executable files (such as JS, VBS, or macros) as well as executable files.
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure the Windows Defender AV cloud block timeout period
|
||||
title: Configure the Microsoft Defender AV cloud block timeout period
|
||||
description: You can configure how long Microsoft Defender Antivirus will block a file from running while waiting for a cloud determination.
|
||||
keywords: Microsoft Defender Antivirus, antimalware, security, defender, cloud, timeout, block, period, seconds
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure how users can interact with Windows Defender AV
|
||||
description: Configure how end-users interact with Windows Defender AV, what notifications they see, and if they can override settings.
|
||||
title: Configure how users can interact with Microsoft Defender AV
|
||||
description: Configure how end-users interact with Microsoft Defender AV, what notifications they see, and if they can override settings.
|
||||
keywords: endpoint, user, interaction, notifications, ui lockdown mode, headless mode, hide interface
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Set up exclusions for Windows Defender AV scans
|
||||
description: You can exclude files (including files modified by specified processes) and folders from being scanned by Windows Defender AV. Validate your exclusions with PowerShell.
|
||||
title: Set up exclusions for Microsoft Defender AV scans
|
||||
description: You can exclude files (including files modified by specified processes) and folders from being scanned by Microsoft Defender AV. Validate your exclusions with PowerShell.
|
||||
keywords:
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
|
||||
@ -140,7 +140,7 @@ All files under a folder (including files in subdirectories), or a specific file
|
||||
>[!IMPORTANT]
|
||||
>If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list.
|
||||
|
||||
For example, the following code snippet would cause Windows Defender AV scans to exclude any file with the `.test` file extension:
|
||||
For example, the following code snippet would cause Microsoft Defender AV scans to exclude any file with the `.test` file extension:
|
||||
|
||||
```PowerShell
|
||||
Add-MpPreference -ExclusionExtension ".test"
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure local overrides for Windows Defender AV settings
|
||||
description: Enable or disable users from locally changing settings in Windows Defender AV.
|
||||
title: Configure local overrides for Microsoft Defender AV settings
|
||||
description: Enable or disable users from locally changing settings in Microsoft Defender AV.
|
||||
keywords: local override, local policy, group policy, gpo, lockdown,merge, lists
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
|
||||
@ -101,7 +101,7 @@ Remove items from the list | `Remove-MpPreference`
|
||||
>[!IMPORTANT]
|
||||
>If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list.
|
||||
|
||||
For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by the specified process:
|
||||
For example, the following code snippet would cause Microsoft Defender AV scans to exclude any file that is opened by the specified process:
|
||||
|
||||
```PowerShell
|
||||
Add-MpPreference -ExclusionProcess "c:\internal\test.exe"
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Enable and configure Microsoft Defender Antivirus protection features
|
||||
description: Enable behavior-based, heuristic, and real-time protection in Windows Defender AV.
|
||||
description: Enable behavior-based, heuristic, and real-time protection in Microsoft Defender AV.
|
||||
keywords: heuristic, machine-learning, behavior monitor, real-time protection, always-on, Microsoft Defender Antivirus, antimalware, security, defender
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
|
||||
@ -44,7 +44,7 @@ This guide describes how to configure your VMs for optimal protection and perfor
|
||||
You can also download the whitepaper [Microsoft Defender Antivirus on Virtual Desktop Infrastructure](https://demo.wd.microsoft.com/Content/wdav-testing-vdi-ssu.pdf), which looks at the new shared security intelligence update feature, alongside performance testing and guidance on how you can test antivirus performance on your own VDI.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Although the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows.<br/>There are performance and feature improvements to the way in which Windows Defender AV operates on virtual machines in Windows 10 Insider Preview, build 18323 (and later). We'll identify in this guide if you need to be using an Insider Preview build; if it isn't specified, then the minimum required version for the best protection and performance is Windows 10 1607.
|
||||
> Although the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows.<br/>There are performance and feature improvements to the way in which Microsoft Defender AV operates on virtual machines in Windows 10 Insider Preview, build 18323 (and later). We'll identify in this guide if you need to be using an Insider Preview build; if it isn't specified, then the minimum required version for the best protection and performance is Windows 10 1607.
|
||||
|
||||
### Set up a dedicated VDI file share
|
||||
|
||||
@ -194,7 +194,7 @@ If you would prefer to do everything manually, this what you would need to do to
|
||||
|
||||
Scheduled scans run in addition to [real-time protection and scanning](configure-real-time-protection-microsoft-defender-antivirus.md).
|
||||
|
||||
The start time of the scan itself is still based on the scheduled scan policy – ScheduleDay, ScheduleTime, ScheduleQuickScanTime. Randomization will cause Windows Defender AV to start a scan on each machine within a 4 hour window from the time set for the scheduled scan.
|
||||
The start time of the scan itself is still based on the scheduled scan policy – ScheduleDay, ScheduleTime, ScheduleQuickScanTime. Randomization will cause Microsoft Defender AV to start a scan on each machine within a 4 hour window from the time set for the scheduled scan.
|
||||
|
||||
See [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) for other configuration options available for scheduled scans.
|
||||
|
||||
@ -219,7 +219,7 @@ Sometimes, Microsoft Defender Antivirus notifications may be sent to or persist
|
||||
|
||||
3. Click **OK**.
|
||||
|
||||
This prevents notifications from Windows Defender AV appearing in the action center on Windows 10 when scans or remediation is performed.
|
||||
This prevents notifications from Microsoft Defender AV appearing in the action center on Windows 10 when scans or remediation is performed.
|
||||
|
||||
### Disable scans after an update
|
||||
|
||||
@ -253,7 +253,7 @@ This forces a scan if the VM has missed two or more consecutive scheduled scans.
|
||||
|
||||
2. Click **OK**.
|
||||
|
||||
This hides the entire Windows Defender AV user interface from users.
|
||||
This hides the entire Microsoft Defender AV user interface from users.
|
||||
|
||||
### Exclusions
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.custom: nextgen
|
||||
> The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates.
|
||||
|
||||
Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/).
|
||||
|
||||
|
||||
|
||||
You can enable or disable Microsoft Defender Antivirus cloud-delivered protection with Microsoft Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, or on individual clients in the Windows Security app.
|
||||
|
||||
|
||||
@ -37,7 +37,7 @@ By default, Microsoft Defender Antivirus will enable itself on a Windows 10 devi
|
||||
|
||||
If Microsoft Defender Antivirus is enabled, the usual options will appear to configure it on that device:
|
||||
|
||||
|
||||
|
||||
|
||||
If another antivirus product is installed and working correctly, Microsoft Defender Antivirus will disable itself. The Windows Security app will change the **Virus & threat protection** section to show status about the AV product, and provide a link to the product's configuration options:
|
||||
|
||||
@ -47,7 +47,7 @@ Underneath any third party AV products, a new link will appear as **Microsoft De
|
||||
|
||||
|
||||
|
||||
Sliding the switch to **On** will show the standard Windows Defender AV options underneath the third party AV product. The limited periodic scanning option will appear at the bottom of the page.
|
||||
Sliding the switch to **On** will show the standard Microsoft Defender AV options underneath the third party AV product. The limited periodic scanning option will appear at the bottom of the page.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -129,9 +129,9 @@ For more information, see [Windows Defender WMIv2 APIs](https://docs.microsoft.c
|
||||
|
||||
## Allow ad hoc changes to protection based on cloud-delivered protection
|
||||
|
||||
Windows Defender AV can make changes to its protection based on cloud-delivered protection. Such changes can occur outside of normal or scheduled protection updates.
|
||||
Microsoft Defender AV can make changes to its protection based on cloud-delivered protection. Such changes can occur outside of normal or scheduled protection updates.
|
||||
|
||||
If you have enabled cloud-delivered protection, Windows Defender AV will send files it is suspicious about to the Windows Defender cloud. If the cloud service reports that the file is malicious, and the file is detected in a recent protection update, you can use Group Policy to configure Windows Defender AV to automatically receive that protection update. Other important protection updates can also be applied.
|
||||
If you have enabled cloud-delivered protection, Microsoft Defender AV will send files it is suspicious about to the Windows Defender cloud. If the cloud service reports that the file is malicious, and the file is detected in a recent protection update, you can use Group Policy to configure Microsoft Defender AV to automatically receive that protection update. Other important protection updates can also be applied.
|
||||
|
||||
### Use Group Policy to automatically download recent updates based on cloud-delivered protection
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Apply Windows Defender AV protection updates to out of date endpoints
|
||||
title: Apply Microsoft Defender AV protection updates to out of date endpoints
|
||||
description: Define when and how updates should be applied for endpoints that have not updated in a while.
|
||||
keywords: updates, protection, out-of-date, outdated, old, catch-up
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -56,7 +56,7 @@ If Microsoft Defender Antivirus did not download protection updates for a specif
|
||||
|
||||
4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates**.
|
||||
|
||||
5. Double-click the **Define the number of days after which a catch-up security intelligence update is required** setting and set the option to **Enabled**. Enter the number of days after which you want Windows Defender AV to check for and download the latest protection update.
|
||||
5. Double-click the **Define the number of days after which a catch-up security intelligence update is required** setting and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to check for and download the latest protection update.
|
||||
|
||||
6. Click **OK**.
|
||||
|
||||
@ -96,11 +96,11 @@ You can also specify the number of days after which Microsoft Defender Antivirus
|
||||
|
||||
5. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates** and configure the following settings:
|
||||
|
||||
1. Double-click **Define the number of days before spyware definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Windows Defender AV to consider spyware Security intelligence to be out-of-date.
|
||||
1. Double-click **Define the number of days before spyware definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to consider spyware Security intelligence to be out-of-date.
|
||||
|
||||
2. Click **OK**.
|
||||
|
||||
3. Double-click **Define the number of days before virus definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Windows Defender AV to consider virus Security intelligence to be out-of-date.
|
||||
3. Double-click **Define the number of days before virus definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to consider virus Security intelligence to be out-of-date.
|
||||
|
||||
4. Click **OK**.
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Manage how and where Windows Defender AV receives updates
|
||||
title: Manage how and where Microsoft Defender AV receives updates
|
||||
description: Manage the fallback order for how Microsoft Defender Antivirus receives protection updates.
|
||||
keywords: updates, security baselines, protection, fallback order, ADL, MMPC, UNC, file path, share, wsus
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Define how mobile devices are updated by Windows Defender AV
|
||||
description: Manage how mobile devices, such as laptops, should be updated with Windows Defender AV protection updates.
|
||||
title: Define how mobile devices are updated by Microsoft Defender AV
|
||||
description: Manage how mobile devices, such as laptops, should be updated with Microsoft Defender AV protection updates.
|
||||
keywords: updates, protection, schedule updates, battery, mobile device, laptop, notebook, opt-in, microsoft update, wsus, override
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Next-generation protection in Windows 10, Windows Server 2016, and Windows Server 2019
|
||||
description: Learn how to manage, configure, and use Windows Defender AV, the built-in antimalware and antivirus product available in Windows 10 and Windows Server 2016
|
||||
description: Learn how to manage, configure, and use Microsoft Defender AV, the built-in antimalware and antivirus product available in Windows 10 and Windows Server 2016
|
||||
keywords: Microsoft Defender Antivirus, windows defender, antimalware, scep, system center endpoint protection, system center configuration manager, virus, malware, threat, detection, protection, security
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Microsoft Defender Antivirus on Windows Server 2016 and 2019
|
||||
description: Enable and configure Windows Defender AV on Windows Server 2016 and 2019
|
||||
description: Enable and configure Microsoft Defender AV on Windows Server 2016 and 2019
|
||||
keywords: windows defender, server, scep, system center endpoint protection, server 2016, current branch, server 2012
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
@ -91,7 +91,7 @@ To use PowerShell to install Microsoft Defender Antivirus, run the following cmd
|
||||
Install-WindowsFeature -Name Windows-Defender
|
||||
```
|
||||
|
||||
Event messages for the antimalware engine included with Microsoft Defender Antivirus can be found in [Windows Defender AV Events](troubleshoot-microsoft-defender-antivirus.md).
|
||||
Event messages for the antimalware engine included with Microsoft Defender Antivirus can be found in [Microsoft Defender AV Events](troubleshoot-microsoft-defender-antivirus.md).
|
||||
|
||||
|
||||
## Verify Microsoft Defender Antivirus is running
|
||||
@ -190,14 +190,14 @@ If you determine you do want to uninstall Microsoft Defender Antivirus, follow t
|
||||
|
||||
If you unselect **Windows Defender** by itself under the **Windows Defender Features** section, you will be prompted to remove the interface option **GUI for Windows Defender**.
|
||||
|
||||
Windows Defender AV will still run normally without the user interface, but the user interface cannot be enabled if you disable the core **Windows Defender** feature.
|
||||
Microsoft Defender AV will still run normally without the user interface, but the user interface cannot be enabled if you disable the core **Windows Defender** feature.
|
||||
|
||||
### Uninstall Microsoft Defender Antivirus using PowerShell
|
||||
|
||||
>[!NOTE]
|
||||
>You can't uninstall the Windows Security app, but you can disable the interface with these instructions.
|
||||
|
||||
The following PowerShell cmdlet will also uninstall Windows Defender AV on Windows Server 2016 or 2019:
|
||||
The following PowerShell cmdlet will also uninstall Microsoft Defender AV on Windows Server 2016 or 2019:
|
||||
|
||||
```PowerShell
|
||||
Uninstall-WindowsFeature -Name Windows-Defender
|
||||
@ -216,6 +216,6 @@ Uninstall-WindowsFeature -Name Windows-Defender-GUI
|
||||
|
||||
- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)
|
||||
|
||||
- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Configure exclusions in Microsoft Defender AV on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||
|
||||
|
||||
|
||||
@ -48,7 +48,7 @@ To run Microsoft Defender Offline from the endpoint, the user must be logged in
|
||||
Microsoft Defender Offline uses the most recent protection updates available on the endpoint; it's updated whenever Windows Defender Antivirus is updated.
|
||||
|
||||
> [!NOTE]
|
||||
> Before running an offline scan, you should attempt to update Windows Defender AV protection. You can either force an update with Group Policy or however you normally deploy updates to endpoints, or you can manually download and install the latest protection updates from the [Microsoft Malware Protection Center](https://www.microsoft.com/security/portal/definitions/adl.aspx).
|
||||
> Before running an offline scan, you should attempt to update Microsoft Defender AV protection. You can either force an update with Group Policy or however you normally deploy updates to endpoints, or you can manually download and install the latest protection updates from the [Microsoft Malware Protection Center](https://www.microsoft.com/security/portal/definitions/adl.aspx).
|
||||
|
||||
See the [Manage Microsoft Defender Antivirus Security intelligence updates](manage-protection-updates-microsoft-defender-antivirus.md) topic for more information.
|
||||
|
||||
@ -75,7 +75,7 @@ Microsoft Defender Offline scans are indicated under **Malware remediation statu
|
||||
## Configure notifications
|
||||
<a name="manage-notifications"></a>
|
||||
|
||||
Microsoft Defender Offline notifications are configured in the same policy setting as other Windows Defender AV notifications.
|
||||
Microsoft Defender Offline notifications are configured in the same policy setting as other Microsoft Defender AV notifications.
|
||||
|
||||
For more information about notifications in Windows Defender, see the [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) topic.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Microsoft Defender Antivirus in the Windows Security app
|
||||
description: With Windows Defender AV now included in the Windows Security app, you can review, compare, and perform common tasks.
|
||||
description: With Microsoft Defender AV now included in the Windows Security app, you can review, compare, and perform common tasks.
|
||||
keywords: wdav, antivirus, firewall, security, windows
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
@ -27,8 +27,8 @@ In Windows 10, version 1703 and later, the Windows Defender app is part of the W
|
||||
Settings that were previously part of the Windows Defender client and main Windows Settings have been combined and moved to the new app, which is installed by default as part of Windows 10, version 1703.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date.<br/>If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device.
|
||||
>It may also prevent Windows Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed.
|
||||
> Disabling the Windows Security Center service will not disable Microsoft Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date.<br/>If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device.
|
||||
>It may also prevent Microsoft Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed.
|
||||
>This will significantly lower the protection of your device and could lead to malware infection.
|
||||
|
||||
|
||||
@ -108,7 +108,7 @@ This section describes how to perform some of the most common tasks when reviewi
|
||||
|
||||
>[!NOTE]
|
||||
>If you switch **Real-time protection** off, it will automatically turn back on after a short delay. This is to ensure you are protected from malware and threats.
|
||||
>If you install another antivirus product, Windows Defender AV will automatically disable itself and will indicate this in the Windows Security app. A setting will appear that will allow you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md).
|
||||
>If you install another antivirus product, Microsoft Defender AV will automatically disable itself and will indicate this in the Windows Security app. A setting will appear that will allow you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md).
|
||||
|
||||
|
||||
<a id="exclusions"></a>
|
||||
|
||||
@ -1,68 +0,0 @@
|
||||
|
||||
# [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)
|
||||
|
||||
## [Windows Defender AV in the Microsoft Defender Security Center app](microsoft-defender-security-center-antivirus.md)
|
||||
|
||||
## [Windows Defender AV on Windows Server 2016](microsoft-defender-antivirus-on-windows-server-2016.md)
|
||||
|
||||
## [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md)
|
||||
### [Use limited periodic scanning in Windows Defender AV](limited-periodic-scanning-microsoft-defender-antivirus.md)
|
||||
|
||||
|
||||
## [Evaluate Microsoft Defender Antivirus protection](evaluate-microsoft-defender-antivirus.md)
|
||||
|
||||
|
||||
## [Deploy, manage updates, and report on Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md)
|
||||
### [Deploy and enable Microsoft Defender Antivirus](deploy-microsoft-defender-antivirus.md)
|
||||
#### [Deployment guide for VDI environments](deployment-vdi-microsoft-defender-antivirus.md)
|
||||
### [Report on Microsoft Defender Antivirus protection](report-monitor-microsoft-defender-antivirus.md)
|
||||
#### [Troubleshoot Microsoft Defender Antivirus reporting in Update Compliance](troubleshoot-reporting.md)
|
||||
### [Manage updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md)
|
||||
#### [Manage protection and Security intelligence updates](manage-protection-updates-microsoft-defender-antivirus.md)
|
||||
#### [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md)
|
||||
#### [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md)
|
||||
#### [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md)
|
||||
#### [Manage updates for mobile devices and VMs](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md)
|
||||
|
||||
|
||||
## [Configure Microsoft Defender Antivirus features](configure-microsoft-defender-antivirus-features.md)
|
||||
### [Utilize Microsoft cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md)
|
||||
#### [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md)
|
||||
#### [Specify the cloud-delivered protection level](specify-cloud-protection-level-microsoft-defender-antivirus.md)
|
||||
#### [Configure and validate network connections](configure-network-connections-microsoft-defender-antivirus.md)
|
||||
#### [Enable the Block at First Sight feature](configure-block-at-first-sight-microsoft-defender-antivirus.md)
|
||||
#### [Configure the cloud block timeout period](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md)
|
||||
### [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md)
|
||||
#### [Detect and block Potentially Unwanted Applications](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md)
|
||||
#### [Enable and configure always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md)
|
||||
### [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-microsoft-defender-antivirus.md)
|
||||
#### [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md)
|
||||
#### [Prevent users from seeing or interacting with the user interface](prevent-end-user-interaction-microsoft-defender-antivirus.md)
|
||||
#### [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md)
|
||||
|
||||
|
||||
## [Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md)
|
||||
### [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-microsoft-defender-antivirus.md)
|
||||
#### [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md)
|
||||
#### [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md)
|
||||
#### [Configure exclusions in Windows Defender AV on Windows Server 2016](configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||
### [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-microsoft-defender-antivirus.md)
|
||||
### [Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md)
|
||||
### [Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md)
|
||||
### [Configure and run scans](run-scan-microsoft-defender-antivirus.md)
|
||||
### [Review scan results](review-scan-results-microsoft-defender-antivirus.md)
|
||||
### [Run and review the results of a Windows Defender Offline scan](microsoft-defender-offline.md)
|
||||
|
||||
|
||||
## [Review event logs and error codes to troubleshoot issues](troubleshoot-microsoft-defender-antivirus.md)
|
||||
|
||||
|
||||
|
||||
## [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md)
|
||||
### [Use Group Policy settings to configure and manage Windows Defender AV](use-group-policy-microsoft-defender-antivirus.md)
|
||||
### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](use-intune-config-manager-microsoft-defender-antivirus.md)
|
||||
### [Use PowerShell cmdlets to configure and manage Windows Defender AV](use-powershell-cmdlets-microsoft-defender-antivirus.md)
|
||||
### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](use-wmi-microsoft-defender-antivirus.md)
|
||||
### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](command-line-arguments-microsoft-defender-antivirus.md)
|
||||
|
||||
|
||||
@ -44,7 +44,7 @@ In earlier versions of Windows 10, the setting will hide the Windows Defender cl
|
||||
|
||||
|
||||
|
||||
## Use Group Policy to hide the Windows Defender AV interface from users
|
||||
## Use Group Policy to hide the Microsoft Defender AV interface from users
|
||||
|
||||
1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Monitor and report on Microsoft Defender Antivirus protection
|
||||
description: Use Configuration Manager or security information and event management (SIEM) tools to consume reports, and monitor Windows Defender AV with PowerShell and WMI.
|
||||
keywords: siem, monitor, report, windows defender av
|
||||
description: Use Configuration Manager or security information and event management (SIEM) tools to consume reports, and monitor Microsoft Defender AV with PowerShell and WMI.
|
||||
keywords: siem, monitor, report, Microsoft Defender AV
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Restore quarantined files in Windows Defender AV
|
||||
description: You can restore files and folders that were quarantined by Windows Defender AV.
|
||||
title: Restore quarantined files in Microsoft Defender AV
|
||||
description: You can restore files and folders that were quarantined by Microsoft Defender AV.
|
||||
keywords:
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
@ -17,7 +17,7 @@ ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Restore quarantined files in Windows Defender AV
|
||||
# Restore quarantined files in Microsoft Defender AV
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Review the results of Windows Defender AV scans
|
||||
title: Review the results of Microsoft Defender AV scans
|
||||
description: Review the results of scans using Microsoft Endpoint Configuration Manager, Microsoft Intune, or the Windows Security app
|
||||
keywords: scan results, remediation, full scan, quick scan
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Run and customize on-demand scans in Windows Defender AV
|
||||
title: Run and customize on-demand scans in Microsoft Defender AV
|
||||
description: Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Security app
|
||||
keywords: scan, on-demand, dos, intune, instant scan
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Schedule regular quick and full scans with Windows Defender AV
|
||||
title: Schedule regular quick and full scans with Microsoft Defender AV
|
||||
description: Set up recurring (scheduled) scans, including when they should run and whether they run as full or quick scans
|
||||
keywords: quick scan, full scan, quick vs full, schedule scan, daily, weekly, time, scheduled, recurring, regular
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Windows Defender AV event IDs and error codes
|
||||
title: Microsoft Defender AV event IDs and error codes
|
||||
description: Look up the causes and solutions for Microsoft Defender Antivirus event IDs and errors
|
||||
keywords: event, error code, siem, logging, troubleshooting, wef, windows event forwarding
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Troubleshoot problems with reporting tools for Windows Defender AV
|
||||
description: Identify and solve common problems when attempting to report in Windows Defender AV protection status in Update Compliance
|
||||
keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, windows defender av
|
||||
title: Troubleshoot problems with reporting tools for Microsoft Defender AV
|
||||
description: Identify and solve common problems when attempting to report in Microsoft Defender AV protection status in Update Compliance
|
||||
keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
@ -51,9 +51,9 @@ There are three steps to troubleshooting these problems:
|
||||
In order for devices to properly show up in Update Compliance, you have to meet certain prerequisites for both the Update Compliance service and for Microsoft Defender Antivirus:
|
||||
|
||||
>[!div class="checklist"]
|
||||
>- Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](microsoft-defender-antivirus-compatibility.md) and the endpoint will not be reported in Update Compliance.
|
||||
>- Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Microsoft Defender AV to disable itself](microsoft-defender-antivirus-compatibility.md) and the endpoint will not be reported in Update Compliance.
|
||||
> - [Cloud-delivered protection is enabled](enable-cloud-protection-microsoft-defender-antivirus.md).
|
||||
> - Endpoints can [connect to the Windows Defender AV cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud)
|
||||
> - Endpoints can [connect to the Microsoft Defender AV cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud)
|
||||
> - If the endpoint is running Windows 10 version 1607 or earlier, [Windows 10 diagnostic data must be set to the Enhanced level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level).
|
||||
> - It has been 3 days since all requirements have been met
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure Microsoft Defender Antivirus with Configuration Manager and Intune
|
||||
description: Use Microsoft Endpoint Configuration Manager and Microsoft Intune to configure Windows Defender AV and Endpoint Protection
|
||||
description: Use Microsoft Endpoint Configuration Manager and Microsoft Intune to configure Microsoft Defender AV and Endpoint Protection
|
||||
keywords: scep, intune, endpoint protection, configuration
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Use PowerShell cmdlets to configure and run Windows Defender AV
|
||||
title: Use PowerShell cmdlets to configure and run Microsoft Defender AV
|
||||
description: In Windows 10, you can use PowerShell cmdlets to run scans, update Security intelligence, and change settings in Microsoft Defender Antivirus.
|
||||
keywords: scan, command line, mpcmdrun, defender
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure Microsoft Defender Antivirus with WMI
|
||||
description: Use WMI scripts to configure Windows Defender AV.
|
||||
description: Use WMI scripts to configure Microsoft Defender AV.
|
||||
keywords: wmi, scripts, windows management instrumentation, configuration
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
|
||||
@ -25,7 +25,7 @@ ms.custom: nextgen
|
||||
Microsoft next-generation technologies in Microsoft Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models.
|
||||
|
||||
Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/).
|
||||
|
||||
|
||||
|
||||
To take advantage of the power and speed of these next-generation technologies, Microsoft Defender Antivirus works seamlessly with Microsoft cloud services. These cloud protection services, also referred to as Microsoft Advanced Protection Service (MAPS), enhances standard real-time protection, providing arguably the best antivirus defense.
|
||||
|
||||
|
||||
@ -91,8 +91,7 @@ Yes, both the Enterprise Resource domains hosted in the cloud and the Domains ca
|
||||
|
||||
### Why does my encryption driver break Microsoft Defender Application Guard?
|
||||
|
||||
|
||||
Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work and result in an error message ("0x80070013 ERROR_WRITE_PROTECT").
|
||||
Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work and result in an error message ("0x80070013 ERROR_WRITE_PROTECT").
|
||||
|
||||
### Why do the Network Isolation policies in Group Policy and CSP look different?
|
||||
|
||||
|
||||
@ -58,16 +58,16 @@ Informational </br>(Grey) | Alerts that might not be considered harmful to the n
|
||||
|
||||
#### Understanding alert severity
|
||||
|
||||
Microsoft Defender Antivirus (Windows Defender AV) and Microsoft Defender ATP alert severities are different because they represent different scopes.
|
||||
Microsoft Defender Antivirus (Microsoft Defender AV) and Microsoft Defender ATP alert severities are different because they represent different scopes.
|
||||
|
||||
The Windows Defender AV threat severity represents the absolute severity of the detected threat (malware), and is assigned based on the potential risk to the individual machine, if infected.
|
||||
The Microsoft Defender AV threat severity represents the absolute severity of the detected threat (malware), and is assigned based on the potential risk to the individual machine, if infected.
|
||||
|
||||
The Microsoft Defender ATP alert severity represents the severity of the detected behavior, the actual risk to the machine but more importantly the potential risk to the organization.
|
||||
|
||||
So, for example:
|
||||
|
||||
- The severity of a Microsoft Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage.
|
||||
- An alert about a commercial malware was detected while executing, but blocked and remediated by Windows Defender AV, is categorized as "Low" because it may have caused some damage to the individual machine but poses no organizational threat.
|
||||
- The severity of a Microsoft Defender ATP alert about a Microsoft Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage.
|
||||
- An alert about a commercial malware was detected while executing, but blocked and remediated by Microsoft Defender AV, is categorized as "Low" because it may have caused some damage to the individual machine but poses no organizational threat.
|
||||
- An alert about malware detected while executing which can pose a threat not only to the individual machine but to the organization, regardless if it was eventually blocked, may be ranked as "Medium" or "High".
|
||||
- Suspicious behavioral alerts, which weren't blocked or remediated will be ranked "Low", "Medium" or "High" following the same organizational threat considerations.
|
||||
|
||||
|
||||
@ -43,7 +43,7 @@ Field numbers match the numbers in the images below.
|
||||
>
|
||||
> | Portal label | SIEM field name | ArcSight field | Example value | Description |
|
||||
> |------------------|---------------------------|---------------------|------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
> | 1 | AlertTitle | name | Windows Defender AV detected 'Mikatz' high-severity malware | Value available for every Detection. |
|
||||
> | 1 | AlertTitle | name | Microsoft Defender AV detected 'Mikatz' high-severity malware | Value available for every Detection. |
|
||||
> | 2 | Severity | deviceSeverity | High | Value available for every Detection. |
|
||||
> | 3 | Category | deviceEventCategory | Malware | Value available for every Detection. |
|
||||
> | 4 | Detection source | sourceServiceName | Antivirus | Microsoft Defender Antivirus or Microsoft Defender ATP. Value available for every Detection. |
|
||||
@ -53,13 +53,13 @@ Field numbers match the numbers in the images below.
|
||||
> | 8 | UserDomain | sourceNtDomain | CONTOSO | The domain of the user context running the activity, available for Microsoft Defender ATP behavioral based detections. |
|
||||
> | 9 | UserName | sourceUserName | liz.bean | The user context running the activity, available for Microsoft Defender ATP behavioral based detections. |
|
||||
> | 10 | Sha1 | fileHash | 3da065e07b990034e9db7842167f70b63aa5329 | Available for detections associated with a file or process. |
|
||||
> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Windows Defender AV detections. |
|
||||
> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Windows Defender AV detections. |
|
||||
> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Windows Defender AV detections. |
|
||||
> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Microsoft Defender AV detections. |
|
||||
> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Microsoft Defender AV detections. |
|
||||
> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Microsoft Defender AV detections. |
|
||||
> | 14 | IpAddress | sourceAddress | 218.90.204.141 | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. |
|
||||
> | 15 | Url | requestUrl | down.esales360.cn | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. |
|
||||
> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. |
|
||||
> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. |
|
||||
> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Microsoft Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. |
|
||||
> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Microsoft Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. |
|
||||
> | 18 | AlertId | externalId | 636210704265059241_673569822 | Value available for every Detection. |
|
||||
> | 19 | LinkToWDATP | flexString1 | `https://securitycenter.windows.com/alert/636210704265059241_673569822` | Value available for every Detection. |
|
||||
> | 20 | AlertTime | deviceReceiptTime | 2017-05-07T01:56:59.3191352Z | The time the event occurred. Value available for every Detection. |
|
||||
|
||||
@ -31,7 +31,7 @@ While the features will not block or prevent apps, scripts, or files from being
|
||||
|
||||
To find the audited entries, go to **Applications and Services** > **Microsoft** > **Windows** > **Windows Defender** > **Operational**.
|
||||
|
||||
You can use Windows Defender Advanced Threat Protection to get greater details for each event, especially for investigating attack surface reduction rules. Using the Microsoft Defender ATP console lets you [investigate issues as part of the alert timeline and investigation scenarios](../microsoft-defender-atp/investigate-alerts.md).
|
||||
You can use Microsoft Defender Advanced Threat Protection to get greater details for each event, especially for investigating attack surface reduction rules. Using the Microsoft Defender ATP console lets you [investigate issues as part of the alert timeline and investigation scenarios](../microsoft-defender-atp/investigate-alerts.md).
|
||||
|
||||
This topic provides links that describe how to enable the audit functionality for each feature and how to view events in the Windows Event Viewer.
|
||||
|
||||
|
||||
@ -38,7 +38,7 @@ The Windows Intune security baseline provides a comprehensive set of recommended
|
||||
- [Windows security baseline settings for Intune](https://docs.microsoft.com/intune/security-baseline-settings-windows)
|
||||
- [Microsoft Defender ATP baseline settings for Intune](https://docs.microsoft.com/intune/security-baseline-settings-defender-atp)
|
||||
|
||||
Ideally, machines onboarded to Microsoft Defender ATP are deployed both baselines: the Windows Intune security baseline to initially secure Windows and then the Microsoft Defender ATP security baseline layered on top to optimally configure the Microsoft Defender ATP security controls.
|
||||
Ideally, machines onboarded to Microsoft Defender ATP are deployed both baselines: the Windows Intune security baseline to initially secure Windows and then the Microsoft Defender ATP security baseline layered on top to optimally configure the Microsoft Defender ATP security controls. To benefit from the latest data on risks and threats and to minimize conflicts as baselines evolve, always apply the latest versions of the baselines across all products as soon as they are released.
|
||||
|
||||
>[!NOTE]
|
||||
>The Microsoft Defender ATP security baseline has been optimized for physical devices and is currently not recommended for use on virtual machines (VMs) or VDI endpoints. Certain baseline settings can impact remote interactive sessions on virtualized environments.
|
||||
|
||||
@ -151,7 +151,7 @@ Support for Windows Server, provide deeper insight into activities happening on
|
||||
|
||||
1. Configure Microsoft Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints.md).
|
||||
|
||||
2. If you're running a third-party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings. Verify that it was configured correctly:
|
||||
2. If you're running a third-party antimalware solution, you'll need to apply the following Microsoft Defender AV passive mode settings. Verify that it was configured correctly:
|
||||
|
||||
1. Set the following registry entry:
|
||||
- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`
|
||||
@ -168,11 +168,11 @@ Support for Windows Server, provide deeper insight into activities happening on
|
||||
|
||||
|
||||
|
||||
3. Run the following command to check if Windows Defender AV is installed:
|
||||
3. Run the following command to check if Microsoft Defender AV is installed:
|
||||
|
||||
```sc.exe query Windefend```
|
||||
|
||||
If the result is 'The specified service does not exist as an installed service', then you'll need to install Windows Defender AV. For more information, see [Microsoft Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10).
|
||||
If the result is 'The specified service does not exist as an installed service', then you'll need to install Microsoft Defender AV. For more information, see [Microsoft Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10).
|
||||
|
||||
|
||||
## Integration with Azure Security Center
|
||||
|
||||
@ -41,7 +41,7 @@ Group Policy settings that disable local administrator list merging will overrid
|
||||
* Microsoft Defender Antivirus **Configure local administrator merge behavior for lists**
|
||||
* System Center Endpoint Protection **Allow users to add exclusions and overrides**
|
||||
|
||||
For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged).
|
||||
For more information about disabling local list merging, see [Prevent or allow users to locally modify Microsoft Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged).
|
||||
|
||||
## Windows Security app
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 52 KiB After Width: | Height: | Size: 65 KiB |
@ -61,7 +61,7 @@ For more information on these actions, see [Take response action on a file](resp
|
||||
|
||||
The file details, incident, malware detection, and file prevalence cards display various attributes about the file.
|
||||
|
||||
You'll see details such as the file’s MD5, the Virus Total detection ratio, and Windows Defender AV detection if available, and the file’s prevalence, both worldwide and within your organizations.
|
||||
You'll see details such as the file’s MD5, the Virus Total detection ratio, and Microsoft Defender AV detection if available, and the file’s prevalence, both worldwide and within your organizations.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -30,13 +30,13 @@ Indicator of compromise (IoCs) matching is an essential feature in every endpoin
|
||||
|
||||
Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to.
|
||||
|
||||
Currently supported sources are the cloud detection engine of Microsoft Defender ATP, the automated investigation and remediation engine, and the endpoint prevention engine (Windows Defender AV).
|
||||
Currently supported sources are the cloud detection engine of Microsoft Defender ATP, the automated investigation and remediation engine, and the endpoint prevention engine (Microsoft Defender AV).
|
||||
|
||||
**Cloud detection engine**<br>
|
||||
The cloud detection engine of Microsoft Defender ATP regularly scans collected data and tries to match the indicators you set. When there is a match, action will be taken according to the settings you specified for the IoC.
|
||||
|
||||
**Endpoint prevention engine**<br>
|
||||
The same list of indicators is honored by the prevention agent. Meaning, if Windows Defender AV is the primary AV configured, the matched indicators will be treated according to the settings. For example, if the action is "Alert and Block", Windows Defender AV will prevent file executions (block and remediate) and a corresponding alert will be raised. On the other hand, if the Action is set to "Allow", Windows Defender AV will not detect nor block the file from being run.
|
||||
The same list of indicators is honored by the prevention agent. Meaning, if Microsoft Defender AV is the primary AV configured, the matched indicators will be treated according to the settings. For example, if the action is "Alert and Block", Microsoft Defender AV will prevent file executions (block and remediate) and a corresponding alert will be raised. On the other hand, if the Action is set to "Allow", Microsoft Defender AV will not detect nor block the file from being run.
|
||||
|
||||
**Automated investigation and remediation engine**<BR>
|
||||
The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as "bad".
|
||||
@ -153,7 +153,7 @@ It's important to understand the following prerequisites prior to creating indic
|
||||
You can create indicators for certificates. Some common use cases include:
|
||||
|
||||
- Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) and [controlled folder access](controlled-folders.md) but need to allow behaviors from signed applications by adding the certificate in the allow list.
|
||||
- Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Windows Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same.
|
||||
- Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Microsoft Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same.
|
||||
|
||||
|
||||
### Before you begin
|
||||
|
||||
@ -44,11 +44,11 @@ You can also use [audit mode](audit-windows-defender.md) to evaluate how Network
|
||||
|
||||
## Requirements
|
||||
|
||||
Network protection requires Windows 10 Pro, Enterprise E3, E5 and Windows Defender AV real-time protection.
|
||||
Network protection requires Windows 10 Pro, Enterprise E3, E5 and Microsoft Defender AV real-time protection.
|
||||
|
||||
Windows 10 version | Microsoft Defender Antivirus
|
||||
-|-
|
||||
Windows 10 version 1709 or later | [Windows Defender AV real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) and [cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) must be enabled
|
||||
Windows 10 version 1709 or later | [Microsoft Defender AV real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) and [cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) must be enabled
|
||||
|
||||
## Review network protection events in the Microsoft Defender ATP Security Center
|
||||
|
||||
|
||||
@ -95,7 +95,7 @@ below to onboard systems with Configuration Manager.
|
||||
|
||||
|
||||
|
||||
7. Keep criterion type as **simple value**, choose where as **Operating System - build number**, operator as **is equal to** and value **10240** and click on **OK**.
|
||||
7. Keep criterion type as **simple value**, choose where as **Operating System - build number**, operator as **is greater than or equal to** and value **14393** and click on **OK**.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -28,6 +28,8 @@ Microsoft Defender ATP endpoint detection and response capabilities provide adva
|
||||
|
||||
When a threat is detected, alerts are created in the system for an analyst to investigate. Alerts with the same attack techniques or attributed to the same attacker are aggregated into an entity called an _incident_. Aggregating alerts in this manner makes it easy for analysts to collectively investigate and respond to threats.
|
||||
|
||||
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4o1j5]
|
||||
|
||||
Inspired by the "assume breach" mindset, Microsoft Defender ATP continuously collects behavioral cyber telemetry. This includes process information, network activities, deep optics into the kernel and memory manager, user login activities, registry and file system changes, and others. The information is stored for six months, enabling an analyst to travel back in time to the start of an attack. The analyst can then pivot in various views and approach an investigation through multiple vectors.
|
||||
|
||||
The response capabilities give you the power to promptly remediate threats by acting on the affected entities.
|
||||
|
||||
@ -81,7 +81,7 @@ Icon | Description
|
||||
| Not remediated – Threat not removed from the machine.
|
||||
| Indicates events that triggered an alert in the **Alert process tree**.
|
||||
| Machine icon
|
||||
| Microsoft Defender Antivirus events
|
||||
| Microsoft Defender Antivirus events
|
||||
| Windows Defender Application Guard events
|
||||
| Windows Defender Device Guard events
|
||||
| Windows Defender Exploit Guard events
|
||||
|
||||
@ -116,13 +116,13 @@ As part of the investigation or response process, you can remotely initiate an a
|
||||
|
||||
>[!IMPORTANT]
|
||||
>- This action is available for machines on Windows 10, version 1709 or later.
|
||||
>- A Microsoft Defender Antivirus (Windows Defender AV) scan can run alongside other antivirus solutions, whether Windows Defender AV is the active antivirus solution or not. Windows Defender AV can be in Passive mode. For more information, see [Microsoft Defender Antivirus compatibility](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||
>- A Microsoft Defender Antivirus (Microsoft Defender AV) scan can run alongside other antivirus solutions, whether Microsoft Defender AV is the active antivirus solution or not. Microsoft Defender AV can be in Passive mode. For more information, see [Microsoft Defender Antivirus compatibility](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||
|
||||
One you have selected **Run antivirus scan**, select the scan type that you'd like to run (quick or full) and add a comment before confirming the scan.
|
||||
|
||||
|
||||
|
||||
The Action center will show the scan information and the machine timeline will include a new event, reflecting that a scan action was submitted on the machine. Windows Defender AV alerts will reflect any detections that surfaced during the scan.
|
||||
The Action center will show the scan information and the machine timeline will include a new event, reflecting that a scan action was submitted on the machine. Microsoft Defender AV alerts will reflect any detections that surfaced during the scan.
|
||||
|
||||
## Restrict app execution
|
||||
|
||||
|
||||
@ -46,7 +46,7 @@ Attack surface reduction rules will only work on devices with the following cond
|
||||
|
||||
- Endpoints are running Windows 10 Enterprise, version 1709 (also known as the Fall Creators Update).
|
||||
|
||||
- Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||
- Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Microsoft Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||
|
||||
- [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled.
|
||||
|
||||
|
||||
@ -43,7 +43,7 @@ Network protection will only work on devices with the following conditions:
|
||||
|
||||
>[!div class="checklist"]
|
||||
> * Endpoints are running Windows 10 Enterprise edition, version 1709 or higher (also known as the Fall Creators Update).
|
||||
> * Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||
> * Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Microsoft Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||
> * [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled.
|
||||
> * [Cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) is enabled.
|
||||
> * Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**).
|
||||
|
||||
@ -1,66 +0,0 @@
|
||||
---
|
||||
title: Configure the Group Policy settings for Microsoft Defender Application Guard (Windows 10)
|
||||
description: Learn about the available Group Policy settings for Microsoft Defender Application Guard.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 05/27/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
---
|
||||
|
||||
# Configure Microsoft Defender Application Guard policy settings
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Microsoft Defender Application Guard (Application Guard) works with Group Policy to help you manage your organization's computer settings. By using Group Policy, you can configure a setting once, and then copy it onto many computers. For example, you can set up multiple security settings in a GPO, which is linked to a domain, and then apply all those settings to every computer in the domain.
|
||||
|
||||
Application Guard uses both network isolation and application-specific settings.
|
||||
|
||||
## Network isolation settings
|
||||
|
||||
These settings, located at **Computer Configuration\Administrative Templates\Network\Network Isolation**, help you define and manage your company's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container.
|
||||
|
||||
>[!NOTE]
|
||||
>You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. Proxy servers must be a neutral resource listed in the "Domains categorized as both work and personal" policy.
|
||||
|
||||
|
||||
|
||||
|Policy name|Supported versions|Description|
|
||||
|-----------|------------------|-----------|
|
||||
|Private network ranges for apps|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.|
|
||||
|Enterprise resource domains hosted in the cloud|At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.|
|
||||
|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment. Proxies should be added to this list. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.|
|
||||
|
||||
## Network isolation settings wildcards
|
||||
|
||||
|Value|Number of dots to the left|Meaning|
|
||||
|-----|--------------------------|-------|
|
||||
|`contoso.com`|0|Trust only the literal value of `contoso.com`.|
|
||||
|`www.contoso.com`|0|Trust only the literal value of `www.contoso.com`.|
|
||||
|`.contoso.com`|1|Trust any domain that ends with the text `contoso.com`. Matching sites include `spearphishingcontoso.com`, `contoso.com`, and `www.contoso.com`.|
|
||||
|`..contoso.com`|2|Trust all levels of the domain hierarchy that are to the left of the dot. Matching sites include `shop.contoso.com`, `us.shop.contoso.com`, `www.us.shop.contoso.com`, but NOT `contoso.com` itself.|
|
||||
|
||||
## Application-specific settings
|
||||
These settings, located at **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard**, can help you to manage your company's implementation of Application Guard.
|
||||
|
||||
|Name|Supported versions|Description|Options|
|
||||
|-----------|------------------|-----------|-------|
|
||||
|Configure Windows Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher<br><br>Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:<br/>-Disable the clipboard functionality completely when Virtualization Security is enabled.<br/>- Enable copying of certain content from Application Guard into Microsoft Edge.<br/>- Enable copying of certain content from Microsoft Edge into Application Guard. **Important:** Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.<br/><br/>**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.|
|
||||
|Configure Windows Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher<br><br>Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:<br/>- Enable Application Guard to print into the XPS format.<br/>- Enable Application Guard to print into the PDF format.<br/>- Enable Application Guard to print to locally attached printers.<br/>- Enable Application Guard to print from previously connected network printers. Employees can't search for additional printers.<br/><br/>**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.<br><br>**Note**<br>Network printers must be published by Active Directory to work in Application Guard.|
|
||||
|Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container. **Note:** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.<br><br>**Disabled or not configured.** Prevents Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard.<br><br>**Note**<br>This policy is no longer supported in the 2004 update and later.|
|
||||
|Allow Persistence|Windows 10 Enterprise, 1709 or higher<br><br>Windows 10 Pro, 1803 or higher|Determines whether data persists across different sessions in Windows Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.<br><br>**Disabled or not configured.** All user data within Application Guard is reset between sessions.<br><br>**Note**<br>If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.<br><br>**To reset the container:**<br/>1. Open a command-line program and navigate to `Windows/System32`.<br/>2. Type `wdagtool.exe cleanup`. The container environment is reset, retaining only the employee-generated data.<br/>3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`. The container environment is reset, including discarding all employee-generated data.|
|
||||
|Turn on Windows Defender Application Guard in Managed Mode|Windows 10 Enterprise, 1809 or higher|Determines whether to turn on Application Guard for Microsoft Edge and Microsoft Office.|**Enabled.** Turns on Application Guard for Microsoft Edge and/or Microsoft Office, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device. Available options:<br/>- Enable Windows Defender Application Guard only for Microsoft Edge<br/>- Enable Windows Defender Application Guard only for Microsoft Office<br/>- Enable Windows Defender Application Guard for both Microsoft Edge and Microsoft Office<br/><br/>**Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge and Microsoft Office.|
|
||||
|Allow files to download to host operating system|Windows 10 Enterprise, 1803 or higher|Determines whether to save downloaded files to the host operating system from the Windows Defender Application Guard container.|**Enabled.** Allows users to save downloaded files from the Windows Defender Application Guard container to the host operating system.<br><br>**Disabled or not configured.** Users are not able to saved downloaded files from Application Guard to the host operating system.|
|
||||
|Allow hardware-accelerated rendering for Windows Defender Application Guard|Windows 10 Enterprise, 1803 or higher<br><br>Windows 10 Pro, 1803 or higher|Determines whether Windows Defender Application Guard renders graphics using hardware or software acceleration.|**Enabled.** Windows Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Windows Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If this setting is enabled without connecting any high-security rendering graphics hardware, Windows Defender Application Guard will automatically revert to software-based (CPU) rendering. **Important:** Be aware that enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.<br><br>**Disabled or not configured.** Windows Defender Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.|
|
||||
|Allow camera and microphone access in Windows Defender Application Guard|Windows 10 Enterprise, 1809 or higher<br><br>Windows 10 Pro, 1809 or higher|Determines whether to allow camera and microphone access inside Windows Defender Application Guard.|**Enabled.** Applications inside Windows Defender Application Guard are able to access the camera and microphone on the user's device. **Important:** Be aware that enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.<br><br>**Disabled or not configured.** Applications inside Windows Defender Application Guard are unable to access the camera and microphone on the user's device.|
|
||||
|Allow Windows Defender Application Guard to use Root Certificate Authorities from a user's device|Windows 10 Enterprise, 1809 or higher<br><br>Windows 10 Pro, 1809 or higher|Determines whether Root Certificates are shared with Windows Defender Application Guard.|**Enabled.** Certificates matching the specified thumbprint are transferred into the container. Use a comma to separate multiple certificates.<br><br>**Disabled or not configured.** Certificates are not shared with Windows Defender Application Guard.|
|
||||
|Allow users to trust files that open in Windows Defender Application Guard|Windows 10 Enterprise, 1809 or higher|Determines whether users are able to manually trust untrusted files to open them on the host.|**Enabled.** Users are able to manually trust files or trust files after an antivirus check.<br><br>**Disabled or not configured.** Users are unable to manually trust files and files continue to open in Windows Defender Application Guard.|
|
||||
|
||||
|
||||
@ -42,7 +42,7 @@ You can't uninstall the Windows Security app, but you can do one of the followin
|
||||
|
||||
- Disable the interface on Windows Server 2016. See [Microsoft Defender Antivirus on Windows Server 2016](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016).
|
||||
- Hide all of the sections on client computers (see below).
|
||||
- Disable Microsoft Defender Antivirus, if needed. See [Enable and configure Windows Defender AV always-on protection and monitoring](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus).
|
||||
- Disable Microsoft Defender Antivirus, if needed. See [Enable and configure Microsoft Defender AV always-on protection and monitoring](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus).
|
||||
|
||||
You can find more information about each section, including options for configuring the sections - such as hiding each of the sections - at the following topics:
|
||||
|
||||
@ -77,20 +77,20 @@ You can find more information about each section, including options for configur
|
||||
## How the Windows Security app works with Windows security features
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Windows Defender AV and the Windows Security app use similarly named services for specific purposes.
|
||||
> Microsoft Defender AV and the Windows Security app use similarly named services for specific purposes.
|
||||
>
|
||||
> The Windows Security app uses the Windows Security Service (*SecurityHealthService* or *Windows Security Health Servce*), which in turn utilizes the Security Center service ([*wscsvc*](https://technet.microsoft.com/library/bb457154.aspx#EDAA)) to ensure the app provides the most up-to-date information about the protection status on the endpoint, including protection offered by third-party antivirus products, Windows Defender Firewall, third-party firewalls, and other security protection.
|
||||
>
|
||||
>These services do not affect the state of Windows Defender AV. Disabling or modifying these services will not disable Windows Defender AV, and will lead to a lowered protection state on the endpoint, even if you are using a third-party antivirus product.
|
||||
>These services do not affect the state of Microsoft Defender AV. Disabling or modifying these services will not disable Microsoft Defender AV, and will lead to a lowered protection state on the endpoint, even if you are using a third-party antivirus product.
|
||||
>
|
||||
>Windows Defender AV will be [disabled automatically when a third-party antivirus product is installed and kept up to date](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||
>Microsoft Defender AV will be [disabled automatically when a third-party antivirus product is installed and kept up to date](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||
>
|
||||
> Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security).
|
||||
> Disabling the Windows Security Center service will not disable Microsoft Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security).
|
||||
|
||||
> [!WARNING]
|
||||
> If you disable the Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device.
|
||||
>
|
||||
> It may also prevent Windows Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed.
|
||||
> It may also prevent Microsoft Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed.
|
||||
>
|
||||
> This will significantly lower the protection of your device and could lead to malware infection.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user